Privacy notice

This notice explains what personal data abundance.wales collects, why, how long we keep it and your rights.

01Who we are

abundance.wales is published by Carbon Machine Limited (company number 12221076, registered in England and Wales). Carbon Machine Limited is the data controller for this website, which means we decide how your personal data is used and we are responsible for protecting it.

• ICO registration number: ZC266168
• Registered office: 40 Burnet Drive, Pontllanfraith, Blackwood, NP12 2FN, United Kingdom
• Privacy contact: enquiries@abundance.wales

02Kept separate from our other work

Carbon Machine Limited also runs a counselling service. abundance.wales is kept fully separate, with its own server, database, mailboxes and statistics. We do not combine abundance.wales data with counselling client data, and we never use one for the other.

03The short version

• We do not use tracking cookies, advertising or tracking pixels.
• We count visits using our own web server’s logs. Nothing is stored on or read from your device to do this.
• Readers do not need an account. There are no comments and no newsletter sign-up at the moment.
• Our website and its data are hosted in the UK. We do not sell your data.

04What we collect and why

1. When you visit the website

Our web server logs each request:

• your IP address
• the date and time
• the page or file requested, including any search words you type into our site search
• the page that linked you to us (if your browser sends it)
• your browser and device type (the “user agent”)
• whether the request worked

Why: to keep the website secure (for example, blocking attacks and repeated failed log-ins), to fix faults, and to produce visit statistics.

Visit statistics: we use GoAccess, an open-source tool that builds reports from these server logs. There is no tracking code on our pages and no cookies. In the reports, IP addresses are anonymised and automated traffic (bots) is filtered out. The reports show totals only. They are private, behind a login, and never published. We do not use them to identify or profile you, or for advertising.

Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)). Our interests are keeping the site secure and working, and understanding our readership. The impact on you is small: logs are kept briefly, reports are anonymised and only our hosting provider has access.

How long: server logs are deleted after 30 days. Statistics reports contain no IP addresses and may be kept longer. Server backups may hold logs and other data for a short time after that: nightly database copies are kept for 14 days and server snapshots for up to 30 days.

2. Emails you send us

This covers all email to us, including our contact, corrections, complaints, tips and accessibility addresses, and right of reply responses. We receive your name, email address, what you write and anything you attach.

Why: to reply, deal with your request or tip, and keep a record of what we did.

Lawful basis: legitimate interests in running the publication and answering people who contact us.

How long: general emails are kept for 12 months after the last message, then deleted. Complaints and right of reply records are kept for up to 6 years where we need them to deal with possible legal claims. Both are our own suggested policy figures, not legal requirements.

Please do not send sensitive information (for example about your health) unless you need to. If you send a tip, tell us if you want to stay anonymous.

3. Right of reply and quotes

We publish analysis of AI policy in Wales and support no political party. If we criticise a named person or organisation, we put the main points to them before publishing and give them a fair chance to respond.

When we do this, or ask for a quote, we use the person’s name, role, organisation and work contact details (usually from public sources) and keep their response.

Why: to report fairly and accurately and to give people a right of reply.

Lawful basis: legitimate interests in publishing accurate, balanced journalism and analysis on matters of public interest. Data protection law has special provisions for journalism, which in some cases may affect how certain rights apply. If we ever rely on them, we will consider each case carefully.

How long: as for complaints, up to 6 years (see section 2), so we can show what we put to people and what they said.

4. People with a log-in to the website

People who write and edit for us have accounts on the website. We hold their name, username, email address and a record of their changes.

Why: to run the site securely and keep an audit trail.

Lawful basis: legitimate interests in running a secure website. Activity records are kept for 90 days.

5. How we use AI tools

We use AI tools to help research and draft articles. They do not read or handle the emails you send us: a person reads every email. If that ever changes, we will update this notice first.

A human, our Editor-in-Chief, approves everything before it is published. AI tools do not make decisions about you.

05Cookies

We set no cookies for readers. WordPress sets cookies only for people who log in to edit the site. See our Cookies page.

06Who we share data with

We do not sell or share your data for marketing. These providers act only on our instructions, under contract:

Provider	What they do	Where
Amazon Web Services EMEA SARL (AWS)	Hosts the website server and its backups (Amazon Lightsail)	London, UK
Amazon Web Services EMEA SARL (AWS)	Sends system email from the website (Amazon Simple Email Service)	London, UK
Google (Google Workspace)	Holds the emails you send us	Google’s data centres, which may be outside the UK (including the US), under Google’s data processing terms and UK transfer safeguards

We may also share information where the law requires it, to protect our rights or others’ safety, or with professional advisers such as a solicitor.

If you contact us through our social media accounts (X and LinkedIn), those platforms handle your data under their own privacy policies.

07Where your data is stored

The website and its backups are stored in AWS’s London region, in the UK. Apart from any transfer named in the table above, we do not plan to transfer personal data outside the UK. If we do, we will put suitable safeguards in place and update this notice.

08Your rights

Under UK data protection law you have the right to:

• access a copy of your personal data
• correct data that is wrong
• have data deleted in some circumstances
• restrict how we use your data in some circumstances
• object to us using your data where we rely on legitimate interests
• data portability, where it applies (it usually does not apply to legitimate interests processing)

Objecting to log-based statistics: if you do not want your visits counted in our statistics, email us at enquiries@abundance.wales. Tell us your IP address and the approximate dates, as we cannot otherwise match log entries to you. We will exclude them from our statistics. We may still keep raw logs for up to 30 days where needed for security, unless your reasons outweigh that need.

We do not make decisions about you by automated means alone, and we do not profile readers.

To use any of your rights, email enquiries@abundance.wales. We will reply within one month, normally free of charge, and may ask you to confirm your identity.

09Complaints

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

10Changes to this notice

We will update this notice if what we do changes, for example if we add a newsletter. The date at the top shows the last change. Where the law requires it, we will ask for your consent first.