This policy explains what personal data MTO News collects when you use this website, why we collect it, how long we keep it, and the rights you have over it under the UK General Data Protection Regulation and the Data Protection Act 2018. It applies to mtonews.co.uk and was last reviewed in July 2026.
Who is responsible for your data
MTO News is the data controller for personal data collected through this website. If you want to exercise any of the rights described below, or you have a concern about how we handle your data, contact us through the Contact page and mark your message for the attention of the data protection contact.
What we collect
When you simply read the site, we collect technical information automatically: your IP address in truncated form where possible, browser type and version, device type, operating system, the pages you view, the time of your visit, and the referring page. This is standard server and analytics data used to keep the site working and to understand which articles are read.
When you contact us, we collect the information you choose to send — typically your name, email address and the content of your message — so that we can reply and, where relevant, act on a correction request or story tip.
If you subscribe to a newsletter, we collect your email address and records of whether messages were delivered and opened. If you leave a comment where comments are enabled, we collect the name, email address and content you submit.
We do not knowingly collect data from children under 13, and we do not ask for special category data such as health, political opinions or religious beliefs. Please do not send us such data unless it is directly relevant to a story and you intend to share it.
Why we are allowed to use it
We rely on legitimate interests for operating and securing the website, understanding aggregate readership, and responding to correspondence. We rely on consent for non-essential cookies, analytics and advertising cookies, and newsletter marketing — consent you can withdraw at any time. We rely on legal obligation where we must retain records to comply with law.
Cookies and advertising
We use essential cookies that make the site function and, with your consent, analytics and advertising cookies. Advertising partners may set their own cookies and may process data such as your approximate location and browsing behaviour to select and measure advertising. Full detail, including how to change your choices, is in our Cookie Policy.
Who we share data with
We share data only with service providers who process it on our behalf — website hosting, content delivery and security, email delivery, and analytics — each under contract and only for the purposes we specify. We may disclose data where required by law or to protect our legal rights. We do not sell your personal data.
International transfers
Some providers operate outside the UK. Where personal data is transferred internationally we rely on UK adequacy regulations or, where these do not apply, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical safeguards.
How long we keep it
Server logs are retained for up to 12 months. Analytics data is retained in aggregate form for up to 26 months. Correspondence is kept for as long as needed to handle the matter and, where it relates to published journalism, retained as part of the editorial record. Newsletter data is kept until you unsubscribe, plus a short suppression record so we do not contact you again in error.
Your rights
You have the right to be informed about how your data is used, to request a copy of the data we hold, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent where consent is the basis we rely on. You can also object to direct marketing at any time. We respond to valid requests within one month.
Please note that UK data protection law provides an exemption for personal data processed for the purposes of journalism where compliance would be incompatible with those purposes. We rely on this exemption only where necessary and only to the extent necessary — for example, we will not disclose material that would identify a confidential source.
Security
The site is served over HTTPS. Access to administrative systems is restricted, authenticated and logged. No system is perfectly secure, but we take reasonable technical and organisational measures proportionate to the data we hold, and we will notify the regulator and affected individuals where a breach requires it.
Complaints
If you are unhappy with how we have handled your data, please raise it with us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.
Changes to this policy
We update this policy when our practices or the law change, and we revise the review date above. Material changes will be flagged on the site.