Updated: 1 October 2026
This notice explains how data is processed when you use www.queerscore.org. It covers the public QueerScore website. Other projects and services have their own notices.
1. Who is responsible
Queer Score Foundation Ltd.
71–75 Shelton Street
London, WC2H 9JQ
United Kingdom
Registered in England and Wales, company number 16566890.
For privacy questions or to exercise your rights, contact info@queerscore.org.
2. Providing and protecting this website
Our server processes connection data needed to deliver the website, including your IP address, time of request, requested address, response status and browser information. Technical logs help us investigate faults and attacks. Our lawful basis is our legitimate interest in operating a secure and reliable service (Article 6(1)(f) UK GDPR and, where applicable, EU GDPR).
Access to these records is restricted. The front-end web server rotates non-empty access logs weekly and retains four older files, or ten for error logs. Additional application logs remain until the relevant application container is replaced. These rules are not a fixed deletion period in calendar days. Records relevant to a security incident may be retained until it is resolved and, where necessary, to establish or defend legal claims. Backup snapshots are described in section 7.
Fonts and images are served from our own server. Our contact form does not use an external CAPTCHA service.
3. Contacting us
When you contact us, we process your name, email address, message and the technical information needed to deliver it. We use this to handle your enquiry and respond. Form messages are delivered to our project mailbox; their contents are not also saved as form records in WordPress.
For enquiries about a possible contract, our lawful basis is Article 6(1)(b). For other enquiries, we rely on our legitimate interest in communicating with you (Article 6(1)(f)). The form does not subscribe you to marketing. Please keep your first message general and avoid health, sex-life or other particularly sensitive personal details wherever possible.
Abuse prevention uses short-lived IP-related check values, which do not store the IP in plain text, and technical counters: rate limits of up to 15 minutes per check value or one hour overall, duplicate-submission checks of up to two hours, and delivery receipts of up to 30 minutes. Expired technical entries are removed through WordPress housekeeping.
We retain correspondence for as long as needed to handle and reasonably document the enquiry. Contractual or statutory retention duties, or unresolved legal claims, may require longer retention. The relevant duty or proceedings determine that period.
4. Cookies and your choices
Optional Google measurement stays off until you agree. “Only necessary” rejects it. You can change your choices or withdraw consent for future processing through “Cookie settings” in the footer at any time. Withdrawal does not affect the lawfulness of processing already carried out.
| Storage | Purpose | Duration |
|---|---|---|
| __Host-qs_consent | Remembers your privacy choices on this website, without an individual visitor identifier. Needed to respect your choices. | Up to 180 days after your choice |
| _ga and _ga_… | Google Analytics identifiers for recognition and session measurement, only with consent. | In our setup, at most 180 days; browsers may delete them sooner |
Storage necessary to respect your choices does not require consent under the applicable cookie rules. To the extent personal data is processed, our legitimate interest is to implement your decision. Google Analytics does not load when JavaScript is disabled.
5. Local basic statistics
We maintain our own daily counts of page requests and enquiries successfully handed to the mail server. Only the date, public page identifier, type of count and total are stored. There is no individual visitor identifier, recognition across visits or transfer of these totals to Google.
This helps improve our website. Our lawful basis is legitimate interests under Article 6(1)(f). These statistics do not store IP addresses, browser identifiers, messages, complete request addresses or referrers. Technical connection logs described in section 2 are separate.
You can object to future local counting: choose “Only necessary” or turn off “Local basic statistics” in Cookie settings. When JavaScript is disabled, a separate button is available at the bottom of the page. We also respect DNT and GPC signals sent by your browser. Requests already added to a total cannot be linked back to a person and therefore cannot be individually removed. Daily totals are retained for no more than 400 days.
6. Google Analytics — with your consent
If you agree, we use Google Analytics 4 to understand page views, sources of visits and successful enquiries. Cookie identifiers, usage events and technical device/browser information are sent to Google. An IP address is necessarily involved in the connection. Google states that it discards IP addresses from EU, Swiss and UK users before storing them; approximate location information may first be derived from the address.
We use Basic Consent Mode: no Google Analytics scripts load before you agree or after a saved rejection. We do not enable Google Signals, advertising personalisation or links to Google Ads. Names, email addresses and message contents are not sent as event data. Query parameters and fragments are removed from the page addresses that we send.
Our lawful basis is your consent (Article 6(1)(a) and the applicable cookie rules). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the United States and other subprocessors listed in Google’s contractual documentation may also process data.
International transfers are covered by the safeguards described in Google’s data processing terms, including applicable adequacy decisions and contractual safeguards such as Standard Contractual Clauses and the UK addendum. Details and copies of these contractual mechanisms are available in the Google data processing terms. See also how Google uses information from websites.
Retention of user and event data for detailed analysis is set to 14 months, with extension through renewed activity turned off. This setting does not govern aggregated standard reports, which may remain longer. Measurement is incomplete because of declined consent and technical blocking. We do not use it to make automated decisions about you with legal or similarly significant effects.
7. Recipients and backups
Access is restricted to people who need it to handle enquiries or operate this project. The website and project mailbox run on our own infrastructure. We use our existing Mailjet service for outgoing email replies. Your own email provider also processes messages when we correspond by email.
We protect against data loss through local backups and encrypted off-site backups in Microsoft OneDrive. Contents and file and folder names are encrypted before transfer. Microsoft also processes technical information needed to provide its storage service. Backups are renewed and thinned under the backup plan; older technical maintenance snapshots may be retained for recovery. If a backup is restored, previously implemented deletions must be applied again.
8. Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You can withdraw consent for future processing at any time.
Right to object: you may object to processing based on legitimate interests on grounds relating to your particular situation. Contact info@queerscore.org. Section 5 explains the immediate choice to stop local statistics.
You can complain to a data protection authority, particularly the UK Information Commissioner’s Office (ICO) or, where EU GDPR applies, the relevant authority where you live or work.
You do not have to agree to Google Analytics. If you want a reply through the contact form, we need the fields marked as required. You can alternatively email us.