Privacy at the British Resilience Index

The email list

The signup form asks for one thing: an email address. There is one list, and it is used for two things: the monthly reading, which is the new national score, what moved and the sharpest findings from the data, and The Quarterly Record, the print edition, which is sent four times a year. Whichever form you use to join, including the one that unlocks the free Record, you are joining that single list and can expect both. Nothing else is sent to that address and it is used for no other purpose.

The lawful basis is your consent. The list uses double opt in, so the address stays pending and receives nothing until you click a confirmation link, which is also the record of that consent. It is kept until you unsubscribe or ask for it to be deleted, and every email carries a one click unsubscribe link.

What happens when you press subscribe: your address goes to this site and no further, where a small piece of code checks the anti abuse challenge described below and then passes the address to EmailOctopus, the provider that stores the list and sends the email. That code runs on Cloudflare, holds no database and writes nothing down, so the project keeps no copy of your address outside EmailOctopus. It exists so that the key to the mailing list never has to be published in the page, and so that nobody can use this site to send confirmation mail to an address that never asked for it.

Analytics, and why there is no cookie banner

The project counts page views so it knows which analyses are worth writing more of. The tool is PostHog, on its EU cloud, and it is deliberately set up in its least invasive configuration: no cookies, no identifier written to your device, no session recording and no automatic capture of what you click. A handful of deliberate events are recorded, such as a share, a council lookup, or a newsletter signup and the place on the site it came from. Do Not Track is respected.

Because nothing is stored on or read from your device, the rules that require a cookie banner do not apply. The honest cost of that choice is that visitor counts here are approximate, since the same person visiting twice cannot be recognised.

Cloudflare serves the site and, as any web server must, sees the IP address and browser details of each request in order to return the page. The signup form carries one further piece of Cloudflare: Turnstile, a challenge that tells a person from a script. It loads only where a signup form appears, and when you subscribe your IP address is sent to Cloudflare so the challenge can be verified. It replaced the alternative, Google reCAPTCHA, precisely because that would have reported readers who merely scrolled past the form to an advertising company.

Who else can see your data

Three companies process data on the project’s behalf. There are no others, and none of them is permitted to use your data for their own purposes.

Your rights

Under UK data protection law you can:

• Ask what the project holds about you, and get a copy
• Have it corrected if it is wrong
• Have it erased
• Withdraw consent at any time, which for the newsletter is the unsubscribe link in every email
• Object to or ask for a restriction on how it is used

To exercise any of them, email press@britishresilienceindex.comCopyor open in your mail app. Since the only record is usually an email address, the fastest route to erasure is often the unsubscribe link itself.

If you are unhappy with how the project has handled your data, you can complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk.