Privacy Policy
This privacy policy explains how your personal data is collected, used and protected when you use the Byline Times websites and services, including the news website at bylinetimes.com, the subscriptions and shop website at subscribe.bylinetimes.com and their sub-domains, and our email-update service (together, the “Websites”).
Last updated: 31 August 2026
Who we are — the data controllers
Two companies within the Byline group act as data controllers, depending on the activity:
| Controller | Company details | What it controls |
|---|---|---|
| Byline Times Ltd | Registered in England and Wales, company number 11658725; registered office 426 Metal Box Factory, 30 Great Guildford Street, Borough, London SE1 0HS. ICO registration number ZB259463. | Editorial and journalistic activity, and personal data processed for the purposes of journalism on bylinetimes.com. |
| Byline Media Holdings Ltd | Registered in England and Wales, company number 10143080; registered office Churchill House, 137–139 Brent Street, London NW4 4DJ. ICO registration number ZA241269. | Subscriptions, payments, the shop, the email-update service, and operation of the Websites. |
Where this policy refers to “we”, “us” or “Byline”, it means the relevant controller for the processing in question. If you are unsure which controller is responsible, or wish to exercise your rights, contact us using the details in the “Contact and complaints” section below and we will direct your request appropriately.
Definitions
- Data / personal data: information relating to an identified or identifiable living individual, as defined in the UK GDPR.
- Data Protection Laws: the UK GDPR, the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 (PECR), and any other applicable law relating to the processing of personal data.
- UK GDPR: the UK General Data Protection Regulation.
The personal data we collect
Depending on how you use the Websites, we may collect:
- Information you give us: name; contact information such as email address and telephone number; postal address (for print subscriptions and deliveries); account login details; and correspondence you send us.
- Payment information: processed by our third-party payment providers, Stripe and PayPal. Some longstanding subscriptions are still collected by Direct Debit through GoCardless, although this is no longer offered to new customers. We do not store full card details ourselves.
- Information collected automatically: when you visit the Websites we may collect your IP address, device and browser information, and information about how you interact with our content, through cookies and similar technologies. We use Jetpack Stats, provided by Automattic, to measure how our journalism is read.
- Email-update service: if you sign up for email updates, your email address and engagement data (such as whether you open or click our emails) are processed through our newsletter provider, Beehiiv.
How and why we use your data, and our legal bases
We only process your personal data where we have a lawful basis under Article 6 of the UK GDPR. The bases we rely on, and the purposes for each, are:
| Purpose | Lawful basis |
|---|---|
| Providing subscriptions, processing payments, delivering the magazine and services, and administering your account | Performance of a contract with you (Article 6(1)(b)), or steps to enter into one. |
| Sending you our email updates and marketing about our own similar products and services, where you are an existing customer or have signed up | Legitimate interests (Article 6(1)(f)) and, where required, in accordance with PECR (see “Marketing” below). |
| Improving and securing the Websites, understanding how our content is used, preventing fraud and misuse, and internal record-keeping and administration | Legitimate interests (Article 6(1)(f)): namely our interest in operating, securing, analysing and improving our journalism, services and Websites, and in running our business efficiently. |
| Journalism — collecting, using and publishing personal data for the purposes of journalism | Legitimate interests (Article 6(1)(f)) in freedom of expression and information, relying on the journalism exemption in Schedule 2, Part 5, paragraph 26 of the Data Protection Act 2018. |
| Complying with our legal, regulatory and tax obligations | Legal obligation (Article 6(1)(c)). |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests, rights and freedoms, and we have concluded they are not. You have the right to object to processing based on legitimate interests (see “Your rights”). You can ask us for more information about this assessment.
Marketing and the email-update service
If you sign up for email updates or are an existing customer, we may send you marketing about our own similar products, services and journalism.
- Where the law requires your consent, we will ask for it clearly (for example, by an unticked opt-in box), and you can withdraw it at any time.
- Where we rely on the PECR “soft opt-in” — which is a limited statutory exception that applies where you have bought from us or asked about our products, and we are marketing our own similar things — we will always give you a simple way to opt out, both when we collect your details and in every message.
- Every marketing email contains an unsubscribe link. You can also opt out at any time by contacting us.
Who we share your data with
We share personal data only where necessary, with:
- Service providers (processors) who act on our instructions, including: our website hosting and technical infrastructure providers, overseen on our behalf by Yes We Work Ltd; our newsletter provider, Beehiiv; our payment providers, Stripe, PayPal and GoCardless; our audience-measurement provider, Automattic; the mailing house that addresses and posts print copies, which receives the names and postal addresses of print subscribers; the system we use to handle customer correspondence and support; and our accountants and bookkeepers.
- Professional advisers (such as lawyers and auditors) where necessary.
- Group companies within the Byline family, where necessary to administer your account and provide our services.
- Authorities or third parties where we are required to do so by law, or to establish, exercise or defend legal claims.
We do not sell your personal data.
International transfers
Some of our service providers are based outside the UK, including in the United States — among them Beehiiv, Stripe, PayPal and Automattic. Where we transfer your personal data outside the UK, we ensure an appropriate safeguard is in place, such as the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or we transfer only to jurisdictions covered by UK “adequacy” regulations.
How long we keep your data
We keep your personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements. Our retention periods are, in summary:
| Data | Retention period |
|---|---|
| Subscription and account data | For the duration of your subscription, and two years afterwards. |
| Payment and transaction records | Six years, to meet tax and accounting requirements. |
| Email-update subscriber data | Until you unsubscribe, and six months afterwards. |
| Correspondence and enquiries | Two years. |
When your data is no longer required, we will delete or anonymise it. It may persist on secure backups for a limited period before being overwritten.
Keeping your data secure
- We use appropriate technical and organisational measures to protect your personal data. Access to accounts is controlled by unique credentials, and data is stored on secure servers.
- We maintain ISO 27001 certification for our information-security management.
- If you suspect any misuse, loss or unauthorised access to your data, please tell us immediately using the contact details below.
Cookies
The Websites use cookies and similar technologies:
- Essential cookies keep you signed in, remember the contents of your basket and allow the checkout to work. The Websites cannot function without them.
- Audience-measurement cookies set by Jetpack Stats, provided by Automattic, count visits and tell us which articles are read. We use this to understand how our journalism is used; we do not use it to build advertising profiles.
- Third-party cookies and pixels may be set by our payment providers when you check out, and by our newsletter provider when you open or click our emails.
You can block or delete cookies through your browser settings, and most browsers let you refuse third-party cookies while keeping the rest. Blocking essential cookies will stop parts of the Websites working.
Your rights
Under the Data Protection Laws you have the right to: access your data; have it corrected; have it erased; restrict or object to our use of it (including objecting to processing based on legitimate interests, and to direct marketing at any time); data portability; and, where we rely on consent, to withdraw that consent at any time.
The journalism exemption may limit some of these rights where they would be incompatible with the purposes of journalism, but only to the extent the law permits.
To exercise any right, contact us using the details below. We will respond within the time limits set by law.
Contact and complaints
For subscriptions, payments, the shop, the email-update service and the running of the Websites, contact Byline Media Holdings Ltd at info@byline.com, or by post at Churchill House, 137–139 Brent Street, London NW4 4DJ.
For editorial and journalism matters on bylinetimes.com, contact Byline Times Ltd at info@bylinetimes.com, or by post at 426 Metal Box Factory, 30 Great Guildford Street, Borough, London SE1 0HS.
If you are not sure which company to write to, use either address and we will pass your request to the right place.
Your right to complain to us: If you consider that we have infringed data protection law in connection with your personal data, you have the right to complain directly to us as the controller under section 164A of the Data Protection Act 2018. We will acknowledge your complaint within 30 days and investigate it without undue delay. Please use the contact details above.
Your right to complain to the ICO: You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or by calling their helpline. We would, however, appreciate the chance to address your concerns first.
Changes to this policy
We may update this policy from time to time. When we make significant changes, we will indicate the date at the top and, where appropriate, notify you. Please check back periodically.
This policy supersedes the version dated 13 September 2021.