The Stag Archive

Privacy notice

This site is a free, non-commercial reference about the Triumph Stag. It is run by one person, in his own time, and it holds as little personal data as it can get away with. This notice sets out exactly what is collected, why, where it lives and what you can ask for. It describes what the site actually does, not what a template says it might do.

Who is responsible

The data controller is Jon Cosson, an individual in North Yorkshire, operating this site personally and non-commercially. There is no company behind it. Write to stag@triumphstag.org or use the contact form for anything in this notice.

What is collected, and why

Simply reading the site

No account is needed and no personal data is collected. The hosting provider handles the request and its infrastructure logs it in the ordinary way, for delivery and security. There is no analytics package, no tag manager, no advertising and no visitor profiling.

Accounts

An account is only needed to submit a car to the Registry. Creating one stores your email address, an encrypted password if you signed up with one, or your Google account identifier if you signed in with Google, along with the sign-up and last sign-in times. A short profile record is created at the same time holding a display name, taken from your Google profile name or from the part of your email address before the @ symbol, and an optional location if you enter one. Lawful basis: your consent, given by choosing to create an account.

Registry submissions

The Registry is currently withdrawn from public view while it is being reconsidered. Its pages are still reachable by direct link for people who already have an account, so it is described here in full. A submission records the commission number, year, mark, colour name and code, engine type and details, transmission, the car's history as you write it, a display name and a location if you choose to give them, any photographs you upload, and the review status of the entry. Photographs are held in a private storage bucket and are shown only through short-lived signed links. Lawful basis: your consent, given by submitting the entry. A display name and a location can identify a person, so give only what you are content to have published, and give nothing about anyone else.

Event submissions

If you submit an event, the form records the event details, your name as submitter, your relationship to the event, an organiser contact if you supply one, and your confirmations that you have permission to publish and that the details are accurate. Lawful basis: your consent. Do not enter another person's private contact details unless they have agreed to it being published.

The contact form

The contact form records your name, your email address, the subject if you give one, the message and the time it arrived. It is stored so that messages are not lost, and it triggers a notification email so the message is actually read. Lawful basis: legitimate interests, namely being able to receive and answer a message you chose to send. The form uses a hidden field, a timing check and a simple sum to deter automated spam. None of those are tracking, and none of them profile you.

Email sent to you

One email is sent automatically when an account is created. It welcomes you, explains what the account is for, links to the Registry submission page and invites you to reply. It is not marketing, there is no mailing list, and no newsletter is sent. A separate notification of the new registration goes to the site owner. If you write in through the contact form, a copy of your message is emailed to the site owner so it can be answered.

Who processes the data

• Supabase, the database, authentication and file storage behind the accounts, the Registry, the gallery, event submissions and contact messages.
• The hosting provider, which serves the pages and runs the site's server-side code. It sets the two strictly necessary cookies described on the cookies page.
• Resend, which delivers the welcome email and the notification emails. It receives the recipient address and the content of that email.
• Google Fonts, which serves the two typefaces the site uses. Your browser requests those font files from Google's servers, which means Google receives your IP address and the ordinary technical details of that request. No cookie is set by it.
• Google, if, and only if, you choose to sign in with a Google account, in which case Google handles the sign-in and tells the site your email address and basic profile name.

Nothing else receives your data. There is no advertising network, no analytics provider, no data broker, no social media pixel and no third-party comment or chat service.

Where it is stored

The database and file storage sit with Supabase, and the site is served through a global hosting network, so data may be processed outside the United Kingdom, including in the United States. Those providers operate under the standard safeguards for international transfers set out in their own terms.

How long it is kept

• Account and profile records are kept for as long as the account exists. Ask for the account to be deleted and the record goes with it.
• Registry entries are kept while the Registry exists, or until you ask for yours to be removed. Photographs are deleted with the entry.
• Event submissions are kept while the event is relevant, and are removed once it has passed and is of no further use.
• Contact messages are kept while the correspondence is live and for a reasonable period afterwards, so that a thread can be picked up again. They are deleted on request.
• Sent email sits in the ordinary way with the mail provider and in the site owner's mailbox.

What never happens

• Your data is never sold or rented.
• It is never shared with anyone for marketing.
• It is never used for advertising, profiling or automated decision-making.
• You are never added to a mailing list.
• No email address given here is passed to a club, a specialist or a business.

Your rights

Under UK GDPR you have the right to ask for a copy of the personal data held about you (access), to have it corrected (rectification), to have it deleted (erasure), to have its use paused while a concern is resolved (restriction), to object to processing carried out on the basis of legitimate interests, and to receive the data you gave in a portable, machine-readable form (portability). Where processing rests on your consent, you can withdraw that consent at any time, which does not affect anything done before you withdrew it.

To exercise any of them, email stag@triumphstag.org or use the contact form. Say what you want and from which part of the site, and it will be dealt with within one month. There is no charge. This is a one-person archive, not a call centre, though a request will always be answered.

Complaints

If you think your data has been handled badly, please raise it here first, because most things are fixed in a day. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.

Changes to this notice

If the site starts doing something new with personal data, this page is updated before that happens, not afterwards. Related reading: the cookies notice and the terms of use.