Last updated: 23 September 2026
1. Who we are
This website, cefa.org (“the Website”), is operated by Centre for Ethical Foreign Affairs Ltd, 117 Swingate Lane, London, England, SE18 2DQ, United Kingdom (“we”, “us”, “our”). We are the data controller responsible for personal data processed through this Website.
If you have any questions about this Privacy Policy or how we handle your data, you can contact us at:
- By email: iking@cefa.org
- By post: Centre for Ethical Foreign Affairs Ltd, 117 Swingate Lane, London, England, SE18 2DQ, United Kingdom
2. Overview
We aim to collect as little personal data as possible. We do not sell your personal data, and we do not use it for advertising or profiling. The Website uses a small number of services for security, performance, consent management, and privacy-friendly analytics, which are described below.
Information about the cookies and similar technologies used on this Website is provided in our separate Cookie Policy.
3. Hosting and server logs
The Website is hosted by Greyhound Studio Limited, The Storey, Meeting House Lane, Lancaster, England, LA1 1TH, United Kingdom. When you visit the Website, the server may automatically record technical information such as your IP address, browser type and version, operating system, referring URL, the pages you visit, and the date and time of access. This is necessary to deliver the Website and keep it secure.
Legal basis: Our legitimate interest in operating a secure and functional website (Art. 6(1)(f) UK GDPR).
Retention: Server logs are deleted after 3 days.
4. Cloudflare (content delivery and security)
We use Cloudflare, a content delivery network and security service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Traffic to the Website passes through Cloudflare’s network, which helps the Website load faster and protects it against attacks, spam, and abusive bots.
To do this, Cloudflare processes technical data such as your IP address, browser information, and details of your requests. Cloudflare may also set cookies that are strictly necessary for security purposes, such as distinguishing humans from bots.
Because Cloudflare is based in the United States, data may be transferred outside the EU/EEA. Cloudflare is certified under the UK Extension to the EU-U.S. Data Privacy Framework and also relies on Standard Contractual Clauses.
Legal basis: Our legitimate interest in the secure and efficient delivery of the Website (Art. 6(1)(f) UK GDPR). More information: https://www.cloudflare.com/privacypolicy/
5. WP Cerber Security
We use the WP Cerber Security plugin to protect the Website against hacking attempts, brute-force attacks, and spam. WP Cerber may record information such as your IP address, browser user agent, the pages or URLs requested, and login attempts, including the username entered. This information is used to detect and block malicious activity.
This data is stored on our own web server and is not shared with the plugin developer.
Legal basis: Our legitimate interest in protecting the Website and its users against attacks and misuse (Art. 6(1)(f) UK GDPR).
Retention: Activity logs are automatically deleted after 30 days.
6. Consent management (Real Cookie Banner)
To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.
The legal basis for the processing of personal data in this context are Art. 6 (1) (c) UK GDPR and Art. 6 (1) (f) UK GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.
The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.
7. Plausible Analytics
We use Plausible Analytics, a privacy-friendly analytics service provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, to understand how the Website is used in aggregate (for example, which pages are popular and where visitors come from).
Plausible does not use cookies and does not collect or store personal data. It does not track you across websites or devices. Your IP address is used only briefly to generate an anonymous daily visitor count; it is hashed together with a salt that changes every 24 hours, and the raw IP address is never stored. All data is processed on servers within the EU.
The information collected includes the page URL, referrer, browser type, operating system, device type, and country (derived from your IP address, which is then discarded).
Legal basis: Our legitimate interest in understanding and improving the Website (Art. 6(1)(f) UK GDPR). More information: https://plausible.io/data-policy
8. Contacting us
If you contact us by email or via a contact form, we will process the information you provide (such as your name, email address, and message) in order to respond to your enquiry.
Legal basis: Taking steps at your request (Art. 6(1)(b) UK GDPR) or our legitimate interest in responding to enquiries (Art. 6(1)(f) UK GDPR).
Retention: We keep this data only as long as needed to handle your enquiry, unless we are legally required to keep it longer.
9. Your rights
Under the UK GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we process your data;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at iking@cefa.org.
If you are unhappy with how we have handled your personal data, we would appreciate the chance to address your concerns first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
10. Security
This Website uses SSL/TLS encryption to protect data transmitted between your browser and our server. You can recognise an encrypted connection by “https://” in your browser’s address bar.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example when we add new services or when legal requirements change. The current version is always available on this page.