Privacy and Cookie Policy: UK GDPR, Cookies and Third-Party Advertising
How RiskStance collects, uses and protects your data, how our cookie banner and advertising partners work, and the rights you have in the UK and around the world.
Who We Are and Scope of This Policy
This Privacy and Cookie Policy explains how personal data is collected and used when you visit RiskStance.com or contact us. The site is owned and operated by Jis Johnson, who also owns jis.to, and is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Where EU or EEA law applies, we also follow the EU GDPR. You can contact us about privacy at hi@riskstance.com.
Summary. We collect only what we need to run the site, answer your messages and understand how our guides are used. With your consent, we and our advertising partners use cookies for analytics and advertising. You can change your cookie choices at any time, and you have strong rights over your data.
The Personal Data We Collect
Information you give us
Your name, email address and message content when you email us, plus anything else you choose to include. If we add a newsletter or comment form, we will tell you what it collects at the point of sign-up.
Information collected automatically
IP address, device and browser type, operating system, screen size, language, approximate location derived from the IP address, pages viewed, time on page, referring website and error logs.
Cookie and advertising data
Cookie identifiers, mobile advertising IDs, ad interaction data and, where you consent, interest and browsing signals used by analytics and advertising partners.
We do not knowingly collect special category data such as health, ethnicity or religion. Please do not include it in messages to us. Our guides discuss financial and health protection topics in general terms only.
How We Use Your Data and Our Legal Bases
Under UK GDPR we must have a lawful basis for each use of your personal data. The table below explains ours.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide and secure the website | IP address, device data, logs | Legitimate interests (running and protecting our site) |
| Reply to emails and corrections | Name, email, message | Legitimate interests, or steps you ask us to take |
| Analytics and improving content | Usage data, cookie IDs | Consent (non-essential cookies under PECR) |
| Show third-party ads and banners | Cookie IDs, ad IDs, approximate location, page data | Consent |
| Handle data requests and legal duties | Identity and request details | Legal obligation |
| Marketing emails, if offered | Name, email | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we balance them against your rights and expectations. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
Cookies and Similar Technologies
Cookies are small files placed on your device. We also use similar technologies such as pixels, local storage and device identifiers, and we refer to all of them as cookies. Under PECR and UK GDPR, we ask for your consent before setting cookies that are not strictly necessary. When you first visit, a cookie banner lets you accept all, reject non-essential cookies or choose by category. Rejecting is as easy as accepting.
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Strictly necessary | Security, load balancing, remembering your cookie choice | Consent record, session and security cookies | Not required |
| Preferences | Remember settings such as language or display | Site preference cookies | Required |
| Analytics | Measure visits and understand which guides help readers | Analytics platforms such as Google Analytics | Required |
| Advertising | Serve, limit and measure ads, and personalise them where permitted | Ad networks and exchanges such as Google AdSense or Ad Manager | Required |
| Social and embedded | Videos, share buttons and embedded content | YouTube, social platforms | Required |
Managing cookies. You can change or withdraw consent at any time using the cookie settings link in the footer of the site, which reopens the banner. You can also block or delete cookies in your browser settings, though some parts of the site may then work less well. Browser and device settings, including the Global Privacy Control signal, are respected where our systems support them.
Third-Party Advertising and Banners
RiskStance may display advertisements and banners provided by third-party advertising networks, exchanges and publishers. These partners may act as independent controllers of the data they collect through their own cookies and identifiers. Their processing is governed by their own privacy notices.
- What they may collect: IP address, device and browser data, cookie or advertising IDs, pages viewed, ad interactions and approximate location.
- Personalised and contextual ads: with your consent, partners may use your browsing history across sites to show interest-based ads. If you do not consent, you may still see contextual or non-personalised ads, which are based on the page you are viewing rather than your profile.
- Measurement and fraud prevention: partners may count ad views, limit repeat ads and detect invalid traffic.
- Consent frameworks: we may use a consent management platform and industry signals, such as the IAB Transparency and Consent Framework or Google consent signals, to pass your choice to advertisers.
- Affiliate links: if you click one, the merchant or network may set a cookie to attribute the sale to us.
How to opt out. Use our cookie settings, or visit tools run by the industry and Google: Your Online Choices (UK and EU), Digital Advertising Alliance and Network Advertising Initiative (US), and Google Ad Settings. Opting out does not remove ads; it limits personalisation.
We do not sell your personal data for money. In some places, sharing data with advertising partners may be described as a sale or as sharing for cross-context behavioural advertising. See the section on other countries for how to opt out.
AI, Our Content and Your Data
RiskStance publishes well-researched content created with AI assistance and human writing and editing. AI tools are used to help prepare articles, not to profile readers. We do not intentionally enter your personal data, such as emails you send us, into AI tools, and we do not use automated decision-making that produces legal or similarly significant effects about you. If we ever introduce an AI feature that processes reader data, such as a chatbot or calculator, we will update this policy and give you the relevant information and choices first. Read more in our Editorial Policy.
Who We Share Data With and International Transfers
We share personal data only where necessary, and only with the following types of recipient.
- Hosting, content delivery, security and email providers who process data on our instructions.
- Analytics, consent-management and advertising partners, as described above.
- Professional advisers, regulators, courts or law enforcement where we are legally required or permitted.
- A buyer, if the site is ever sold, subject to this policy.
Some providers are located outside the UK and EEA, including in the United States. Where we or our partners transfer data internationally, we rely on safeguards recognised by UK GDPR, such as adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge where a recipient is certified.
How Long We Keep Data and How We Protect It
We keep personal data only as long as needed for the purposes above. As a guide, emails are kept for up to 24 months after the conversation ends unless needed longer for legal reasons, analytics data is generally kept for up to 14 months, and cookie lifetimes are shown in the cookie settings panel. Advertising partners apply their own retention periods. We use reasonable technical and organisational measures, including encryption in transit, access controls and updates, but no online system is completely secure. If a breach is likely to harm you, we will tell you and, where required, the Information Commissioner’s Office within 72 hours.
Your Rights Under UK GDPR
Access
Ask for a copy of the personal data we hold about you.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Ask us to delete your data in certain circumstances.
Restriction and objection
Ask us to limit processing or object to uses based on legitimate interests or direct marketing.
Portability
Receive data you provided in a common, machine-readable format.
Withdraw consent
Change your cookie settings or unsubscribe at any time.
To use any right, email hi@riskstance.com with the subject “Data request”. We may need to verify your identity. We aim to respond within one month, and we do not normally charge a fee. Because our cookie and advertising data is held by third parties, you may need to contact them directly as well.
Readers Outside the UK
RiskStance is read around the world, and we aim to respect local privacy laws. The following summarises key rights, and you may have additional rights where you live.
- European Union and EEA: you have rights equivalent to those under UK GDPR and may complain to your national data protection authority.
- United States: residents of states such as California, Colorado, Virginia and others may have rights to know, delete, correct and opt out of the sale or sharing of personal data and targeted advertising. You can exercise these by emailing us or using your cookie settings and browser signals such as Global Privacy Control. We do not discriminate against you for using these rights.
- Canada (PIPEDA), Australia (Privacy Act), Brazil (LGPD), South Africa (POPIA), India (DPDP Act) and others: you may have rights of access, correction, deletion and objection, and you may contact your local regulator.
Children’s Privacy
RiskStance is intended for adults and is not directed at children. We do not knowingly collect personal data from children under 13, or under a higher age set by local law. If you believe a child has given us personal data, please contact us and we will delete it.
External Links
Our pages link to external sites and advertisements. We do not control them and are not responsible for their privacy practices, so please read their notices.
Complaints and Changes to This Policy
If you have a concern, please contact us first at hi@riskstance.com and we will try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113, or to your local supervisory authority. We may update this policy when our practices or the law change. We will post the new version here with a new date and, for material changes, ask for fresh consent where needed.
Do you use cookies?
Yes. Strictly necessary cookies are always on. Analytics and advertising cookies are used only with your consent, which you can withdraw at any time in the cookie settings.
Do you sell my data?
We do not sell personal data for money. Advertising partners may collect data through cookies if you consent, as described above.
Is the content written by AI?
It is created with both AI and human writers and editors, and reviewed by people. See our Editorial Policy for details.
Last updated: 7 November 2026. This policy is general information and is not legal advice.