Privacy Policy
Company: Cogniosynthesis Portal Ltd (trading as CognioNews)
Company number: 16225073
Registered in: England and Wales
Registered office: 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ
Data protection registration: ZC269688
Privacy contact: privacy@cogniosynthesisportal.uk
Version: 2.0
Last reviewed: 2026-10-21
Next review: 2027-10-21
Effective date: 22 October 2026
1. WHO WE ARE
Controller: Cogniosynthesis Portal Ltd, company number 16225073, registered in England and Wales. Registered office: 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We trade as CognioNews.
This notice covers cognionews.com, CognioNews Premium and the services we provide through them. Our main privacy notice at cogniosynthesisportal.uk/privacy.html covers our other services.
We are registered with the Information Commission, the UK data protection regulator, under registration number ZC269688.
We have not appointed a data protection officer, because the law does not require us to. Kenny Lewis, Director, is responsible for data protection. You can contact us about anything in this notice at privacy@cogniosynthesisportal.uk.
2. WHAT PERSONAL DATA WE COLLECT
We collect only what we need to run the service and to deal with you as a reader or customer.
- Contact and account data: name, email address, and where relevant your organisation, role and telephone number, when you subscribe, register, submit a story or contact us.
- Subscription and payment data: the plan you hold, its status, billing period and renewal date, and payment references from Stripe. Stripe collects and holds your card details. We do not receive or store your card number, expiry date or security code.
- Content you give us: story submissions, comments, survey responses, emails and other messages you send us, including any files you attach.
- Usage and device data: the pages you view on this site, the page you arrived from, approximate location (city level), device type, browser and operating system, and your IP address in our server logs. Analytics data is collected only if you accept analytics (see section 9).
- Correspondence and support records: the history of your enquiries and our replies.
If you subscribe to CognioNews Premium, the Premium section below lists the data we keep. You need to give us your email address to subscribe and sign in.
We do not knowingly collect special category data (for example health, ethnicity, religion, political opinions, biometric or genetic data), and we do not buy personal data from data brokers.
3. HOW WE USE YOUR PERSONAL DATA
- To provide the service: publishing content, delivering the pages you request, and managing your access and preferences.
- To create and administer your subscription or account, and to take and manage payment.
- To send you the newsletters, digests and service messages you have asked for, and to handle unsubscribes.
- To answer your enquiries, deal with complaints and provide support.
- To keep our own records, including accounting, tax and VAT records required by law.
- To keep the service secure and available: detecting abuse, fraud, scraping, attacks and technical faults.
- To understand how the site is used, where you have consented to analytics.
- To establish, exercise or defend legal claims.
We do not use your personal data for automated decision-making that produces legal or similarly significant effects about you, and we do not sell your personal data. Our AI analysis is applied to published news content, not to profiles of individual readers.
If we contact you in a business capacity, see the B2B section of our main notice at cogniosynthesisportal.uk/privacy.html.
4. OUR LAWFUL BASES
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing the service you have asked for, including CognioNews Premium, and administering your subscription or account | Performance of a contract — Article 6(1)(b) |
| Taking payment and managing billing, refunds and cancellations | Performance of a contract — Article 6(1)(b) |
| Sending newsletters and digests you have subscribed to | Consent — Article 6(1)(a), or soft opt-in under the Privacy and Electronic Communications Regulations 2003 where you are an existing customer |
| Responding to enquiries and providing support | Legitimate interests — Article 6(1)(f): serving our customers |
| Keeping the service secure, preventing abuse and maintaining logs, including a log of sign-in events and limiting repeated sign-in requests | Legitimate interests — Article 6(1)(f): preventing misuse of the service and of your account |
| Keeping your account details for 90 days after a subscription ends, to deal with refunds, cancellations and queries, or a quick restart | Legitimate interests — Article 6(1)(f) |
| Analytics cookies | Consent — Article 6(1)(a), collected through our cookie banner |
| Billing records, accounting, tax and other statutory records | Legal obligation — Article 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests — Article 6(1)(f), or legal obligation where a claim is compulsory |
Where we rely on legitimate interests we carry out and record a legitimate interests assessment, balancing our interest against your rights and reasonable expectations. You can ask us for a summary of the assessment relating to you. Where we rely on consent you can withdraw it at any time, without affecting processing carried out before withdrawal.
5. WHO WE SHARE IT WITH
We do not sell personal data. We share it only where we need to in order to run the service, and only with organisations that are bound to protect it.
- Payment processing: Stripe Payments UK Ltd and the Stripe group. Stripe processes card data as an independent controller for payment processing and fraud prevention. We receive limited transaction data back from Stripe to reconcile your subscription.
- Hosting and infrastructure: our hosting provider, with servers in the United Kingdom. It hosts our websites, server logs and service data.
- Analytics: Google LLC (Google Analytics), only where you have accepted analytics cookies.
- Email delivery: our email provider (UK), which sends our newsletters and service emails such as receipts and sign-in links.
- Professional advisers: our accountants, auditors and lawyers, where necessary and under duties of confidence.
- Authorities and third parties: where we are required by law, by a court order, or where necessary to establish, exercise or defend legal claims, or to protect someone's vital interests.
- Business transfers: if we sell or transfer all or part of the business, relevant data may be transferred to the buyer under equivalent protections.
We do not use advertising networks or social media tracking pixels on this site, and we do not share personal data for others' marketing.
6. INTERNATIONAL TRANSFERS
Our hosting provider's servers are in the United Kingdom, and our email provider is in the United Kingdom. Some of our processors are based in, or may access data from, the United States:
- Google LLC — covered by the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework). See Google's transfer safeguards.
- Stripe, LLC — covered by the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework). If the Data Bridge cannot be used, Stripe's Data Transfers Addendum applies the UK International Data Transfer Addendum instead.
Where we transfer personal data outside the UK, we rely on UK adequacy regulations, including the UK–US Data Bridge. If those regulations stop applying to a recipient, we will only continue the transfer under another lawful safeguard, such as the UK International Data Transfer Addendum, after checking that the transfer meets the legal test for that safeguard. You can ask us for details of the safeguards used for a particular transfer.
7. HOW LONG WE KEEP IT
| Data | Retention period |
|---|---|
| CognioNews Premium accounts: email address, name (from Stripe), preferences, subscription status, renewal or end date, and Stripe customer and subscription references | While your subscription is active, then 90 days after it ends. We check every subscription with Stripe about once a day |
| Email addresses entered at Premium sign-in that do not belong to a Premium subscription | Deleted within about 25 hours. The security log keeps a record of the attempt for 12 months, in a form that does not reveal the address |
| Billing and payment records (held by Stripe and in our accounts) | 6 years from the end of the company financial year they relate to, because tax and company law require it |
| Newsletter subscription details | Until you unsubscribe, then 30 days, except a minimal suppression record kept so we do not email you again |
| Enquiries, complaints and support correspondence | 24 months from the last contact |
| Story submissions and other content you send us | While published, and 12 months after we stop using it |
| Sign-in sessions | Up to 30 days while you are signed in, then deleted within a further 30 days |
| Security log of sign-in events | 12 months |
| Records used to limit repeated sign-in requests, including IP addresses | 24 hours |
| Web server logs, including IP addresses | Up to 15 days |
| Service system logs (which hold a coded reference to your email, not the address itself) | Up to 30 days |
| Backup copies of our service data | Up to 30 days. Data deleted from our systems may remain in a backup until then |
| Analytics data | Up to 12 months, or as described in section 9 |
| Consent records | 6 years from the date of the choice, as described in section 9 |
We may keep data longer where it is needed for a complaint, an ongoing legal claim or a security incident, or where the law requires it. When a retention period ends we delete or irreversibly anonymise the data.
8. YOUR RIGHTS
Under the UK GDPR you have the right to:
- be informed about how we use your data — this notice does that;
- access a copy of the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data where there is no good reason for us to keep it;
- restrict processing while a concern is resolved;
- object to processing based on legitimate interests, and to direct marketing at any time, absolutely;
- data portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible;
- withdraw consent at any time where we rely on consent;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions about you.
To exercise any of these rights, email privacy@cogniosynthesisportal.uk. We will respond within one month; if a request is complex we may extend that by up to two further months and will tell you why. Exercising your rights is free. We may ask for proof of identity so that we do not disclose data to the wrong person.
If you are unhappy with our response, you can complain to us or to the Information Commission — see section 13.
10. CHILDREN'S PRIVACY
Our services are not directed at children under 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact privacy@cogniosynthesisportal.uk and we will delete it promptly.
11. KEEPING YOUR DATA SECURE
We are responsible for keeping your personal data secure, and we require the organisations that handle it for us to do the same. If you are worried about the security of your data, contact privacy@cogniosynthesisportal.uk.
12. DATA BREACHES
If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the Information Commission, where feasible within 72 hours of becoming aware of it. If it is likely to put you at high risk, we will tell you without undue delay. We keep a record of every breach and what we did about it.
13. COMPLAINTS
If you are unhappy with how we have used your personal data, you have the right to complain to us. Email privacy@cogniosynthesisportal.uk or write to Cogniosynthesis Portal Ltd, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission, the UK data protection regulator. It replaced the Information Commissioner's Office (ICO) on 30 September 2026.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
14. CHANGES TO THIS POLICY
We may update this policy from time to time. Material changes will be communicated via email or a prominent notice on our website. The "Last reviewed" date at the top indicates the latest revision.
15. CONTACT US
Email: privacy@cogniosynthesisportal.uk
We check this mailbox on working days.
Post: Cogniosynthesis Portal Ltd, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ
Company number: 16225073 (registered in England and Wales)
Data protection registration: ZC269688
Document History:
| Version | Date | Author | Changes |
|---|---|---|---|
| 1.0 | Feb 2026 | Kenny Lewis | Initial version |
| 1.1 | 2026-02-10 | Kenny Lewis | Added Art. 22 automated decision-making section, data retention schedule, UK IDTA/SCCs for international transfers, PECR references |
| 2.0 | 2026-10-21 | Cogniosynthesis Portal Ltd | Added sections 1–8 in line with the main privacy notice; added CognioNews Premium; added the right to complain to us and updated the regulator to the Information Commission; added our data protection registration number; corrected the registered office; replaced the security-measures list and removed a broken link; set retention periods, including for sign-in records, email addresses entered at sign-in and backups. |
Approval:
Kenny Lewis, Director
Date: 22 October 2026