Last updated: 21 April 2026.
This notice tells you what personal data Upper Medway Land Stewards Cluster CIC collects when you visit this website, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
This website is operated by Upper Medway Land Stewards Cluster CIC, a Community Interest Company registered in England and Wales (company number 114-106608). We are the data controller for personal data processed through this site.
To contact us about anything on this page, email contact@uppermedway.org.
Short version
This is a static informational website. It does not use cookies, does not run analytics, does not have a contact form, and does not require a login. The only personal data processing that happens when you visit is:
- Your internet connection's IP address appears in basic server access logs, held for a short period for security and troubleshooting purposes.
- If you click an email link and choose to email us, your email address and anything you write is processed by us and our email provider.
- If you view our interactive maps, your browser fetches basic map-tile images from a third-party map provider, which means that provider sees your IP address.
The rest of this page goes into detail.
What we collect, and why
Server access logs
Our web server (Caddy, running on a UK/EU-hosted virtual machine) keeps a short rolling log of incoming requests. Each log line records the time of the request, the IP address it came from, the page or file requested, the HTTP status returned, and the user-agent string your browser sent.
Why: to detect and mitigate abuse (denial-of-service attacks, automated scanning, attempted intrusions) and to troubleshoot server errors.
Legal basis: legitimate interests (UK GDPR Article 6(1)(f)) — specifically, the interest of keeping a working, secure public website.
How long: logs roll on size (20 MiB) with 3 rolled files kept — typically between a few days and a few weeks depending on traffic.
Who sees it: only the people administering the server on behalf of the CIC.
Email you send us
If you email contact@uppermedway.org (or any equivalent address) your email address and anything you write is processed by us and by the email-hosting provider we use.
Why: to read and reply to your message.
Legal basis: legitimate interests where you have contacted us unsolicited; consent or contract where relevant (e.g. if you ask to join a mailing list or become a cluster member).
How long: we keep emails only for as long as we reasonably need them for the purpose you sent them. Administrative email correspondence is typically kept for up to 3 years; membership-related correspondence for as long as you are a member.
Who sees it: the cluster's directors and any administrator acting on their behalf, plus our email-hosting provider as a data processor.
Third-party map tiles
The Our Area page contains an interactive map that loads map images from OpenStreetMap (tile.openstreetmap.org). When you view that page, your browser requests image tiles directly from OpenStreetMap, which means OpenStreetMap can see your IP address and basic request information. This is industry-standard for open mapping and is subject to the OpenStreetMap Foundation privacy policy.
Why: to display a modern interactive map showing the Environment Agency catchment boundary without us hosting our own global basemap.
Legal basis: legitimate interests (giving you a useful map).
What we do not do
- We do not set any cookies on your browser from this site.
- We do not run any analytics (no Google Analytics, no Plausible, no Fathom, no anything else).
- We do not embed social-media tracking pixels, advertising pixels, or any third-party tracking scripts.
- We do not have a user account system, and we do not store passwords.
- We do not sell data. Ever. We do not have data to sell.
- We do not transfer personal data outside the UK or EEA except where a third-party service (e.g. our email provider) may do so under standard contractual clauses.
Privacy of our members
We take the privacy of our cluster members seriously. This website does not publish the names, contact details, farm names or holding-level information of members or directors. Where formal director information is required (Companies House filings) it appears on the Companies House public register, which is outside our control. If you are a cluster member and spot information on this site that identifies you without your agreement, please email contact@uppermedway.org immediately so we can remove it.
Your rights under UK GDPR
You have the following rights in relation to any personal data we hold about you:
- Right to be informed — this notice.
- Right of access — ask us for a copy of any personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten") — ask us to delete your data, subject to certain exceptions.
- Right to restrict processing — ask us to pause processing of your data in certain circumstances.
- Right to object — object to processing based on legitimate interests.
- Right to data portability — receive your data in a machine-readable format where applicable.
- Rights related to automated decision-making and profiling — not applicable to this site, as we do none.
To exercise any of these rights, email contact@uppermedway.org. We will respond within one calendar month.
Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. If you are still not satisfied, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this notice
We may update this privacy notice from time to time. The date at the top of this page shows when it was last changed. For material changes we will update the top of the page and note the change in summary.