Legal
Privacy notice
Last updated: 28 October 2026
This notice explains how personal data is used when you visit www.luiguibleand.com and news.luiguibleand.com, the websites of the artist Luigui Bleand. It says who is responsible for your data, what data is involved, why, who else receives it, how long it is kept and what your rights are. Our Cookie policy lists each thing the sites store on, or read from, your device.
Who we are
The organisation responsible for your personal data on these websites (the 'controller') is the company named below. The controller decides why and how your data is used. In this notice, 'we', 'us' and 'our' mean that company.
- Name: IL LOKO MANAGEMENT LTD
- Private limited company registered in England and Wales, company number 16516206
- Registered office and postal address: 27 Old Gloucester Street, London WC1N 3AX, United Kingdom
- Registered with the Information Commission (ICO) as a data protection fee payer, reference ZC051588
- Other names it uses, as listed in that registration, include Bleand Style Recordings and Bleand Style Pictures
How to contact us about your data
To ask about your personal data, to use any of your rights or to make a complaint, email us at chat@illokomngt.io. You can also write to us by post at the address given in 'Who we are'.
chat@illokomngt.io is our address for privacy and data-protection matters. The bookings@illokomngt.io address shown elsewhere on the sites is for bookings and management enquiries; if you send a privacy request or complaint there instead, we will still deal with it.
What this notice covers
This notice covers www.luiguibleand.com (also reached at luiguibleand.com), news.luiguibleand.com and all their language versions. It also covers push.luiguibleand.com, the service behind the notification bell on both sites, and the emails you send us at the addresses published on these sites.
It does not cover other websites we link to, such as streaming services, social networks or press sites. Their own privacy notices apply once you go there.
The sites have no user accounts or logins, no newsletter and no comment or contact forms; you contact us by email. Our own code sets no advertising cookies, and we tell Microsoft Clarity to refuse advertising storage. If you agree to analytics, Microsoft may also use Clarity data for its own purposes, including advertising; see 'Visitor analytics'. Third-party content that you choose to load, namely YouTube videos, may use its own cookies and similar technologies, for example for analytics or advertising, under Google's own policies. The Cookie policy explains what we know about them.
Do you have to give us your data?
No. No law and no contract requires you to give us personal data. To load the sites at all, your browser has to send connection data such as your IP address; without it the pages cannot reach you. Everything else is optional: notifications, emails to us, analytics, and videos from YouTube. If you do not use them, you can still use the rest of the sites.
At a glance
| What | When | Who receives data | Your choice |
|---|---|---|---|
| Hosting, delivery and security | Every visit | Alibaba Cloud (ESA) | Needed to run the sites securely |
| Visitor analytics | Only if you switch on Analytics or choose 'Accept all' | Microsoft (Clarity) | Off unless you switch it on; switch it off at any time in Cookie settings |
| Notifications | Only if you press the bell and allow notifications when your browser asks | Alibaba Cloud; your browser's push service | The bell, at any time |
| Bleand Notes | Visits to the www homepage and its language pages | Alibaba Cloud | Part of the page |
| Tour dates | With the www homepage, as part of the page | Nobody else: the dates are part of our page | Nothing to switch: no other provider is involved |
| Music videos | Only when you press play, or, on news articles, by themselves if you switched on External content | Google (YouTube) | Your choice; switch External content off at any time |
| Settings remembered on your device | When you pick a language, choose a theme or move the Bleand note | They stay on your device; your language pick is also sent with your requests to our sites | On by default; switch off at any time in Cookie settings |
| Only if you write to us | Proton (our email provider) | Your choice | |
| Share buttons and links | Only when you click | The platform you choose | Your choice |
Hosting, delivery and security (Alibaba Cloud ESA)
Our sites are hosted and delivered by Alibaba Cloud's Edge Security Acceleration (ESA) network, which also protects them against attacks and floods of traffic. Every time your browser loads a page, image or file from our sites, it connects to ESA servers.
| Topic | Details |
|---|---|
| What data | Your IP address, browser type (user agent), the full address of the page or file requested (including anything after '?', such as a language code), the page you came from (referrer), other standard request headers, and the values of two security cookies, acw_tc and cdn_sec_tc. Your browser also sends any of our own cookies it holds with every request to our sites: your cookie choices (lb-consent), your language pick (lb-pick) and, if you use notifications, the lb-push code. The Cookie policy describes each one. |
| Notification check | If your browser supports notifications, then each time a page loads it also asks push.luiguibleand.com, our own notification service, whether notifications are available. That request sends the usual connection data, but no cookies and no subscription details, and the answer is not stored on your device. |
| Why | To deliver the sites, keep them working and protect them, for example by detecting and limiting floods of requests. The two security cookies let ESA recognise one browser's requests for an hour, so it can count how often they arrive. |
| Lawful basis | Legitimate interests (UK GDPR Article 6(1)(f)). Our interest is to deliver the sites you ask for and to keep them working and secure. The UK GDPR names processing needed to keep network and information systems secure as an example of a legitimate interest. This is the data any website receives when you visit it. The two security cookies need no consent, because storing them is strictly necessary to keep the service you asked for secure (PECR Schedule A1, paragraph 4). |
| Who receives it | Alibaba Cloud, our hosting provider; an invoice for our account, issued on 1 May 2026, names Alibaba Cloud US LLC as the issuer. Alibaba Cloud's terms include a Data Processing Addendum for all customers, under which Alibaba Cloud acts as our processor: it may process this data only to provide its services to us, and it may use subcontractors to do so. For technical troubleshooting, we have also used OpenAI's Codex to examine selected request diagnostics. Since 28 October 2026 our log-analysis scripts provide these tools only minimized aggregate counts rather than individual request records. |
| How long | The two security cookies last 1 hour on your device and are renewed with each page. Server logs: ESA keeps a standard access log of the requests to our sites, which records, among other things, your IP address, your browser type, the address requested, the page you came from, the country, region and network provider of your connection, and the time. We can see these logs in the ESA console for 31 days. Alibaba's documentation says that logs up to 180 days old can be retrieved through a support request; it does not say when they are deleted after that. |
| Alibaba's performance script | Until 28 October 2026, Alibaba's network added a script of its own (rum_common.js) to some of the pages it delivered. It sent the page address and your browser type to Alibaba and, if Alibaba's server asked it to, timed how quickly your browser connected to test addresses chosen by Alibaba and sent those timings back; your IP address was part of each connection. It stored nothing on your device, and our Cookie settings could not switch it off. On 28 October 2026 we switched off this optional collection in our Alibaba Cloud settings; in our checks afterwards the script was no longer added. We have not found Alibaba documentation that identifies the script, so we cannot tell you how Alibaba used those measurements, where it processed them or how long it keeps them. |
| International transfers | Our Alibaba Cloud account uses the Singapore region, and ESA servers are spread around the world; in our check on 26 October 2026, servers labelled as US locations answered. There are no UK transfer regulations (UK GDPR Article 45A) for Singapore, and for the United States they cover only organisations certified under the UK Extension to the EU-US Data Privacy Framework. For Alibaba Cloud we therefore rely on appropriate safeguards (UK GDPR Article 46): its Data Processing Addendum incorporates the EU standard contractual clauses (European Commission Implementing Decision (EU) 2021/914), together with the UK's International Data Transfer Addendum to those clauses (the 'UK Addendum') for personal data transferred from the UK. You can ask us for a copy at chat@illokomngt.io.chat@illokomngt.io |
Visitor analytics (Microsoft Clarity), only if you agree
We use Microsoft Clarity to understand how our pages are used, for example which parts get attention and where visitors get stuck. Clarity gives us heatmaps and session analytics.
Clarity does not load at all unless you switch on 'Analytics' in Cookie settings or choose 'Accept all'. If you choose 'Reject all', close the banner or simply ignore it, Clarity does not load. If your browser sends a Global Privacy Control signal and you have not made a choice, we treat that as a no. Clarity never runs on pages that are hidden from search engines.
Even after you agree, we tell Clarity that analytics storage and advertising storage are refused. This limits Clarity but does not stop it: Microsoft documents that in this mode Clarity assigns a separate ID to each page view and does not use its persistent tracking cookies to join those views or recognise returning visits. Clarity still records your page views and how you interact with each page, and sends this to Microsoft (see 'What data'). Clarity's advertising ID sync, which runs only when advertising storage is allowed, never runs on our sites. In our Clarity project settings, cookies are switched off and no advertising or analytics integration is connected (checked on 28 October 2026).
| Topic | Details |
|---|---|
| What data | The page address, the page you came from, the page title and language; your browser type and version and, where your browser shares them, platform, platform version, browser brands and device model; screen width, height and colour depth, pixel ratio, time zone, browser language, number of processor cores, touch support and device memory; whether your browser sends a Global Privacy Control signal; and how you interact with the page (for example clicks, scrolling and mouse movements), together with the content of the page as it is shown to you. Your IP address is part of the connection. The Clarity script also looks for its own cookie and for two Microsoft Advertising cookies (_uetvid and _uetmsclkid) on our domain; our sites never set the advertising cookies, and Clarity does not set its own cookie here. |
| Why | To improve the sites by seeing how pages are used. |
| Lawful basis | Consent (UK GDPR Article 6(1)(a)). PECR requires your consent before Clarity runs in your browser, and where PECR consent is needed, the ICO says the UK GDPR lawful basis should also be consent. When you agree to Analytics, you agree to Clarity running in your browser and sending this data to Microsoft, which also uses it for its own purposes as described under 'Who receives it'. You can withdraw your consent at any time; withdrawing does not affect the lawfulness of what was done with your consent before then. |
| If you switch Analytics off | Switching Analytics off in Cookie settings stops Clarity from loading and from sending new data from your browser; if Clarity was already running on the page, the page reloads once without it. It also removes any Clarity cookies on our domain. It does not delete data that Microsoft has already received. Microsoft's Clarity documentation says that the data of a single visitor cannot be deleted without deleting the whole project. To ask for deletion of data collected about you, email chat@illokomngt.io and we will handle your request with Microsoft as far as Clarity allows.chat@illokomngt.io |
| Who receives it | Microsoft. Under the Clarity terms, we and Microsoft are independent controllers of this data: each of us is responsible for its own use of it, and neither acts as the other's processor. Under those terms Microsoft may use the personal data it collects through Clarity for its own purposes, as described in the Microsoft Privacy Statement, including to provide and improve its products and to create profiles used, among other things, for advertising. Our Clarity project is linked to our Bing Webmaster Tools account, which is also a Microsoft service. |
| How long | Microsoft keeps Clarity data for periods it sets: recordings of visits for 30 days, after which it keeps a sample (1% of recordings or 10 recordings a day, whichever is higher) for up to 9 months; recordings we label or mark as favourites for 9 months; heatmaps and click data for 9 months. Microsoft says that after these periods the data on Clarity servers, including backups, is deleted. |
| International transfers | Microsoft stores Clarity data in its Azure cloud; the Clarity documentation does not say in which country. The Clarity script is served from Microsoft servers in the eastern United States, and Microsoft's general Privacy Statement says personal data is usually stored in the user's region or in the United States. For the United States, UK transfer regulations (the UK-US 'data bridge') cover transfers to organisations certified under the UK Extension to the EU-US Data Privacy Framework; Microsoft Corporation and its US subsidiaries that use the Microsoft name were listed as active participants on 26 October 2026. As an independent controller, Microsoft is responsible for any further transfers it makes; its Privacy Statement says it uses safeguards such as standard contractual clauses for some transfers. |
Third parties, including Microsoft, may collect personal data through Clarity on our sites. Microsoft collects or receives personal data from us through Clarity to provide Microsoft Advertising. How Microsoft uses personal data is described in the Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement.
Notifications, only if you switch them on
Both sites have a bell button. If you press it and then allow notifications when your browser asks for your permission, we send you a short notification when a new post is published on news.luiguibleand.com. Pressing the bell registers our notification script (a service worker) in your browser while it asks for your permission; the push subscription, and anything we store about it, are created only if you allow notifications.
| Topic | Details |
|---|---|
| What data | When you switch notifications on, your browser creates a push subscription and we store: the push address your browser gives us (a web address unique to your browser at your browser's push service), two keys your browser creates so that our notifications are encrypted for you, your device language, which of our sites you subscribed on, and the date and time. We also keep overall counts (total subscribers and subscribers per language) and the time of the last send, which do not identify you. Our notification service does not store your IP address, name or email address. Our hosting provider may log connections; see 'Hosting, delivery and security'. |
| Why | To send you the notifications you asked for, in your language, and to stop when you switch them off. If your device language changes, or once a week, the site quietly updates your subscription so it keeps working. |
| Lawful basis | Consent (UK GDPR Article 6(1)(a)). You give it by pressing the bell and then allowing notifications when your browser asks for your permission; both steps are needed. Pressing the bell registers the service worker while your browser asks for permission; the push subscription, the lb-push cookie and the three local-storage items that notifications use (listed in the Cookie policy) are created only after you allow notifications. You can withdraw your consent at any time by pressing the bell again or by blocking notifications for our site in your browser. |
| How long | We keep your subscription until you switch notifications off, or until your browser's push service tells us that the subscription no longer exists; we then delete it. There is no other time limit. If a notification cannot be delivered at once, the push service may hold it for up to 2 days. |
| How to switch off | Press the bell again on either site. Or block notifications for our site in your browser settings: on your next visit the site then removes your subscription. If your subscription stops working for another reason (for example after you clear your browser data), our next notification is rejected by the push service and we delete your record at that point. |
| Who receives it | Alibaba Cloud stores the subscriptions for us, as our processor under its Data Processing Addendum (see 'Hosting, delivery and security'). We send each notification, encrypted, to your browser's push service, which delivers it. Your browser chooses this service, not us; it is usually run by your browser's maker: Google for Chrome, Mozilla for Firefox (Firefox for Android also uses Google's messaging platform), Apple for Safari (the Apple Push Notification service) and Microsoft for Edge. We use the Web Push standard to send notifications. |
| International transfers | Subscriptions are stored in Alibaba's Edge KV, which is spread across Alibaba's global network; our account region is Singapore, for which there are no UK transfer regulations. For Alibaba Cloud we rely on the safeguards in its Data Processing Addendum: the EU standard contractual clauses with the UK Addendum (see 'Hosting, delivery and security'). Push services: to deliver a notification we send the push service your push address and the notification, encrypted so that only your browser can read it. Which company receives this depends on the push address your browser created. Google LLC (Chrome and other Chromium browsers) and Microsoft Corporation (Edge) were listed as active participants in the UK Extension to the EU-US Data Privacy Framework when we checked on 28 October 2026, so UK transfer regulations (the UK-US data bridge) cover them. Apple's privacy policy says that personal data of people in the UK is controlled by Apple Distribution International Limited in Ireland, and Ireland is covered by UK transfer regulations; we have not independently confirmed that this applies to the delivery of web push notifications. Mozilla Corporation (Firefox), in the United States, was not found in the Data Privacy Framework list, and we have not verified an applicable UK transfer safeguard for deliveries to Mozilla's push service in this review. |
Bleand Notes (Luigui's daily note)
On the www homepage and its language pages, a small floating note shows Luigui's current daily note. Your browser fetches the note directly from a cloud function we run on Alibaba Cloud Function Compute, at an Alibaba Cloud address in the Singapore region.
| Topic | Details |
|---|---|
| What data | Your IP address, browser type, and our site and page address (origin and referrer). The request carries no cookies. The images used for sharing are fetched only when you open or point at the share menu. |
| When | When the page loads. While the page stays open, the note is fetched again at most every 10 minutes, or when you come back to the tab after a minute or more. |
| Why | To show the latest note and let you share it. |
| Lawful basis | Legitimate interests (UK GDPR Article 6(1)(f)). Our interest is to show you the current note as part of the page you are visiting and to let you share it. The request carries only the connection data that any web request carries, and it stores nothing on your device. |
| Who receives it | Alibaba Cloud (Function Compute), our hosting provider, as our processor under its Data Processing Addendum (see 'Hosting, delivery and security'). |
| How long | Our function's code does not record or store any visitor data. Function Compute is set up to keep logs of our function in Alibaba Cloud's Log Service in Singapore: our code writes nothing about visitors to them, but the platform's own records of each request may include technical details of it. We have not yet been able to confirm how long that log store keeps them. |
| International transfers | The function runs in Alibaba's Singapore region; there are no UK transfer regulations for Singapore. We rely on the safeguards in Alibaba Cloud's Data Processing Addendum: the EU standard contractual clauses with the UK Addendum (see 'Hosting, delivery and security'). |
| On your device | If you minimise or drag the note, your browser remembers this while Preferences are on; see the Cookie policy. |
Tour dates
The tour dates on the www homepage and its language pages are part of the page, served by our own server: showing them sends nothing to Bandsintown, Google or any other provider. A ticket link next to a date is an ordinary link: nothing reaches the ticket site until you click it, and that site's own privacy notice then applies.
Until 28 October 2026, the dates could be loaded at your request through a widget from Bandsintown, which also loaded a font from Google Fonts; loading it sent your IP address, browser type and our site's address to Bandsintown and Google. We removed the widget because Bandsintown is no longer certified under the EU-US Data Privacy Framework and we had no transfer safeguard with it. To ask about data that Bandsintown or Google received through the widget, email chat@illokomngt.io and we will pass your request on to them.
Fonts
The fonts our sites use are served from our own servers, so loading them sends nothing to Google or to any other font provider. The only exception is inside the YouTube player, which may load fonts from Google itself when it loads (see 'Music videos').
Music videos (YouTube), only when you choose
We show official music videos from YouTube, using YouTube's privacy-enhanced domain (youtube-nocookie.com). Google says that in this privacy-enhanced mode, watching an embedded video does not influence your browsing experience on YouTube, and that any ads on the video are not personalised. It does not mean that the player collects nothing or stores nothing: see 'What data' below. Google's privacy policy is at https://policies.google.com/privacy.
Each video first shows a still image stored on our own server, and a note next to the videos says that playing one loads YouTube. On the homepage, a video always waits for you to press play. On news articles it depends on 'External content' in Cookie settings: while it is off (the default), nothing loads from YouTube until you press play; if you have switched it on, the player loads by itself when you open the article, without starting the video. Either way, once the player has loaded, Google receives data even if you never start the video.
| Topic | Details |
|---|---|
| What data | When the player loads: your IP address, browser type and our site's address (referrer). As soon as the player loads, even before a video plays, it sends usage and quality statistics and security checks to Google (youtube-nocookie.com, www.google.com and jnn-pa.googleapis.com) and saves data in your browser's storage for youtube-nocookie.com (see the Cookie policy). While a video plays, YouTube may collect more data under Google's own policies. |
| Why | To play the video you chose. |
| Lawful basis | Consent (UK GDPR Article 6(1)(a)), given when you press play after reading the note next to the videos, or by switching on External content. The player does more than deliver the video, for example it sends usage statistics to Google, so we ask for your consent; where PECR consent is needed, the ICO says the UK GDPR lawful basis should also be consent. |
| If you switch External content off | Players no longer load by themselves on news articles. If a player is on the page when you switch External content off, or when you save your choices with it off (for example with 'Reject all'), the page reloads once without it, whether it loaded by itself or because you pressed play. This does not delete data that Google has already received, or the items the player saved in your browser, which you can remove in your browser settings. To ask for deletion of data Google received, email chat@illokomngt.io and we will pass your request on to Google.chat@illokomngt.io |
| Who receives it | Google (YouTube), under Google's own privacy policy and terms. Google says that when the player loads, it shares basic data with YouTube to show the video's image and title, to check whether the video can play and for fraud and abuse reasons, and that more data is shared once the video plays. |
| How long | We do not receive or keep this data. Google keeps what it receives for as long as its own privacy policy provides. The items the player saves in your browser have no built-in expiry: they stay until the player removes them or you delete them in your browser settings. |
| International transfers | Google LLC, in the United States, was listed as an active participant in the UK Extension to the EU-US Data Privacy Framework on 26 October 2026, so UK transfer regulations (the UK-US data bridge) cover data it receives under that certification. |
When you email us
The sites show bookings@illokomngt.io for bookings, management and website contact, and this notice gives chat@illokomngt.io for privacy and data-protection matters. If you write to either address, you send the message from your own email program.
bookings@illokomngt.iochat@illokomngt.io
| Topic | Details |
|---|---|
| What data | Your email address, your name if you give it, your message and anything you attach. |
| Why | To read and answer your message, to handle booking and management requests, and to deal with requests and complaints about your personal data. |
| Lawful basis | Legitimate interests (UK GDPR Article 6(1)(f)): our interest is to read and answer the messages people send us and to handle the booking and management requests they contain. When you use your data protection rights or make a complaint, we use your message to deal with it as the law requires (UK GDPR Article 6(1)(c), legal obligation). |
| Who receives it | Proton AG, of Geneva, Switzerland, which provides our mailbox as our processor, under the data processing agreement that is part of Proton's terms. A message sent to us as ordinary email, without compatible end-to-end encryption, is normally protected while it travels between mail servers; when it arrives, Proton scans it in memory for spam and viruses and then encrypts it for storage. Proton says that, because of how email works, it can see the sender and recipient addresses, the subject, the names of attachments, the times a message was sent and received, and the IP address an incoming message came from. We share your message with others only where that is needed to deal with your request (for example with a venue or promoter, if you ask us about a booking) or where the law requires it. Your own email provider also handles your message, under its own terms. |
| How long | We keep emails as long as we need them to answer you and to handle any booking or work that follows, and then delete them, unless we have to keep them longer for legal, tax or accounting reasons or to deal with a legal claim. Proton says it keeps encrypted backups for up to 30 days. |
| International transfers | Proton says it stores mail data, encrypted, only on servers in Switzerland, Germany or Norway. UK transfer regulations cover all three countries: Switzerland, and Germany and Norway as countries of the European Economic Area. No further safeguard is needed. |
Settings remembered on your device
Some choices are remembered in your browser so the site works the way you set it: the language you pick in the language menu, light or dark theme, and where you put the Bleand note. They hold only the setting itself. Your language pick is also kept in a cookie shared by www and news, so it is sent with your requests to our sites. The Cookie policy lists each item and how long it lasts.
These settings ('Preferences') are on by default. You can switch them off at any time in Cookie settings, or by choosing 'Reject all'; the site then deletes the settings it saved, stops saving them and uses its defaults.
On a visit where you have not chosen a language, either in the menu or through the address you opened (for example www.luiguibleand.com/es/), the site reads your device's time zone and, if needed, your browser's language to show the site in a matching language. It stores nothing and sends nothing anywhere for this. To avoid it, open a page at its language address (for example www.luiguibleand.com/en/), or pick a language in the menu while Preferences are on.
Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)), where these settings count as personal data. Our interest is to show the site in your language and in the way you set it. Under PECR we rely on the exception for storage or access whose only purpose is to adapt the site's appearance or functions to your preferences. It applies only if you are told about it and have a simple, free way to object, which this notice, Cookie settings and the language addresses give you.
Where your data goes (international transfers)
Some of our providers handle data outside the UK. UK law allows personal data to be transferred abroad only if UK transfer regulations (UK GDPR Article 45A) cover the destination, if appropriate safeguards are in place (UK GDPR Article 46, for example the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses), or, in limited cases, if a specific exception applies (UK GDPR Article 49). For each provider, the table shows whether UK transfer regulations exist for the destination and the safeguard we rely on.
| Provider | What for | Where (as far as known) | UK transfer regulations | Safeguard relied on |
|---|---|---|---|---|
| Alibaba Cloud ESA and Edge KV | Hosting, security and notification subscriptions | Account region Singapore; servers worldwide (US-labelled servers answered our check on 26 October 2026). Alibaba's documentation does not say where ESA access logs are stored | None for Singapore. For the United States, only for organisations certified under the UK Extension to the EU-US Data Privacy Framework; we do not rely on that for Alibaba Cloud | Alibaba Cloud's Data Processing Addendum: the EU standard contractual clauses (Implementing Decision (EU) 2021/914) with the UK Addendum |
| Alibaba Cloud Function Compute | Bleand Notes | Singapore | None for Singapore | Alibaba Cloud's Data Processing Addendum: the EU standard contractual clauses (Implementing Decision (EU) 2021/914) with the UK Addendum |
| Microsoft (Clarity) | Analytics, only with your consent | Microsoft's Azure cloud; the country is not stated. Script served from the eastern US | United States: yes, for Microsoft Corporation and its US subsidiaries that use the Microsoft name, listed as active in the UK Extension to the EU-US Data Privacy Framework on 26 October 2026 (next renewal due 31 August 2027) | UK transfer regulations (UK-US data bridge); no further safeguard needed. Microsoft, as a separate controller, is responsible for its own further transfers |
| The YouTube player, only with your consent or your click | Not stated by Google for these services; Google LLC is in the United States | United States: yes, for Google LLC, listed as active in the UK Extension to the EU-US Data Privacy Framework when we checked on 26 and 28 October 2026 (next renewal due 13 September 2027); the listing does not name YouTube separately | UK transfer regulations (UK-US data bridge); no further safeguard needed | |
| Proton | Switzerland, Germany or Norway (Proton's servers) | Yes: Switzerland, and Germany and Norway as countries of the European Economic Area | None needed (covered by UK transfer regulations) | |
| Browser push services | Delivering notifications, only if you switch them on | Depends on your browser's push service: Google LLC or Microsoft Corporation (United States), Apple (its privacy policy names Apple Distribution International Limited, Ireland, for people in the UK) or Mozilla Corporation (United States) | Google and Microsoft: yes (UK Extension to the Data Privacy Framework, active when we checked on 28 October 2026). Apple: Ireland is covered by UK transfer regulations; that this delivery route goes to Apple Distribution International Limited has not been independently confirmed. Mozilla: none found | Google and Microsoft: UK transfer regulations; no further safeguard needed. Apple: not independently confirmed for this delivery route. Mozilla: we have not verified an applicable UK transfer safeguard for deliveries to Mozilla's push service in this review |
To get a copy of the safeguards we rely on, email chat@illokomngt.io.
Your rights
You have these rights over your personal data. Some apply only in certain cases.
- Access: ask for a copy of your data and information about how we use it.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Portability, where it applies: ask for data you gave us in a commonly used digital format.
- Withdraw consent: where we rely on your consent (analytics, videos and notifications), you can withdraw it at any time, as easily as you gave it: in Cookie settings at the bottom of every page, or with the bell for notifications. This does not affect the lawfulness of anything we did with your consent before you withdrew it.
- Object: see 'Your right to object' below.
- Complain: to us and to the Information Commission; see 'Complaints' below.
We do not carry out automated decision-making about you that requires safeguards under Article 22C of the UK GDPR.
To use your rights, email chat@illokomngt.io. If we need information from you to find your data or to confirm who you are, we will ask for it, and the time we have to reply pauses until we receive it. We will search for your data in a reasonable and proportionate way.
If you suffer damage because we break data protection law, you can claim compensation from us, through the courts if needed. The Information Commission cannot award compensation.
Your right to object
Where we rely on legitimate interests (hosting and security, Bleand Notes, the settings remembered on your device, and emails), you have the right to object at any time to our use of your data, on grounds relating to your situation. Email chat@illokomngt.io and tell us why. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims, and we will tell you our decision.
For the settings remembered on your device, you can also simply switch off Preferences in Cookie settings. Where we rely on consent (analytics, videos and notifications), you can say no or withdraw at any time: analytics and external content in Cookie settings, notifications with the bell.
Complaints
You have the right to complain to us about how we use your personal data. Email chat@illokomngt.io, or contact us in any other way you like: we accept a complaint however it reaches us.
We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you informed of progress and tell you the outcome.
You also have the right to complain to the UK regulator, the Information Commission (known as the ICO), at any time. Complaining to us is not a condition for that right, although the ICO usually asks people to raise the matter with the organisation first and to give it a copy of that complaint. To complain to the ICO: https://ico.org.uk/make-a-complaint/data-protection-complaints/ or call its helpline on 0303 123 1113.
ico.org.uk/make-a-complaint/data-protection-complaints/
You can also report concerns about cookies to the ICO at https://ico.org.uk/make-a-complaint/cookies/.
If you are in the European Union
If the EU General Data Protection Regulation (EU GDPR) applies to our use of your data, you also have the right to complain to a data protection supervisory authority in the EU country where you usually live, where you work or where the alleged infringement took place. In Italy, for example, this is the Garante per la protezione dei dati personali.
Children
Our sites are not aimed at children, and we do not knowingly collect children's data.
Changes to this notice
We will update this notice when our sites, or the way we use data, change, and before we add any new feature that uses personal data. The date at the top shows the current version.
If a change affects something you agreed to, for example a new purpose or a new third party, we will ask you again through the cookie banner before it applies to you.