Who we are
XO is published by RAD Media Holdings Limited, a company registered in England and Wales (company number 15203187), whose registered office is at 132–140 Goswell Road, London, EC1V 7DY. RAD Media Holdings Limited is the data controller for this site.
What we collect
We aim to collect as little personal data as possible. In practice that means:
- Newsletter: if you subscribe to the XO newsletter we store your email address — and nothing else — so we can send it to you. You can unsubscribe at any time using the link in any email.
- Pitches and enquiries: your name, email address, and the contents of your message — only when you choose to email our editorial inboxes.
- Analytics: with your consent, Google Analytics 4 counts page views, sessions and referrers (this sets cookies). We also keep our own cookieless visitor statistics (see below) and use Cloudflare Web Analytics, which is cookieless and aggregate-only. Neither builds an individual visitor profile.
- Advertising: ad slots are served by Google Ad Manager. We never run personalised advertising — ads are targeted on geography only. Without your consent, Ad Manager runs in “limited” mode and sets no advertising cookies on your device.
Our own visitor statistics
To know how many people read XO, which stories they finish and how they found us, XO counts visits itself. It works without cookies and stores nothing on your device. For each page you view we record:
- the page, the site or app you came from, and any campaign tags in the link;
- how long the page was open and in use, and how far down the page and through the article you scrolled;
- a few things you did on the page, such as following a link to another story, sharing it or signing up to the newsletter;
- coarse device details (phone, tablet or desktop; operating system; browser; whether you were in an app such as Instagram or TikTok) and your country.
We never store your IP address or your browser's identifying details. They are used for a moment, when the visit arrives, to tell one day's visitors apart: they are turned into a code that changes every day and can't be turned back. So we can't recognise you on a later day, and the statistics can't identify you. They are not shared with advertisers or combined with Google Analytics. They are stored with Cloudflare in the EU (see transfers).
You can switch them off for this browser. Doing so saves one setting on your device, which is the only thing these statistics ever store there, and only because you asked.
XO's own visitor statistics on this device: on
Your choice is saved in this browser only, so set it on each device you use.
Lawful basis
Under UK GDPR, we rely on:
- Consent — for analytics and advertising cookies, and for newsletter signup. You can withdraw consent at any time (via “Cookie settings” in the footer, or the unsubscribe link in any newsletter).
- Legitimate interests — for handling pitches and enquiries you choose to send us, for cookieless aggregate analytics, and for keeping the site secure.
Who we share data with
We do not sell your personal data. We share it only with the service providers that keep the site and its mailing list running, each of which processes data on our behalf under contract:
- Resend — delivers the newsletter and stores the subscriber list.
- Google — Google Analytics and Google Ad Manager (only where you have consented to the relevant cookies). Google's privacy policy is at policies.google.com/privacy.
- Cloudflare — hosting, security, and cookieless analytics.
International transfers
Some of these providers (including Resend and Google) process data outside the UK, including in the United States. Where they do, the transfer is protected by UK-recognised safeguards — such as the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Agreement (IDTA) — so your data receives an equivalent level of protection.
How long we keep data
- Newsletter: until you unsubscribe.
- Editorial enquiries: retained for two years for record-keeping.
- Analytics: aggregate data is retained by Google for up to 14 months and by Cloudflare Web Analytics for up to six months. Our own visitor statistics keep each visit's record for about six months in our database, plus an archived copy and daily totals that we keep indefinitely; none of it can identify you.
Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected (rectification)
- Have your data deleted (erasure)
- Restrict or object to our processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on it
To exercise any of these rights, email contact@radmedia.com.
Contact and complaints
If you have a complaint, please email us first so we can try to put it right. If you remain unhappy, you can raise the issue with the Information Commissioner's Office (ICO) at ico.org.uk.