Privacy

Last reviewed: 21 October 2026. This notice explains how Rather Good Days uses personal information to deliver this website and keep it secure.

Who is responsible

The controller is Griff, a sole trader operating as Rather Good Days. For privacy questions or requests, email hello@rathergooddays.com.

Information used to run and secure the site

When your browser requests a page or file, our host can record your IP address, time, requested address, response status, referrer, browser information and connection details. Hosting security records can include TLS information and a technical connection identifier. SiteGround also provides traffic statistics derived from server logs. These records exist even though no separate website analytics service is connected.

SiteGround Security records website activity and access events, including the time, IP address, action and outcome. Its visitor records can link activity to an administrator account or a security block. WordPress also stores administrator account details and sign-in sessions. Public registration and article comments are disabled.

Our purpose is to deliver pages, administer the publication, diagnose faults and prevent unauthorised access. Our lawful basis is legitimate interests in operating a reliable, secure publication. We use technical access controls for security; we do not use this information to make solely automated decisions with legal or similarly significant effects.

Email enquiries

If you email us, we receive your address, message and any information you choose to include. We use this to respond to enquiries, investigate corrections and handle privacy requests. Our lawful basis for ordinary correspondence is our legitimate interest in running the publication and responding to readers; we rely on legal obligations where necessary to handle data-protection requests. Please send only information relevant to your enquiry.

Our hello mailbox uses SiteGround’s email service and its spam and security filtering. Email systems process sender and recipient addresses, delivery and connection information, and message content for delivery and filtering. Other email providers may also process a message as it travels between you and us. There is no website contact form or mailing-list subscription.

Hosting, recipients and locations

We use SiteGround hosting and email. The hosting account places this website in London, United Kingdom. Authorised administrators and hosting support may access information when needed to operate, secure or recover the site. SiteGround’s UK processing agreement identifies SiteGround Hosting Ltd. as the processor and allows its group companies and subprocessors to provide the service.

London hosting does not mean every support operation or backup stays in the UK. SiteGround’s agreement permits processing in other countries and describes contractual transfer safeguards, including EU standard contractual clauses and a UK International Data Transfer Agreement. Its current subprocessor list is available on request; we have requested the service-specific list and location details. We do not treat the website’s London origin as proof of where all mailbox, support or backup processing takes place. See the SiteGround processing agreement.

GoDaddy provides domain registration and authoritative DNS. The domain’s existing email-authentication policy sends aggregate DMARC delivery reports to its designated reporting service at onsecureserver.net. These reports help authenticate domain email; no website advertising or audience-measurement service has been enabled.

Retention and recovery copies

The installed security plugin removes activity events older than 12 days when its daily cleanup runs. Anonymous, unblocked visitor entries are removed once no event refers to them. Registered-user and blocked-visitor records are excluded from that orphan cleanup and need separate review. Daily execution means an event can remain until the next cleanup after it becomes eligible.

Hosting access-log archives are available to the account holder for up to 30 days. That access window does not establish the retention period of every infrastructure or security record held by SiteGround.

Restricted website and database backups are held on the hosting account outside the website’s public folder and on the operator’s local computer for recovery. They may contain account and security information from the time of the backup. Deleting a live record does not immediately remove it from an older backup. SiteGround’s agreement sets a maximum of 60 calendar days for relevant backup deletion after a deletion instruction or service termination, subject to legal exceptions; this is distinct from the routine backup rotation.

Provider infrastructure-log, mail-log and routine backup rotation details remain subject to the provider confirmation requested for this notice. These are not inferred from the security plugin’s 12-day rule or the downloadable-log window.

We review ordinary email correspondence annually and remove it when it is no longer needed to answer the enquiry or maintain a necessary correction record. Privacy-request and dispute records may be retained where needed to demonstrate compliance or establish, exercise or defend legal claims. The mailbox does not currently apply automatic age-based deletion.

We review administrator access and retained registered-user or blocked security entries monthly and when access or a security incident ends. We retain an active administrator account while access is needed, and retain a block while it remains necessary for security. These records have no automatic age-based expiry. We do not remove a necessary security block merely to delete its record.

SiteGround now lists an automatic website recovery point. Separately, manual recovery copies are retained for recovery and controlled releases. We review those copies at each release decision and monthly thereafter, keeping only copies still needed for rollback, an unresolved incident or a legal requirement. No automatic purge of those manual copies is configured. Recovery copies are restricted and are not used for ordinary correspondence or marketing.

Cookies and browser storage

WordPress uses cookies for administrator authentication, checking whether cookies work, and editor preferences. In this installation the configured authentication lifetime is two days, or 14 days with “Remember me”; a normal sign-in uses a browser-session cookie. The login test cookie is a session cookie, and editor preference cookies are normally stored for a year. Logging out clears authentication cookies. These are administration functions rather than advertising or audience measurement.

Protected preparation areas also require a hosting password. HTTP Basic authentication is separate from a WordPress cookie; a browser may remember that authentication for its own session.

In a fresh visitor-browser check on 21 October 2026, ordinary reading did not set a website cookie or write to local or session storage. Administrator checks observed wordpress_test_cookie, wordpress_sec_[site hash] and wordpress_logged_in_[site hash] as Secure, HttpOnly, SameSite=Lax session cookies. The observed wp-settings-time-[administrator ID] preference cookie was Secure and SameSite=Lax, readable by scripts, with an approximately one-year expiry. Cookie hashes and administrator IDs vary; these descriptions do not disclose cookie values. We check this configuration again when changing visitor-facing services.

The WordPress editor also stores administrative interface data in local storage under WP_DATA_USER_[administrator ID]. Local storage is separate from cookie expiry and can remain until the application or browser clears it. This is administrative editor storage, not visitor analytics.

Your rights and questions

Depending on the circumstances, you can request access, correction, erasure or restriction of your personal information. You can also object to processing based on legitimate interests. Data portability applies where its legal conditions are met. We may need enough information to identify the relevant records and verify a request; please avoid sending unnecessary sensitive information.

You have the right to object to our use of your information based on legitimate interests. Use the privacy contact listed above. You can complain to the Information Commissioner’s Office or another competent data-protection authority. You do not need to contact us first.