Privacy Policy

1. Who is responsible

The controller responsible for this website under the EU General Data Protection Regulation (GDPR) is:

gilbertleung.org — Gilbert Leung
c/o Online-Impressum 11199
Europaring 90
53757 Sankt Augustin
Germany
Email: contact@gilbertleung.org

2. Visiting this website

This website is hosted by Alpha Internet Limited, trading as Zume, Grosvenor House, 3 Chapel Street, Congleton, Cheshire, CW12 4AB, United Kingdom, on servers in the United Kingdom. The EU has recognised the UK as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR).

Each time you visit, the server automatically records technical information in log files: your IP address, the date and time of access, the page requested, the referring page, your browser and operating system. This is necessary to deliver the website and keep it secure. The legal basis is my legitimate interest in the secure and reliable operation of the site (Art. 6(1)(f) GDPR). The log files for this website are processed into anonymous visitor statistics and then deleted, normally within a few hours. For security and abuse prevention, the host also keeps its own server logs, which include IP addresses, for 180 days. Backups of the website, including any personal data it holds, are kept by the host for about 30 days, on its own servers in the United Kingdom and the Netherlands.

I use the log analysis tool AWStats, provided by the host, to see aggregate visitor numbers. It works only from these server log files, sets no cookies, and places nothing on your device.

This website uses no cookies and no tracking. The fonts are stored on this server, so no connection is made to font providers such as Google Fonts.

3. Login security

To protect the site against automated login attempts, the IP address involved in failed logins to the administration area is stored temporarily, and access is blocked after repeated failures. These records expire automatically, usually within 24 hours. The legal basis is my legitimate interest in protecting the website (Art. 6(1)(f) GDPR).

4. Newsletter

If you subscribe, I use your email address to send you occasional news about new videos, publications and talks. The legal basis is your consent (Art. 6(1)(a) GDPR).

Subscription uses a double opt-in process: after signing up you receive an email asking you to confirm, and only then are you added to the list. I store your email address and the dates on which you signed up and confirmed, as proof of your consent. Signups that are never confirmed are deleted after seven days.

The list is held on this website’s own server. No email marketing service is involved, and your address is not passed to anyone. Outgoing email from this server is transmitted via MailChannels Corporation (Canada), a delivery service used by the host and covered by its data processing agreement.

Newsletters contain no tracking: I cannot see whether you open an email or click a link.

You can withdraw your consent at any time by using the unsubscribe link in any email, by visiting gilbertleung.org/unsubscribe, or by emailing me. Your address is then deleted immediately; copies in the host’s backups expire within about 30 days.

5. Videos

The homepage can show a video from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video does not load until you click on it. Only then does your browser connect to YouTube, which receives your IP address and information about your device and sets cookies. If you are logged in to a Google account, YouTube can associate the visit with it. Google may transfer data to the United States; Google LLC is certified under the EU–US Data Privacy Framework.

The legal basis is your consent, given by clicking to play the video (Art. 6(1)(a) GDPR and § 25(1) TDDDG). For details, see Google’s privacy policy: https://policies.google.com/privacy

6. Contacting me

If you email me, I use your message and contact details to reply. The legal basis is my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or steps towards a contract where your enquiry concerns one (Art. 6(1)(b) GDPR). Emails to this address are held on the same server as the website, with the host named in section 2. I delete correspondence when it is no longer needed, unless legal retention obligations apply.

7. Links to other websites

This site links to other websites, including YouTube, LinkedIn, Critical Legal Thinking and Counterpress. They are responsible for their own data processing once you follow a link.

8. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or its processing restricted (Art. 18), and to data portability (Art. 20). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)).

Right to object: where processing is based on legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise any of these rights, email contact@gilbertleung.org.

You also have the right to lodge a complaint with a data protection supervisory authority, in the member state of your residence or workplace or where you believe an infringement has occurred.

9. Changes

I may update this policy when the website changes. The current version always appears on this page.

Last updated: 24 September 2026