Who we are
The Hackney Citizen is published by Citizen News & Media Limited, a company registered in England and Wales (company number 06426082). We are the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it.
This policy explains what personal data we collect when you read our website, sign up to our newsletters, become a paying supporter or get in touch with us. It also explains your rights and how to use them.
We are registered with the Information Commissioner's Office (ICO) under registration number ZB273681. You can check our entry on the ICO's public register.
We have not appointed a data protection officer, as the law does not require one for an organisation of our size. For any question about your data, contact:
- Email: office@hackneycitizen.co.uk
- Post: Data protection, Citizen News & Media Limited, 9 Perseverance Works, 38 Kingsland Road, London E2 8DD
Our website is for a general adult readership. We do not knowingly collect personal data from children under 13, and you must be 18 or over to take out a paid membership.
What we collect and why
We collect only what we need for each purpose below. The law requires us to have a lawful basis for each one, and we have set these out alongside.
| What you do | What we collect | Why we use it | Lawful basis |
|---|---|---|---|
| Read our website | Your IP address, browser type and the pages you request, recorded in our hosting provider's server logs. Stripe also collects cookie identifiers and device information for fraud checks. Our analytics records pages viewed, how you arrived, and your country, device and browser type, without cookies (see Cookies) | To deliver pages to you, keep the site secure, prevent payment fraud and understand which stories are read | Legitimate interests (running a secure website, preventing fraud and improving our journalism) |
| Sign up to a newsletter | Your email address, your name if you give it, the date you signed up, the page you signed up on and which newsletters you chose | To send you the newsletters you asked for | Consent |
| Receive a newsletter | Which links in our emails you click | To understand which stories readers find useful | Legitimate interests (improving our journalism) |
| Take out a paid membership | Your name, email address, membership level, payment dates and a customer reference from our payment provider | To provide your membership, send receipts and manage renewals and cancellations | Contract |
| Pay us | Your card or bank details, entered directly with Stripe. We never see or store your full card number | To take payment | Contract |
| Keep our accounts | Records of payments and memberships | To meet our tax and accounting obligations | Legal obligation |
| Email, write to or call us | Your name, contact details and whatever you choose to tell us | To reply to you, and to investigate and report where you have given us information for a story | Legitimate interests, or the journalism exemption (see Our journalism) |
| Advertise with us or supply us | Business contact details and correspondence | To arrange and deliver advertising and services | Contract, or legitimate interests |
We do not sell your personal data, and we do not use it for targeted advertising or profiling. We will only send you marketing about our own products, such as membership offers, if you have agreed to it.
Our journalism
This policy covers readers, subscribers, members and the people who contact us. It does not cover personal data we process to research and publish journalism.
Reporting on Hackney means we gather and publish information about people, including councillors, officials, businesses and members of the public. Some of it may be sensitive. The Data Protection Act 2018 (Schedule 2, Part 5) recognises the importance of a free press. It exempts processing for journalism from many data protection rules where we reasonably believe publication is in the public interest.
We treat information from sources in confidence. We will not reveal a confidential source's identity without their permission.
If you are concerned about something we have published about you, please use our editorial complaints procedure rather than a data protection request. That way your concern reaches the editor directly.
Newsletters
When you sign up, you choose which of our newsletters to receive. You can change your choices or unsubscribe at any time using the link at the bottom of every email, or from your account page on our website.
Our newsletters do not track whether you open them. Links in our emails pass briefly through our email system, which records that a link was clicked so we can see which stories readers find useful. We look at this information in aggregate and do not use it to profile individual readers.
We also send a small number of service emails that are not newsletters, such as sign-in links, payment receipts and changes to your membership. You will receive these while you have an account with us, even if you have unsubscribed from all newsletters.
Comments
Signed-in members can comment on our articles. Your comments are public: anyone visiting the site can read them, shown with the name in your account and any short bio you choose to add. We store your comments, when you posted them and any comments you like, so that we can display them and moderate the discussion. We use this data to provide the commenting service you signed up for (contract), and to moderate comments and keep the discussion lawful (legitimate interests).
We may hide or remove comments that break our community standards. If another reader reports a comment, we receive the report so we can review it.
You can edit or delete your own comments at any time. If you delete your account, your comments stay on the site but are anonymised, so they are no longer shown with your name.
Payments
Paid memberships are processed by Stripe. When you pay, you enter your card or bank details on Stripe's secure payment page, not on our website. We never see or store your full card number.
Stripe shares with us your name, email address, the last four digits and expiry date of your card, and the status of your payments. We need this to manage your membership.
Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal obligations. For those purposes it is a separate data controller. See Stripe's privacy policy for details.
You can cancel a paid membership at any time from your account page. Cancelling stops future payments. Your access continues until the end of the period you have already paid for.
Cookies and third-party services
We do not use advertising or analytics cookies. The only cookies on our website are our own sign-in cookie and two cookies set by our payment provider, Stripe, to prevent fraud.
We measure visits to our website using the analytics built into Ghost, the platform our site runs on. It uses no cookies and stores nothing on your device. It records which pages are viewed, how visitors arrived (for example from a search engine or social media), and visitors' country, device and browser type. It counts unique visitors within 24-hour windows, so it cannot recognise you from one day to the next. Analytics data is stored in the EU, and we use it only to understand which of our journalism readers find useful.
If you sign in to your account, our website sets a cookie that keeps you signed in as you move between pages. This cookie is strictly necessary for the account to work, so we do not ask for consent to it. It is deleted when you sign out.
Because we take payments through Stripe, Stripe's code loads on every page of our website, not only when you pay. It sets two cookies: __stripe_mid, which lasts one year, and __stripe_sid, which lasts 30 minutes. Stripe uses these, together with information about your device and browser, to detect and prevent fraudulent payments. It does this as a separate data controller, under Stripe's privacy policy and cookie policy. We do not receive this information, and we do not use it ourselves.
Each time a page loads, your browser also contacts jsDelivr, a public content delivery network that supplies the code for our site search, comments and sign-up and account window. It receives your IP address and the address of the page you are reading, but sets no cookies.
Most videos in our articles are shown as a still image with a Play button. Nothing loads from YouTube until you press Play; the video then plays from YouTube's privacy-enhanced service (youtube-nocookie.com), and YouTube may store information on your device from that point. Posts from X (formerly Twitter) are shown as quotations, with a link to the original, and nothing loads from X.
Some older articles still contain material embedded from other services, including videos from YouTube, Vimeo and Dailymotion, audio from SoundCloud, Spotify and Bandcamp, posts from Instagram and Facebook, and maps from Google Maps. A few older articles also load typefaces from Google Fonts. When you open one of these articles, your browser contacts that service, which receives your IP address and the address of the page, and may set its own cookies or store information on your device. These services are controlled by their providers under their own privacy policies, not by us.
You can block or delete cookies in your browser settings. If you block our sign-in cookie, you will not be able to stay signed in. If you block Stripe's cookies, you may not be able to pay us.
Who we share your data with
We use a small number of service providers to run our website, newsletters and memberships. They process your data only on our instructions, under contracts that require them to keep it secure.
| Provider | What they do for us | Their privacy information |
|---|---|---|
| Ghost Foundation | Hosts our website, stores member and subscriber records, sends our newsletters and measures visits to our website, using its own sub-processors for server hosting, content delivery, email delivery and analytics | ghost.org/privacy and ghost.org/dpa |
| Stripe | Processes membership payments and runs fraud checks on our website | stripe.com/gb/privacy |
| jsDelivr | Supplies the code for our site search, comments and sign-up window | jsdelivr.com privacy policy |
We may also disclose personal data where the law requires it, for example under a court order. We will not identify a confidential journalistic source.
Transfers outside the UK
Ghost stores our website and membership data in the European Union, which UK law recognises as giving equivalent protection. Ghost and some of its sub-processors may also process data in other countries; where they do, Ghost's data processing agreement requires standard contractual clauses to protect it. Stripe may process payment data in the United States, protected by the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses. You can ask us for more detail about the safeguards for a particular provider.
How long we keep your data
We keep personal data only as long as we need it for the purpose we collected it.
| Data | How long we keep it |
|---|---|
| Newsletter subscriptions | Until you unsubscribe or delete your account. We may also remove subscribers who have not engaged with any newsletter for two years. If you unsubscribe, we keep your email address on a do-not-contact list so that we do not email you again. |
| Free and paid member accounts | Until you delete your account, or two years after a paid membership ends if you have not signed in since |
| Payment and accounting records | Six years after the end of the financial year they relate to, as required for tax purposes |
| Correspondence | Two years after our last contact with you, unless it forms part of our editorial records |
| Server logs | As set by our hosting provider, normally no more than a few weeks |
Comments stay on the site until you delete them, and are anonymised if you delete your account. We may keep data longer if we need it for a complaint or a legal claim.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete your data
- ask us to restrict how we use your data
- object to our use of your data where we rely on legitimate interests
- receive data you gave us in a portable format, or have it sent to another organisation
- withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
You can object at any time to our use of your data for direct marketing, and we will stop.
Some of these rights do not apply in every case. For example, we must keep accounting records for six years, and the rights are limited for data held for journalism. If we cannot do what you ask, we will explain why.
To use any of these rights, contact us at office@hackneycitizen.co.uk. There is no fee. We may ask you to confirm your identity. We will respond within one month, or tell you within that month if we need longer.
Complaints
If you are unhappy with how we have handled your data, please contact us first. We will acknowledge your complaint within 30 days and try to put things right.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow SK9 5AF.
Changes to this policy
We review this policy regularly and will update it if we change how we use personal data. If a change affects how we use data we already hold, we will tell members and subscribers by email before it takes effect.
This policy was last updated on 7 October 2026.