Privacy Policy

Introduction

This Privacy Policy explains how Britain's Steam Railway Encyclopedia ("we", "us", "our") collects, uses, and protects personal data when you visit https://www.steamlocomotives.org. We are the data controller for the personal data described here.

What we collect

• Usage data, pages viewed, time on site, device/browser info, approximate location (country/region), referral source. Collected via Google Analytics 4.
• Advertising data, when advertising is enabled, Google AdSense may set identifiers to show relevant ads and measure performance.
• Consent record, when you choose "Accept", "Reject" or customised consent options, we log an anonymous UUID alongside your choice, our current privacy-policy version, and a timestamp. This audit trail proves compliance and is retained for up to 24 months.
• Contact data, if you email us directly, we retain your message and email address to reply and for a reasonable period afterwards.

Legal basis

Under UK GDPR and EU GDPR, our lawful bases are:

• Consent, for analytics, advertising and personalisation cookies. You can withdraw consent at any time via the Cookie preferences button in the footer.
• Legitimate interests, for essential site operation, security, and the consent audit log itself.

Third parties

We share data with the following processors/controllers:

• Google Analytics 4, website analytics. Google Privacy Policy.
• Google AdSense, advertising (when enabled). How Google uses data from sites that use our services.
• Google Funding Choices, IAB TCF v2.3-certified consent management for visitors in the EEA, UK and Switzerland. Funding Choices help.
• Our web host, processes server logs for security and uptime.

International transfers

Data sent to Google services may be transferred outside the UK/EEA. Google relies on Standard Contractual Clauses and the UK-US / EU-US Data Privacy Framework for these transfers.

Your rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure ("right to be forgotten") where applicable
• Object to processing based on legitimate interests
• Port your data to another service
• Lodge a complaint with the UK Information Commissioner's Office (or your local supervisory authority)

To exercise any of these rights, email us using the contact details below.

Retention

Analytics data is retained by Google for the period configured in our GA4 property (default 14 months). Consent records are retained for up to 24 months. Email correspondence is retained as long as necessary to handle your enquiry and for a reasonable period afterwards.

Security

We use HTTPS, strict cookie settings (SameSite, Secure flags), and a default-deny Consent Mode so no non-essential tracking runs until you agree.

Changes to this policy

We may update this policy from time to time. Material changes will trigger the cookie banner to reappear so you can review. The current version is stored with your consent record.

Contact

For any privacy matter, email us or write to the address shown on our homepage.

Last updated: 2026.