Who we are
XO is published by RAD Media Holdings Limited, a company registered in England and Wales (company number 15203187), whose registered office is at 132–140 Goswell Road, London, EC1V 7DY. RAD Media Holdings Limited is the data controller for this site.
What we collect
We aim to collect as little personal data as possible. In practice that means:
- Newsletter: if you subscribe to the XO newsletter we store your email address — and nothing else — so we can send it to you. You can unsubscribe at any time using the link in any email.
- Pitches and enquiries: your name, email address, and the contents of your message — only when you choose to email our editorial inboxes.
- Analytics: with your consent, Google Analytics 4 counts page views, sessions and referrers (this sets cookies). We also use Cloudflare Web Analytics, which is cookieless and aggregate-only — no individual visitor profile is built.
- Advertising: ad slots are served by Google Ad Manager. We never run personalised advertising — ads are targeted on geography only. Without your consent, Ad Manager runs in “limited” mode and sets no advertising cookies on your device.
Lawful basis
Under UK GDPR, we rely on:
- Consent — for analytics and advertising cookies, and for newsletter signup. You can withdraw consent at any time (via “Cookie settings” in the footer, or the unsubscribe link in any newsletter).
- Legitimate interests — for handling pitches and enquiries you choose to send us, for cookieless aggregate analytics, and for keeping the site secure.
Who we share data with
We do not sell your personal data. We share it only with the service providers that keep the site and its mailing list running, each of which processes data on our behalf under contract:
- Resend — delivers the newsletter and stores the subscriber list.
- Google — Google Analytics and Google Ad Manager (only where you have consented to the relevant cookies). Google's privacy policy is at policies.google.com/privacy.
- Cloudflare — hosting, security, and cookieless analytics.
International transfers
Some of these providers (including Resend and Google) process data outside the UK, including in the United States. Where they do, the transfer is protected by UK-recognised safeguards — such as the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Agreement (IDTA) — so your data receives an equivalent level of protection.
How long we keep data
- Newsletter: until you unsubscribe.
- Editorial enquiries: retained for two years for record-keeping.
- Analytics: aggregate data is retained by Google for up to 14 months and by Cloudflare for up to six months.
Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected (rectification)
- Have your data deleted (erasure)
- Restrict or object to our processing
- Receive your data in a portable format
- Withdraw consent at any time, where we rely on it
To exercise any of these rights, email contact@radmedia.com.
Contact and complaints
If you have a complaint, please email us first so we can try to put it right. If you remain unhappy, you can raise the issue with the Information Commissioner's Office (ICO) at ico.org.uk.