← Cogniosynthesis Portal

Privacy Policy

Company: Cogniosynthesis Portal Ltd (trading as CognioNews, CognioEngine, MoltHumanities, FestivalFocus)

Company Number: 16225073

Registered in: England and Wales

Registered office: 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ

Data protection registration: ZC269688

Privacy contact: privacy@cogniosynthesisportal.uk

Version: 1.4

Last reviewed: 2026-10-21

Next review: 2027-10-21

Effective Date: 22 October 2026

1. WHO WE ARE

Controller: Cogniosynthesis Portal Ltd, company number 16225073, registered office 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We are registered in England and Wales and trade as CognioNews, CognioEngine, MoltHumanities, FestivalFocus and OldSchool Search.

This notice covers cogniosynthesisportal.uk and its subdomains, and the services we provide through them. Where a specific product has its own additional notice, that notice applies alongside this one.

We are registered with the Information Commission, the UK data protection regulator, under registration number ZC269688.

We have not appointed a data protection officer, because the law does not require us to. Kenny Lewis, Director, is responsible for data protection. You can contact us about anything in this notice at privacy@cogniosynthesisportal.uk.

2. WHAT PERSONAL DATA WE COLLECT

We collect only what we need to run the service and to deal with you as a customer, reader or business contact.

Contact and account data: name, email address, and where relevant your organisation, role and telephone number, when you subscribe, register, submit a story or contact us.
Subscription and payment data: the plan you hold, its status, billing period and renewal date, and payment references from Stripe. Stripe collects and holds your card details. We do not receive or store your card number, expiry date or security code.
Content you give us: story submissions, comments, survey responses, emails and other messages you send us, including any files you attach.
Usage and device data: the pages you view on this site, the page you arrived from, approximate location (city level), device type, browser and operating system, and your IP address in our server logs. Analytics data is collected only if you accept analytics (see section 9).
Correspondence and support records: the history of your enquiries and our replies.
Business prospect data: see the supplementary section on B2B prospect data below.

If you subscribe to CognioNews Premium, you need to give us your email address to subscribe and sign in. Without it we cannot provide Premium. The CognioNews privacy notice describes the Premium data in full.

We do not knowingly collect special category data (for example health, ethnicity, religion, political opinions, biometric or genetic data), and we do not buy personal data from data brokers.

3. HOW WE USE YOUR PERSONAL DATA

To provide the service: publishing content, delivering the pages you request, and managing your access and preferences.
To create and administer your subscription or account, and to take and manage payment.
To send you the newsletters, digests and service messages you have asked for, and to handle unsubscribes.
To answer your enquiries, deal with complaints and provide support.
To keep our own records, including accounting, tax and VAT records required by law.
To keep the service secure and available: detecting abuse, fraud, scraping, attacks and technical faults.
To understand how the site is used, where you have consented to analytics.
To introduce our services to named people at organisations, under the B2B section below.
To establish, exercise or defend legal claims.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects about you, and we do not sell your personal data. Our AI analysis is applied to published news content, not to profiles of individual readers.

4. OUR LAWFUL BASES

Purpose	Lawful basis (UK GDPR)
Providing the service you have asked for, including a paid subscription such as CognioNews Premium, and administering your subscription or account	Performance of a contract — Article 6(1)(b)
Taking payment and managing billing, refunds and cancellations	Performance of a contract — Article 6(1)(b)
Sending newsletters and digests you have subscribed to	Consent — Article 6(1)(a), or soft opt-in under the Privacy and Electronic Communications Regulations 2003 where you are an existing customer
Responding to enquiries and providing support	Legitimate interests — Article 6(1)(f): serving our customers
Keeping the service secure, preventing abuse and maintaining logs, including a log of sign-in events and limiting repeated sign-in requests	Legitimate interests — Article 6(1)(f): preventing misuse of the service and of your account
Keeping your account details for 90 days after a subscription ends, to deal with refunds, cancellations and queries, or a quick restart	Legitimate interests — Article 6(1)(f)
Analytics cookies	Consent — Article 6(1)(a), collected through our cookie banner
B2B prospect outreach	Legitimate interests — Article 6(1)(f), as set out in the B2B section below
Billing records, accounting, tax and other statutory records	Legal obligation — Article 6(1)(c)
Establishing, exercising or defending legal claims	Legitimate interests — Article 6(1)(f), or legal obligation where a claim is compulsory

Where we rely on legitimate interests, we balance our interest against your rights and reasonable expectations. Where we rely on consent you can withdraw it at any time, without affecting processing carried out before withdrawal.

5. WHO WE SHARE IT WITH

We do not sell personal data. We share it only where we need to in order to run the service, and only with organisations that are bound to protect it.

Payment processing: Stripe Payments UK Ltd and the Stripe group. Stripe processes card data as an independent controller for payment processing and fraud prevention. We receive limited transaction data back from Stripe to reconcile your subscription.
Hosting and infrastructure: our hosting provider, with servers in the United Kingdom. It hosts our websites, server logs and service data.
Analytics: Google LLC (Google Analytics), only where you have accepted analytics cookies.
Email delivery: our email provider (UK), which sends our newsletters and service emails such as receipts and sign-in links.
Professional advisers: our accountants, auditors and lawyers, where necessary and under duties of confidence.
Authorities and third parties: where we are required by law, by a court order, or where necessary to establish, exercise or defend legal claims, or to protect someone's vital interests.
Business transfers: if we sell or transfer all or part of the business, relevant data may be transferred to the buyer under equivalent protections.

We do not use advertising networks or social media tracking pixels on this site, and we do not share personal data for others' marketing.

6. INTERNATIONAL TRANSFERS

Our hosting provider's servers are in the United Kingdom, and our email provider is in the United Kingdom. Some of our processors are based in, or may access data from, the United States:

Google LLC — covered by the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework). See Google's transfer safeguards.
Stripe, LLC — covered by the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework). If the Data Bridge cannot be used, Stripe's Data Transfers Addendum applies the UK International Data Transfer Addendum instead.

Where we transfer personal data outside the UK, we rely on UK adequacy regulations, including the UK–US Data Bridge. If those regulations stop applying to a recipient, we will only continue the transfer under another lawful safeguard, such as the UK International Data Transfer Addendum, after checking that the transfer meets the legal test for that safeguard. You can ask us for details of the safeguards used for a particular transfer.

7. HOW LONG WE KEEP IT

Data	Retention period
CognioNews Premium accounts: email address, name (from Stripe), preferences, subscription status, renewal or end date, and Stripe customer and subscription references	While your subscription is active, then 90 days after it ends. We check every subscription with Stripe about once a day
Email addresses entered at Premium sign-in that do not belong to a Premium subscription	Deleted within about 25 hours. The security log keeps a record of the attempt for 12 months, in a form that does not reveal the address
Billing and payment records (held by Stripe and in our accounts)	6 years from the end of the company financial year they relate to, because tax and company law require it
Newsletter subscription details	Until you unsubscribe, then 30 days, except a minimal suppression record kept so we do not email you again
Enquiries, complaints and support correspondence	24 months from the last contact
Story submissions and other content you send us	While published, and 12 months after we stop using it
Sign-in sessions	Up to 30 days while you are signed in, then deleted within a further 30 days
Security log of sign-in events	12 months
Records used to limit repeated sign-in requests, including IP addresses	24 hours
Web server logs, including IP addresses	Up to 15 days
Service system logs (which hold a coded reference to your email, not the address itself)	Up to 30 days
Backup copies of our service data	Up to 30 days. Data deleted from our systems may remain in a backup until then
Analytics data	Up to 12 months, or as described in section 9
Consent records	6 years from the date of the choice, as described in section 9
B2B prospect data	As described in the B2B section below

We may keep data longer where it is needed for a complaint, an ongoing legal claim or a security incident, or where the law requires it. When a retention period ends we delete or irreversibly anonymise the data.

8. YOUR RIGHTS

Under the UK GDPR you have the right to:

be informed about how we use your data — this notice does that;
access a copy of the personal data we hold about you;
rectify data that is inaccurate or incomplete;
erase your data where there is no good reason for us to keep it;
restrict processing while a concern is resolved;
object to processing based on legitimate interests, and to direct marketing at any time, absolutely;
data portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible;
withdraw consent at any time where we rely on consent;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions about you.

To exercise any of these rights, email privacy@cogniosynthesisportal.uk. We will respond within one month; if a request is complex we may extend that by up to two further months and will tell you why. Exercising your rights is free. We may ask for proof of identity so that we do not disclose data to the wrong person.

If you are unhappy with our response, you can complain to us or to the Information Commission — see section 13.

B2B prospect data and direct marketing (supplementary)

This section supplements sections 2–8 and applies to named people we contact in their professional capacity.

Controller: Cogniosynthesis Portal Ltd, company number 16225073, registered office: 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. This section applies to our group brands, including CognioEngine.

We may contact named people at organisations using contact details obtained from public business sources, such as organisation websites, professional directories and published business profiles. We do this to introduce services relevant to their professional role and organisation and to manage any resulting business enquiries.

Our lawful basis for processing this personal data is legitimate interests, Article 6(1)(f) UK GDPR: developing relevant business relationships and promoting our services. We use business contact details; this basis does not override any separate requirement for consent to send electronic marketing.

We hold only the information needed for this purpose: name, role, business email address, organisation, public source and contact history.

Retention: we delete prospect data if there is no engagement within 12 months of collection. We keep minimal suppression entries indefinitely so that we do not email anyone who has objected to direct marketing. We screen intended recipients against the suppression list before sending. Email marketing consent records are retained for six years from confirmation; the separate cookie-consent record period is described above.

You have an absolute right to object to the use of your personal data for direct marketing at any time. Use the unsubscribe link in our marketing emails or email privacy@cogniosynthesisportal.uk. You do not need to give a reason. We action objections within one working day, stop using your data for direct marketing and retain only the minimal suppression information needed to honour your objection.

10. CHILDREN'S PRIVACY

Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact privacy@cogniosynthesisportal.uk and we will delete it promptly.

11. KEEPING YOUR DATA SECURE

We are responsible for keeping your personal data secure, and we require the organisations that handle it for us to do the same. If you are worried about the security of your data, contact privacy@cogniosynthesisportal.uk.

12. DATA BREACHES

If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the Information Commission, where feasible within 72 hours of becoming aware of it. If it is likely to put you at high risk, we will tell you without undue delay. We keep a record of every breach and what we did about it.

13. COMPLAINTS

If you are unhappy with how we have used your personal data, you have the right to complain to us. Email privacy@cogniosynthesisportal.uk or write to Cogniosynthesis Portal Ltd, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission, the UK data protection regulator. It replaced the Information Commissioner's Office (ICO) on 30 September 2026.

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

14. CHANGES TO THIS POLICY

We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The "Last reviewed" date at the top indicates the latest revision.

15. CONTACT US

Email: privacy@cogniosynthesisportal.uk

We check this mailbox on working days.

Post: Cogniosynthesis Portal Ltd, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ

Company number: 16225073 (registered in England and Wales)