ECHELON 8

Privacy notice

How ECHELON 8 collects, uses and protects personal information.

Last updated: 21 October 2026. Version 1.0.

In short

  • We run an information website. It has no forms, accounts, analytics or advertising.
  • Our hosting provider, Hostinger, automatically keeps technical records of visits, such as IP addresses.
  • If you email us, we use your message to reply and to keep a short record. We delete routine enquiries 12 months after we last hear from you, unless a legal or operational reason means we need to keep them longer.
  • If an email suggests someone may be at risk of harm, we handle it separately and may share it with the police or services that can help. We cannot promise confidentiality.
  • You can ask to see, correct or delete your information, and you can complain to the Information Commissioner’s Office (ICO).

Who we are

ECHELON 8 C.I.C. (“ECHELON 8”, “we”) runs this website. We are a community interest company registered in England and Wales, company number 16988115. Our registered office is 124–128 City Road, London, EC1V 2NX.

This notice explains how we handle personal information that we receive through this website. For privacy questions, contact the ECHELON 8 Privacy Contact at echelon8hq@gmail.com.

What this website does and does not do

  • It has no forms, no accounts and no comments, so it does not ask you to enter personal information.
  • It does not use analytics, advertising or tracking.
  • It does not connect to a database of ours.
  • Its fonts, images and scripts are delivered from this website’s own address, through our hosting provider. It runs one small script of its own, which opens and closes the mobile menu.

Visitor logs from our hosting

Our website is hosted by Hostinger, which also delivers it through its content delivery network (CDN). When you visit, Hostinger’s systems automatically record technical information about each request: your IP address, the date and time, the pages requested, browser and device information, and approximate location, such as the country.

Why: to operate, maintain, monitor and protect the website, including keeping it secure and fixing faults.

Lawful basis: legitimate interests. Our interest is in running a secure and reliable website. The information is limited, you would expect a website to keep records like these, and we do not use them to identify or profile individuals or for marketing. You can object (see “Your rights”).

Who can see it: Hostinger holds the logs, and we can view access-log information through our hosting dashboard. Only one person at ECHELON 8, the Founder, can open that dashboard, and we do not download or keep our own copies of the logs.

How long it is kept: Hostinger sets this. We have asked Hostinger how long it keeps these logs, including for its CDN, and have not yet had a reply, so we cannot state a period. We will update this notice when we can.

If you email us

If you email echelon8hq@gmail.com, we receive your email address, your name if it appears, the content of your message and any attachments you send. We use this to read and reply to you, and to keep a record of the conversation in case you follow up. Please do not include sensitive information, such as health details, or details about other people, in an email.

Lawful basis: legitimate interests. Our interest is in responding to people who contact us and keeping a short record of the conversation. You chose to contact us, and we use your message only for this purpose, unless it is about someone’s safety (see below).

Who can see it: only one person at ECHELON 8, the Founder, can open this mailbox, and it is protected with two-step verification.

If your email is about someone’s safety

This inbox is not monitored for emergencies and is not checked all the time. If someone is in immediate danger, call 999.

If an email suggests that a child or an adult at risk may be harmed, we handle it separately from routine enquiries. We may record what you tell us, keep it securely, and share what is necessary with the police or with children’s or adult safeguarding services that can help protect that person. We cannot promise to keep it confidential, and we may share it even if you ask us not to.

What we use and why: your email address, your name if you give it, what you tell us, and any details about the person you are worried about. Our reason is to protect people from harm and to respond to you.

Our legal basis: where an email suggests that a child or an adult at risk may be harmed, we rely on “recognised legitimate interest”, a lawful basis in UK data protection law for safeguarding, where it applies: we use your information where it is necessary to protect that person from harm. Where an email contains sensitive information, the law sets separate conditions for different kinds of information, and we use them only where they apply. For special category information, such as health information, we use Article 9 of the UK GDPR together with the safeguarding condition in Schedule 1 to the Data Protection Act 2018. For information about alleged offences, which is criminal offence data, we use Article 10 of the UK GDPR together with the Data Protection Act 2018 authorisation that applies to it. We use these only where what we do is necessary to protect a child or an adult at risk. The safeguarding condition also requires that consent cannot be given or obtained, or that asking for it would put the protection at risk. In a life-threatening emergency, we may instead rely on protecting someone’s vital interests. If an email is not about someone’s safety, we treat it as a routine enquiry (see “If you email us”).

Who can see it: only the Founder. We keep these emails in our Gmail account, provided by Google, and store notes in a protected folder. Information may be processed outside the UK by our providers. See “Service providers and their roles” and “Transfers outside the UK” for what we have and have not confirmed.

How long we keep it: we keep these emails and our notes separately from routine enquiries, and we do not delete them under the 12-month rule. If we look at a concern and do not pass it on, we keep it for up to 2 years after we last took any action. If we pass a concern to the police or a safeguarding service, we keep it for up to 6 years after we last took any action. We delete it sooner if we no longer need it, and we review these records at least once a year. We may keep them longer only where it is necessary, for example for a complaint, a legal claim or a request from a regulator, the police or a safeguarding service, and we record the reason.

Your rights: you can ask about this information in the usual way (see “Your rights”). We may not always be able to give you what you ask for, for example where doing so could put someone at risk.

How long we keep information

Routine enquiries: we keep them for 12 months after the last contact, then delete them. We may keep an email for longer where we need to for a legal or operational reason, for example to deal with a complaint, a legal claim or a request from a regulator. We review the mailbox at least every three months, so an enquiry may be kept for up to about three months after the 12 months have passed.

Emails about someone’s safety: we keep them separately, and not under the 12-month rule: for up to 2 years after we last took action if we did not pass the concern on, and up to 6 years if we did, and we delete them sooner if we no longer need them. See “If your email is about someone’s safety” above.

Deleted emails: when we delete an email, it may remain for a time in Google’s systems. Google’s data retention page describes general timeframes for its services: deleting data completely from its servers generally takes around two months, and encrypted backup copies can remain for up to six months. We have not confirmed how these apply to our free Gmail account.

Visitor logs: see “Visitor logs from our hosting” above. We cannot yet state a period.

Service providers and their roles

  • Hostinger provides our website hosting, its CDN and the visitor logs described above. Hostinger publishes a data processing addendum, which describes Hostinger as a processor of customer data, and a separate privacy policy, in which Hostinger is responsible for information about its own customers and services. We have asked Hostinger which applies to the visitor and CDN logs and have not yet had a reply.
  • Google provides Gmail for our enquiry mailbox. We use an ordinary free Gmail account, not Google Workspace, so we have no Google Workspace agreement with Google. Google’s privacy policy and terms apply to information in that account. We have not independently confirmed Google’s role for the content of our mailbox.

We do not sell personal information. We share it with others only where the law requires it, where you ask us to, or, for an email about someone’s safety, where it is necessary to protect a child or an adult at risk, as described in “If your email is about someone’s safety”. We will update this notice when we have confirmed the roles.

Transfers outside the UK

Our providers may process information outside the UK. Google may process information in the United States and other countries where it operates. Google publishes a general statement of its legal frameworks for data transfers, which says it relies on UK adequacy regulations and on the UK Extension to the EU–US Data Privacy Framework, among other mechanisms, for transfers of UK personal information. We use an ordinary free Gmail account, not Google Workspace, and have no Google Workspace agreement, and we have not confirmed which parts of Google’s statement apply to our account. Hostinger’s published data processing addendum refers to EU Standard Contractual Clauses. We have not yet confirmed whether Hostinger’s addendum also incorporates the UK International Data Transfer Addendum, whether it covers the visitor and CDN logs described above, where our website is hosted, or which CDN locations serve visitors. We are checking, and we will update this notice with the countries and safeguards once we have confirmed them.

Cookies and similar technologies

This website’s own code does not set cookies or use your browser’s local storage, and it does not use analytics, advertising or tracking cookies. In a check of a test copy of this website on 21 October 2026, we saw no cookies and no Set-Cookie header. We have not checked every page or response, and we have yet to check the live website, so we will keep checking and will update this notice if we find any.

Children and young people

This website is for everyone, including young people. It has no forms and does not ask you for personal information. If you are under 18 and you email us, we use your message to reply to you, in the same way as any other email, and we keep it for the same time, unless it suggests that you or someone else may be in danger (see below).

If you tell us something that suggests you or someone else may be in danger or being harmed, we may need to tell someone who can help, even if you ask us not to. If someone is in immediate danger, call 999.

FUTUR8: Next Steps is not currently recruiting. If we open any way to take part, we will publish an updated notice first, written to be easy to understand.

Your rights

Under UK data protection law you can, in the circumstances the law sets out:

  • ask what personal information we hold about you and ask for a copy;
  • ask us to correct information that is wrong;
  • ask us to delete your information;
  • ask us to restrict how we use it; and
  • object to our use of it where we rely on legitimate interests or on recognised legitimate interest.

To use any of these rights, email echelon8hq@gmail.com and tell us what you would like. We may ask you to confirm who you are first. We aim to respond within one month. If you are under 18, you can ask an adult you trust to help you.

Complaints

If you are unhappy with how we handle your information, you can tell us at echelon8hq@gmail.com and we will look into it. You can also complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk, at any time.

Changes to this notice

If we add forms, analytics or any other way of collecting information, or when we confirm the details above, we will update this notice before we do.