Privacy Policy

FamFusion is a trading name of Q25 LTD, a company registered in England and Wales with company number 12990025. Our registered office is 34 Dunelm Road, Trimdon, Trimdon Station, England, TS29 6PX.

Q25 LTD is the controller of the personal information described in this policy. That means we decide why and how it is used and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything about privacy, including using your rights, email info@q25.co.uk or write to us at our registered office. We have not appointed a Data Protection Officer because the law does not require one for the processing we carry out; your message will reach the person responsible for data protection at Q25 LTD.

Q25 LTD is registered with the Information Commissioner's Office as a data controller, registration number ZA890536.

This policy covers the FamFusion website at famfusion.co.uk (including the Journal and our informational pages), the private Admin area used by our editorial team, and emails you exchange with us about FamFusion.

Older addresses on the q25.co.uk domain now redirect to FamFusion. The redirect happens on the same hosting platform described below and does not involve any additional processing.

Websites we link to (for example research we cite in an article) have their own privacy policies. We are not responsible for how they use information.

When you visit the website

Every time a browser requests a web page, it sends technical information. To deliver FamFusion to you and keep it secure, our hosting provider processes: your IP address, the date and time of the request, the page or file requested, the referring page if your browser sends one, your browser and device type (the user agent) and technical response information such as errors.

We use this to send pages to your browser, route requests to the nearest part of the hosting network, detect and block attacks and abuse (for example denial-of-service traffic), and investigate faults. We do not use it to build a profile of you, to follow you across websites or to find out who you are, and we do not combine it with other information for that purpose.

Lawful basis: legitimate interests (Article 6(1)(f) UK GDPR). Our interest is operating a website that works and is secure. This processing is expected, limited to what a web server needs, and kept for a short time, so we consider that it does not override your interests. You can object, as explained under Your rights.

When you contact us

If you email us, we receive your email address, your name if you include it, the content of your message, anything you attach and the email's technical details. We use it to read and answer your message, to keep a record of what was said and to deal with any follow-up, complaint or request.

Lawful basis: legitimate interests in responding to people who contact us and keeping proper records. Where your message is about a contract with us, the basis is taking steps at your request or performing that contract (Article 6(1)(b)). Where you ask us to use your data protection rights, we process your request because the law requires us to (Article 6(1)(c)).

Please do not send us sensitive information (for example about health) or information about your children unless it is necessary. If you do, we will use it only to deal with your message.

If you are a member of our editorial team (Admin accounts)

The Admin area is private and available only by invitation to people who write, review or publish FamFusion content. If you have an Admin account, we process:

• your name, email address and role (for example editor or administrator);
• your password, stored only as a one-way cryptographic hash that we cannot read;
• your invitation (the email address it was sent to, who created it, when it expires and whether it was accepted or revoked; the invitation link itself is stored only as a hash);
• sign-in records: the email address entered at sign-in, the time and whether it succeeded, used to limit password-guessing;
• your editorial activity: articles, revisions, change and review notes, photographs you upload, workflow events (such as submitting, approving or publishing) and a short-lived indicator that you are editing a particular article;
• the session cookie and browser storage described in our Cookie Policy.

We use this to give you secure access, to control what each role may do, to keep an accurate history of who changed what and when (which protects both you and our readers), to prevent unauthorised access and to deal with any dispute or incident.

Lawful basis: where you work with us under an agreement, performing that agreement (Article 6(1)(b)); otherwise legitimate interests in running a secure, accountable editorial process. Keeping security and audit records is also in our legitimate interests.

Information in published articles

Published articles are credited to FamFusion; the names of the team members who write, review or publish them are kept internally for editorial accountability and are not shown on the public website. Articles may contain photographs. When a photograph is uploaded we automatically remove hidden information from the file, including location (GPS) data and camera details. We only publish photographs of identifiable people where we have a proper basis to do so, such as permission. If you appear in something we have published and would like it reviewed or removed, contact us.

Legal, security and business needs

We may use any of the information above where necessary to comply with the law, respond to lawful requests from public authorities, establish or defend legal claims, prevent fraud or crime, or keep our systems and people safe. The lawful basis is legal obligation (Article 6(1)(c)) or legitimate interests in protecting our business, users and the public.

We do not currently rely on consent for any processing. If we introduce something that needs your consent, we will ask clearly first and you will be able to withdraw that consent as easily as you gave it.

• We do not use analytics, display advertising, advertising or affiliate cookies, social media pixels, tracking cookies or device fingerprinting on FamFusion.
• We do not sell or rent personal information, or share it for advertising.
• We do not send marketing emails.
• We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile visitors.
• We do not load fonts, scripts or embedded content from other companies on our public pages.

Some articles may contain affiliate links to retailers such as Amazon (see Affiliate links and advertising in our Terms). Clicking one is your choice. When you do:

• you leave FamFusion and go to the retailer's website. We do not send the retailer your name, email address or any other personal information, and our links tell your browser not to share the address of the FamFusion page you were reading;
• the link itself contains FamFusion's affiliate identifier, so the retailer can tell that the visit came from FamFusion;
• the retailer, and the affiliate programme it runs, may use cookies and record your visit and any purchases under its own privacy and cookie notices, acting as a separate controller. For Amazon this is described in Amazon's privacy notice;
• the retailer reports to us only commission information, such as the number of clicks and qualifying purchases, which does not tell us who you are. We do not combine it with anything that could identify you.

We use a small number of service providers who handle information on our behalf to run FamFusion. Each provider's handling of personal information is governed by its terms with us, and we only share what each one needs to provide its service:

We may also share information, where necessary, with professional advisers (such as lawyers and accountants) under a duty of confidentiality; with the police, courts, regulators or other authorities where the law requires or allows it; and with a buyer or successor if our business or FamFusion is reorganised, sold or transferred, who would have to continue to protect it in line with this policy.

We will name any new important service provider in an update to this policy.

Our database and photograph storage are located in the Netherlands and our application code runs in London. However, Vercel, Railway and Google are United States companies or part of United States groups, and they, Railway's storage infrastructure provider Tigris, or their support and security teams may access information from the United States or other countries outside the UK. UK law allows personal information to be transferred abroad only with appropriate protection.

• Vercel Inc. and Railway Corporation are listed by the US Department of Commerce as active participants in the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"). UK adequacy regulations recognise that framework as providing adequate protection for personal information transferred to participating US organisations.
• Google provides Google Workspace under its Cloud Data Processing Addendum, which forms part of the Google Workspace agreement and provides for standard contractual clauses or another recognised transfer mechanism where information is transferred to a country without adequacy status.
• For any other access from outside the UK, including by our providers' own subcontractors, we require an appropriate safeguard recognised by UK law.

You can ask us for more information about the safeguards for a particular provider by emailing info@q25.co.uk.

We keep personal information only for as long as we need it for the purposes above, then delete or anonymise it.

Exceptionally, we may keep a specific sign-in attempt or invitation record for longer than 90 days where it is reasonably necessary for an active security investigation, a legal obligation or a legal claim, and only until that need ends.

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS with HSTS), hashed passwords and invitation links, limits on repeated sign-in attempts, role-based access controls checked on the server for every Admin action, private storage for photographs, removal of hidden photo metadata, security headers that stop other sites framing FamFusion, and restricted access to production systems.

No system can be perfectly secure. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it and, where the risk is high, tell the people affected without undue delay.

FamFusion is written for parents, carers and other adults. The public website can be read without giving us any personal information, it has no accounts, comments or uploads for the public and it uses no tracking, so we do not knowingly collect personal information from children through it.

If a child has contacted us by email, a parent or carer can ask us to delete that information. Children also have the same data protection rights as adults.

In the future FamFusion may let Families include children, under the control of responsible adults. That will not happen until we have completed the assessments UK law requires, designed it in line with the ICO's Age Appropriate Design Code (the Children's Code) and published an updated policy explaining it in language children can understand.

Under UK data protection law you have the right to:

Access

ask whether we hold information about you and for a copy of it, with details of how we use it.

Rectification

have inaccurate information corrected and incomplete information completed.

Erasure

ask us to delete information in certain circumstances, for example when we no longer need it.

Restriction

ask us to limit how we use information in certain circumstances, for example while we check its accuracy.

Objection

object to our use of information where we rely on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, or we need it for legal claims. You can object to direct marketing at any time and we will always stop.

Portability

receive information you gave us, in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we process it by automated means on the basis of consent or a contract.

Withdraw consent

withdraw consent at any time where we rely on it, without affecting what we did before. (We do not currently rely on consent.)

Automated decisions

not to be subject to significant decisions made solely by automated means, with safeguards. We do not make such decisions.

To use any right, email info@q25.co.uk. We may need to confirm your identity. There is normally no fee. We will respond without undue delay and within one month, which can be extended by up to two further months for complex or numerous requests (we will tell you if so). We will carry out reasonable and proportionate searches for your information. Some rights have legal exceptions; if one applies, we will explain.

If you are unhappy with how we have used your personal information, please tell us first at info@q25.co.uk (with "Data protection complaint" in the subject, if you can). We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. The ICO usually expects you to have raised the matter with us first.

No. You can read FamFusion without giving us any personal information beyond the technical data every browser sends. If you email us, we need your email address to reply. Admin team members must give their name and email address to receive an account; without them we cannot provide access.

We will update this policy when the way we use personal information changes, including before we release any new feature that processes personal information in a new way. The version number and date at the top show when it last changed, and the version history summarises each change. If a change significantly affects people whose information we already hold, we will tell them directly where we are able to.