Last updated: 29 July 2026
This notice explains what personal data WrongLK collects, why, on what legal basis, who it is shared with, and what rights you have. It is written to meet Articles 13 and 14 of the UK/EU General Data Protection Regulation.
1. Who is responsible for your data
The data controller for this site is:
The Prince of Kandy
Email: [email protected]
[IF APPLICABLE: EU/UK Article 27 representative — name and address]
2. What we collect, why, and on what basis
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Contact form: name, email, subject, message | To read and reply to your message | Legitimate interests (Art. 6(1)(f)) — to respond to an enquiry you chose to send us. Submitting is voluntary and you may ask us to delete it at any time. | 24 months from last contact, then deleted |
| Spam protection: IP address and interaction data, sent to Google reCAPTCHA | To block automated spam submissions | Legitimate interests (Art. 6(1)(f)) in protecting the site from abuse | Per Google’s retention |
| Comments: name, email, comment, IP address, browser user agent | To publish your comment and detect spam | Consent for publication; legitimate interests (Art. 6(1)(f)) for spam prevention and site security | Until you ask us to remove it |
| Server and security logs: IP address, request, user agent | To keep the site available and defend against attack and abuse | Legitimate interests (Art. 6(1)(f)) in securing the service | Typically 30 days at our host and Cloudflare |
| Analytics: pages viewed, approximate location, device and browser | To understand which articles are read | Consent (Art. 6(1)(a)) — off unless you allow Statistics | Up to 14 months in Google Analytics |
| Advertising: ad interactions and identifiers | To show and measure advertising | Consent (Art. 6(1)(a)) — off unless you allow Marketing | Per Google’s retention, up to 13 months for the cookies involved |
| Account data (only if you register): username, email | To operate your account | Contract (Art. 6(1)(b)) | Until the account is deleted |
Providing contact-form or comment data is entirely voluntary. There is no statutory or contractual obligation to give it; the only consequence of not doing so is that we cannot reply to you or publish your comment.
3. Cookies and tracking
In the EEA, the UK and Switzerland, non-essential cookies are blocked until you consent; elsewhere your choice is applied as soon as you make it. Full detail of every cookie, its purpose and its lifetime is in our Cookie Policy. You can change or withdraw consent at any time via the Cookie preferences button at the bottom-left of every page, or this link.
4. Who your data is shared with
We do not sell your personal data. We share it only with providers who process it on our behalf, or where you have consented:
- Our web host — stores the site and its database.
- Cloudflare, Inc. — content delivery and security; processes IP addresses and request data.
- Google LLC / Google Ireland Ltd — Analytics and AdSense. Only where you have consented.
- Automattic Inc. — Jetpack site services, asset delivery, and Gravatar images beside comments.
- Email delivery — used to send you replies from the contact form.
- Legal disclosure — where we are required by law to disclose data.
A note on reCAPTCHA. This site uses Google reCAPTCHA v3 to block automated spam. For technical reasons it loads on all pages, not only on pages with a form, and it sends your IP address and interaction data to Google. We rely on our legitimate interest in keeping the site free of abuse. Google’s Privacy Policy and Terms of Service apply.
5. International transfers
Several of these providers are based outside the UK/EEA, principally in the United States. Where data is transferred there, it is protected by the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework, together with the providers’ own supplementary safeguards. You can request details of the safeguards used by writing to us.
6. Your rights
Where the GDPR applies to you, you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted (the “right to be forgotten”).
- Restriction — ask us to limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — at any time, without affecting processing already carried out.
How to exercise these rights is set out on our Your Data Rights page. We respond within one month and do not charge a fee for a first request.
You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk); in the EEA it is the authority in your country of residence.
7. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you. Advertising personalisation, where you have consented to it, is performed by Google and is described in their own policies.
8. Children
This site is not directed at children under 16. We do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Security
The site is served over HTTPS, sits behind Cloudflare, and access to the administration area is restricted to authorised accounts. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk.
10. Changes to this notice
We will update this page when our processing changes, and revise the date at the top. Material changes affecting consent will trigger a fresh consent request.