Data Protection Notice

The operator of What To Do Next? is the controller of the personal data described here. Contact: legal@whattodonext.org. This notice sits alongside our Privacy Policy, which describes in detail what we collect and why.

• Contract — creating and running your account, publishing what you post.
• Legitimate interests — keeping the site secure, preventing spam and abuse, understanding usage in aggregate.
• Consent — optional analytics and advertising cookies, and any marketing email you sign up for. You can withdraw consent at any time.
• Legal obligation — responding to lawful requests and keeping records we are required to keep.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your data where we have no overriding reason to keep it.
• Restriction — pausing processing while a dispute is resolved.
• Objection — objecting to processing based on legitimate interests.
• Portability — receiving your data in a structured, machine-readable format.
• Withdrawing consent — for anything we do on the basis of consent.
• Complaint — lodging a complaint with your local data protection authority.

Email legal@whattodonext.org from the address registered to your account and tell us which right you want to exercise. We may ask a question to confirm your identity. We respond within 30 days; if a request is complex we will tell you and may extend by a further two months.

Requests are free. We may charge a reasonable fee, or decline, only where a request is clearly excessive or repetitive.

Some of our providers process data outside your country. Where that happens, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses or an adequacy decision.

We do not make decisions about you by purely automated means that have legal or similarly significant effects. Automated systems are used only to detect spam and abuse, and their decisions can be reviewed by a person on request.

If a breach is likely to result in a risk to your rights, we notify the relevant authority within 72 hours of becoming aware of it, and inform affected users without undue delay.