Privacy Policy

1. Who we are

Gram Culture ("we", "us", "our") publishes gramculture.com, the Gram Culture Briefing, our reports and the Gram Culture+ membership. We decide what personal data those services collect and why, which under UK and EU law makes us the controller of it.

Controller: Gram Culture
Write to us: [email protected] — the same address for a question, a correction or a request under section 8.

2. What we hold

Two kinds of thing, and not much of either.

What you hand us

An email address, when you join the Briefing or ask for a report. A name and company, if you choose to add them to a form. Whatever you write in a message to the desk. Billing details if you buy a membership — those go straight to our payment processor and we never see a full card number.

What your browser tells us

Which pages were opened, from where, for how long, and on what kind of device. An IP address arrives with every request; we use it to tell readers apart in aggregate and to stop abuse, not to build a profile of you. We do not buy data about you from anyone, and we run no advertising trackers.

3. What we do with it

Send you the thing you asked for. Answer you when you write. Count what is read, so we commission more of what works. Take payment, where there is something to pay for. Keep the records the law requires us to keep. That is the list — if we ever want it for something else, we will ask first.

4. Why we are allowed to (UK and EU readers)

Consent for the Briefing and any other marketing email, withdrawable in one click from the bottom of every one. Contract for anything you have paid for. Legitimate interest for keeping the site up, measuring readership and preventing abuse — interests we have weighed against yours, and which you can object to under section 8. Legal obligation for the rest.

5. Who else touches it

We do not sell your data, and we do not share it for anyone else's marketing. A short list of suppliers process it on our instructions so the site can work at all:

• an email provider, to deliver the Briefing and replies;
• an analytics provider, for aggregate readership figures;
• a payment processor, for memberships;
• our hosting and content-delivery providers, which necessarily handle requests as they are served.

Each is bound by a data-processing agreement. Current names are available on request from [email protected]; we keep them out of this page so the page cannot go quietly out of date when one changes.

6. Cookies

Two kinds. The ones that keep you signed in and remember your theme, which the site cannot work without, and the ones that count readers. You are asked about the second kind on your first visit and can change your mind at any time in your browser. Declining costs you nothing but our statistics.

7. How long we keep it

Subscription data for as long as you are subscribed, then 90 days — long enough to honour an unsubscribe if a stale list is loaded by mistake. Correspondence for three years. Aggregate analytics for 26 months. Billing records for as long as tax law requires. Then it goes.

8. Your rights

You can ask for a copy of what we hold, have it corrected, have it deleted, take it elsewhere in a portable form, object to processing based on legitimate interest, or withdraw consent. Write to [email protected] and we will answer within 30 days. No account, no hoops, no fee. If we get it wrong you can complain to your national data protection authority — in the UK, the Information Commissioner's Office.

9. Keeping it safe

Everything travels over HTTPS, access to reader data is limited to the people who need it, and credentials are rotated. No system is perfect; if a breach ever affects you we will tell you and the relevant regulator within the time the law allows, and we will tell you what we actually know rather than wait for a tidy story.

10. Where it goes

We work from London, Singapore and New York, and some of our suppliers are in the United States, so your data may be processed outside the UK and EEA. Where it is, the transfer rests on the UK addendum and the EU standard contractual clauses, or on an adequacy decision.

11. When this changes

We will post the new version here with a new date, and if the change matters to you we will say so in the Briefing rather than hope you re-read the page.

12. Contact

Questions about this policy? Email [email protected].