Last updated: 30 September 2026
- 1. Who we are
- 2. What we collect
- 3. Why, and our lawful basis
- 4. How your issue is written
- 5. Email opens and clicks
- 6. The anonymous search list
- 7. Who else handles your data
- 8. Data sent outside the UK
- 9. How long we keep it
- 10. Your rights
- 11. Age
- 12. Keeping it safe
- 13. Changes to this notice
- 14. Contact and complaints
01Who we are
FORM is a weekly sports newsletter published by Joshua Shaw, [[TRADING NAME OR COMPANY NAME, e.g. "trading as FORM" or "FORM Media Ltd, company number 00000000"]], of [[POSTAL ADDRESS]], London, United Kingdom. In this notice "FORM", "we", "us" and "our" mean Joshua Shaw as the publisher of FORM.
We are the controller of your personal data, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO) under registration number [[ICO REGISTRATION NUMBER]].
You can reach us at [[CONTACT EMAIL]], or by replying to any issue of FORM.
02What we collect
When you sign up
- Your email address.
- Your picks: up to three teams or players from our list, and the sports they belong to.
- Your reading preferences: voice, depth and length. Everyone starts on the same defaults, and you can change them by replying.
- Your edition: free, or the paid full edition once it opens.
- Votes for coming sports: if you tick a sport marked "coming soon", we note that on your record.
- Subjects you ask us to add: if you tap "ask for it" on something we do not yet cover, we save the name of that subject (up to five) on your record.
- Your IP address and the time you signed up. Our signup form passes your IP address to Buttondown, our email provider, so it can spot spam and fake signups. Buttondown also records when you confirmed your subscription, which is our record that you asked to receive FORM. Our own systems do not store your IP address.
When you write to us
If you reply to an issue or email us, we receive your email address, your message and anything you choose to include, such as new picks.
When you pay (once the full edition opens)
Payments will be taken by Stripe, through Buttondown. We will see your name, email address, the plan you chose and your payment history. We never see or store your full card number. Stripe handles card details under its own privacy policy.
When you visit the website
Our website does not use cookies or advertising tools, and counts visits only anonymously (section 6). Like every website, the service that hosts it (Netlify) receives technical information such as your IP address and browser type when you load a page, and keeps it in short-term server logs for security and to keep the site running. Our website stores nothing on your device; see our cookies and storage page.
We do not collect special category data (such as health, religion or politics), and we ask you not to send it to us.
03Why we use it, and our lawful basis
Data protection law says we must have a lawful basis for each use of your personal data. Here is ours.
| What we do | Data used | Lawful basis |
|---|---|---|
| Send you FORM each Monday, and the occasional short note about FORM itself (for example, when the full edition opens) | Email address, edition | Your consent, given when you sign up and confirm by email. Withdraw it any time by unsubscribing. |
| Write your issue around your picks and preferences | Picks, sports, preferences, edition, past issues | Your consent, as part of the newsletter you asked for (and contract once you pay for the full edition) |
| Provide the paid full edition, take payment and handle cancellations | Name, email, plan, payment records | Contract with you |
| Keep financial records for tax | Payment records | Legal obligation |
| Answer your replies and messages | Email address, your message | Legitimate interests: running the newsletter and helping readers |
| Stop spam, fake signups and misuse | IP address, signup time, email address | Legitimate interests: protecting FORM and its readers |
| Decide which sports and subjects to cover next | Votes and "ask for it" requests (per reader); the anonymous search list (no personal data) | Legitimate interests: building what readers want |
| Check each issue does not repeat the last one | Your past issues | Legitimate interests: quality of the newsletter you asked for |
| Keep a record that you asked to receive FORM, and that you unsubscribed | Email address, dates | Legal obligation and legitimate interests: showing we have your consent, and never emailing you again after you leave |
Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum. You can object at any time (see section 10).
We do not sell your personal data, share it for other people's marketing, or use it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.
04How your issue is written
FORM is drafted with AI tools and edited by Joshua Shaw. Most of the writing is about sport, not about you: each subject is researched and written once a week and shared by every reader who follows it.
To write the short editor's note at the top of your issue, we send the AI service (Anthropic, see section 7) your picks and preferred voice, together with your email address, so the note reaches the right reader. We are moving to a reference code in place of your address, and will update this notice when that is done. Anthropic processes this on our behalf under a data processing agreement, does not use it to train its models, and deletes it within 30 days under its standard terms.
05Email opens and clicks
Many newsletters put an invisible "tracking pixel" in each email to see who opens it, and route links through a tracking address to see who clicks. FORM does not do this. Open tracking and click tracking are switched off in our email provider, so we do not know whether you opened an issue or which links you followed.
If we ever wanted to turn either on, we would ask for your permission first, and it would be optional.
Buttondown does record whether an email was delivered or bounced, so we can stop sending to addresses that no longer work.
06The anonymous search list
When you search our list of teams and players at signup and nothing matches, we note the words you typed, how many times they have been searched, and the first and last date. We do not store your email address, IP address or anything else that identifies you with it. We use the list only to decide what to cover next, and it holds at most 500 entries.
Visit counts. We also count visits to the website ourselves: which page was opened, the name of the site that linked to it (for example "linkedin"), and how many people reached the signup picker, made a first pick and signed up. These are daily totals only. We keep no IP address, no cookie and no identifier, so the counts cannot be linked to you, and they are stored with Netlify alongside the search list.
Please do not type personal information into the search box. If you do, it is kept in the same anonymous list, and you can ask us to delete it.
07Who else handles your data
We use a small number of trusted service providers ("processors") who handle data only on our instructions and under contract.
| Provider | What they do | Where |
|---|---|---|
| Buttondown, LLC | Stores subscriber records and sends the newsletter | United States |
| Netlify, Inc. | Hosts the website and the signup form, and stores the anonymous search list and visit counts | United States and global network |
| Anthropic, PBC | AI tools used to research and draft issues, including the editor's note (section 4) | United States |
| GitHub, Inc. (Microsoft) | Runs our weekly build and keeps a private archive of past issues [[DELETE THIS ROW IF THE SERVER EDITION IS NOT USED]] | United States |
| Stripe | Takes payments for the full edition, once it opens | United States, Ireland and the UK |
| [[EMAIL INBOX PROVIDER, e.g. Microsoft Outlook]] | Receives your replies and messages | [[LOCATION]] |
We may also share data if the law requires it, to protect our rights, or with a buyer if FORM is ever sold, in which case this notice would continue to apply to your data.
08Data sent outside the UK
Our main providers are based in the United States, so your data is transferred there. The UK does not treat the whole of the US as giving the same protection as UK law, so we rely on these safeguards:
- Netlify is certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection.
- Buttondown and Anthropic process our data under data processing agreements that include the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, a safeguard approved under UK law.
- Stripe and GitHub rely on the UK Extension to the Data Privacy Framework or on contractual clauses of the same kind, as set out in their own terms.
You can ask us for more detail on these safeguards using the contact details below.
09How long we keep it
| Data | How long |
|---|---|
| Subscriber record (email, picks, preferences, votes, requests) | While you are subscribed. After you unsubscribe, we delete it within 90 days, except as below. |
| Suppression record (your email address and the date you left) | Kept after you unsubscribe so we never email you again by mistake. Ask us and we will delete it, on the understanding that we then cannot guarantee to block a future signup. |
| Signups never confirmed | Deleted within 30 days |
| Your past issues | The last 12 months while you are subscribed; deleted within 90 days of unsubscribing |
| Your replies and messages | Up to 2 years, then deleted |
| Payment and invoice records | 6 years after the end of the tax year they relate to, as HMRC requires |
| Anonymous search list | Up to 2 years per entry (no personal data) |
| Anonymous daily visit counts | Up to 2 years (no personal data) |
| Website server logs | Kept briefly by Netlify under its own policy |
| Data sent to Anthropic | Deleted by Anthropic within 30 days under its standard terms |
10Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have it corrected if it is wrong or incomplete;
- have it deleted;
- restrict how we use it, for example while a complaint is resolved;
- object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
- receive it in a common, machine-readable format, or have it sent to another provider;
- withdraw your consent at any time. The simplest way is the unsubscribe link at the foot of every issue. This does not affect anything we did before you withdrew it.
To use any of these rights, email [[CONTACT EMAIL]] or reply to an issue. It is free, and we will answer within one month. We may need to confirm it is really you, usually by replying from the address you subscribed with.
11Age
FORM is for readers aged 16 and over. The paid full edition is for readers aged 18 and over. We do not knowingly collect data from anyone younger. If you believe someone under 16 has signed up, tell us and we will delete their details.
12Keeping it safe
We keep personal data to the minimum, use two-factor sign-in on every account that holds it, keep access keys out of our code, and limit access to Joshua Shaw. If a breach ever put your data at risk, we would tell the ICO within 72 hours where the law requires, and tell you directly if it posed a high risk to you.
13Changes to this notice
We will update this notice when the way we use data changes, and change the date at the top. If a change is significant, we will tell you in the newsletter before it takes effect.
14Contact and complaints
Questions or concerns: [[CONTACT EMAIL]], or write to Joshua Shaw, FORM, [[POSTAL ADDRESS]].
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk/make-a-complaint, or 0303 123 1113.