Last updated: 24 July 2026
1. Who we are
This website, twentyeightyears.com (“this site”), is operated by Paul Bellchambers (“I”, “me”, “my”), an individual based on the Isle of Wight, England. For the purposes of UK data protection law, I am the data controller for personal data collected through this site.
Contact: paul@twentyeightyears.com
2. What personal data I collect
I collect personal data only where you choose to give it to me, in the following ways:
- Contact form enquiries: if this site has a contact form, I collect the name, email address, and message content you submit.
- Newsletter sign-up: if you click through to subscribe to the Substack newsletter, that subscription is handled directly by Substack, Inc. — see the Substack Newsletter Privacy Policy on this site for how that data is handled. This site itself does not separately store your email address unless you use a contact form.
- Blog comments: if commenting is enabled and you leave a comment, WordPress collects the name and email address you provide, and your comment text. Your email address is not displayed publicly.
- Technical and usage data: like most websites, this site’s hosting platform (WordPress.com) automatically logs some technical data — IP address, browser type, pages visited — for security and basic site statistics.
3. Cookies
This site may use a small number of cookies — small text files stored on your device — for essential functions and, if enabled, basic visitor statistics. This site does not use cookies for third-party advertising.
4. How I use your data
I use the personal data described above only to:
- Respond to enquiries sent through a contact form
- Publish and moderate blog comments, where enabled
- Maintain the basic security and functioning of the site
I do not sell, rent, or trade your personal data to any third party, and I do not use it for purposes other than those stated here.
5. Lawful basis for processing
Where I process your personal data, I rely on the following lawful bases under UK GDPR:
- Consent — for example, when you voluntarily submit a contact form or leave a comment.
- Legitimate interests — for basic technical and security logging, where this is proportionate and does not override your rights.
6. How long I keep your data
Contact form enquiries are kept only as long as needed to deal with your enquiry and for a reasonable period afterwards for my own records, typically no longer than 24 months. Comments, if enabled, are kept for as long as the associated post remains published, unless you ask for a comment to be removed.
7. Who I share your data with
This site is hosted on WordPress.com, operated by Automattic Inc., which processes technical and hosting data as part of providing the hosting service. Where a newsletter sign-up takes you to Substack, Substack, Inc. processes that data as described in the Substack Newsletter Privacy Policy on this site. I do not otherwise share your personal data with third parties.
8. International data transfers
Automattic Inc. (WordPress.com) and Substack, Inc. are both US-based companies. Where your personal data is transferred outside the UK as a result, this is done under legally recognised safeguards, such as the UK-US Data Bridge or Standard Contractual Clauses, as set out in each provider’s own privacy documentation.
9. Your rights
Under UK GDPR, you have the right to:
- Access the personal data I hold about you
- Ask me to correct inaccurate data
- Ask me to delete your data
- Object to or restrict certain processing
- Ask for your data in a portable format, where relevant
- Complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been mishandled
To exercise any of these rights, contact me at paul@twentyeightyears.com.
10. Children
This site is not directed at children, and I do not knowingly collect personal data from anyone under 13.
11. Changes to this policy
I may update this policy from time to time. The “last updated” date at the top will always reflect the most recent version.