Last updated: 22 October 2026
This notice explains what personal data Cyber-Threat.net collects, why, and what you can do about it. We have tried to keep it short, because we collect very little.
Who is responsible for your data
The data controller is Cyber-Threat.net. You can contact us about anything in this notice at newsletter@cyber-threat.net. Please put “Privacy” in the subject line.
We are based in the United Kingdom, and we handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
What we collect, and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Your email address, and optionally your first name, when you subscribe to The Long Watch | To send you the newsletter you asked for | Consent (UK GDPR Article 6(1)(a); PECR regulation 22) | Until you unsubscribe. After that we keep your address on a suppression list only, so that we never email you by mistake. |
| The date, time, signup form and IP address recorded when you subscribe and confirm | To prove you asked to subscribe, and to keep junk sign-ups out | Legitimate interests (Article 6(1)(f)): keeping a record of consent and protecting the list | As long as you are subscribed, plus the suppression period above |
| Whether you open an email and which links you click | To see which parts of the newsletter are useful, in aggregate, so we can make it better | Consent, given when you subscribe, which you can withdraw by unsubscribing | As long as you are subscribed |
| Anything you send us by email | To reply, and to act on tips and corrections | Legitimate interests: running a publication and answering readers | As long as needed to deal with your message, and then deleted unless it relates to a published correction |
| Server logs, including IP address, browser type and the pages requested | To keep the site running and secure, and to investigate abuse | Legitimate interests: security and running the site | For the limited period our hosting provider keeps them |
We don’t sell your data, we don’t rent our list, and we never pass subscriber details to advertisers or sponsors.
The newsletter
The Long Watch is sent using Kit (formerly ConvertKit), operated by Kit, Inc. in the United States. Kit acts as our processor under its Data Processing Addendum. Sign-up uses double opt-in: nothing is sent until you confirm your address by clicking the link in the confirmation email.
Every issue has an unsubscribe link. Using it stops all further newsletters straight away. If you have also opted into our occasional Flash alerts, you can turn those off separately without leaving the weekly issue.
Cookies and similar technologies
We keep cookies to a minimum.
- Strictly necessary cookies. WordPress, which runs this site, sets cookies when someone logs in to manage the site. Ordinary readers don’t need to log in, so most visitors will never receive these. These cookies are exempt from consent because the site cannot be administered without them.
- Newsletter sign-up form. If you use the sign-up form, Kit may set or read the small amount of information it needs to process your sign-up and stop abuse of the form.
- Analytics. We do not currently use analytics cookies or tracking scripts. If that changes, we will update this notice first and tell you what we use and how to object.
- Advertising. We do not use advertising or cross-site tracking cookies.
You can delete or block cookies in your browser settings at any time. The site will still work.
Search data
We use Google Search Console to see how the site appears in Google search, for example which search terms lead people here and whether pages have been indexed. Search Console places nothing on your device and gives us aggregate figures only. It does not tell us who you are.
Who else handles your data
- Kit, Inc. sends the newsletter and stores the subscriber list.
- Bluehost, part of Newfold Digital, hosts the website and keeps its server logs.
- Google provides Search Console, as described above.
International transfers
Kit and our hosting provider are based in the United States, so some of your data is processed there. Kit states that it complies with the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK recognises as giving adequate protection. Newfold Digital states that it relies on the UK International Data Transfer Addendum and standard contractual clauses for transfers out of the UK. You can read both companies’ privacy terms through the links above.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it if it is wrong;
- ask us to delete it;
- ask us to restrict how we use it, or object to our using it;
- receive it in a portable format, where the law allows; and
- withdraw your consent at any time, which for the newsletter simply means unsubscribing.
To use any of these rights, email newsletter@cyber-threat.net. We will reply within one month. There is no charge.
If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.
Changes to this notice
If we change how we use personal data, we will update this page and the date at the top. If a change matters to subscribers, we will mention it in The Long Watch.