Data protection

GDPR & Data Protection Statement

Last updated: 8 October 2026

This statement explains the principles Through the Ether follows when handling personal information under UK data-protection law. For the detailed list of information, purposes and retention considerations, read the Privacy Policy.

1. Data-protection principles

Personal information should be:

used lawfully, fairly and transparently;
collected for clear and legitimate purposes;
limited to what is relevant and necessary;
kept accurate where accuracy matters;
kept no longer than reasonably required;
protected with appropriate security.

2. Lawful bases

The appropriate lawful basis depends on why information is being used. For this website and related business communications this may include taking steps at a person's request before entering a contract, performing a contract, complying with a legal obligation, and legitimate interests such as responding to genuine enquiries, operating the website and protecting systems from abuse.

Consent is used where consent is genuinely the appropriate basis, for example if a future optional cookie or similar technology requires it. Consent can be withdrawn for future processing where processing depends on consent.

3. Data minimisation

Through the Ether aims to collect only information reasonably required for the relevant purpose. General enquiry channels should not be used to send passwords, full payment-card information, special-category information or other sensitive data unless it is genuinely required and an appropriate secure method has been agreed.

4. Security and access

Access to administrative systems and personal information should be restricted to people who need it. Reasonable measures include secure passwords, access controls, HTTPS, software patching, backups where appropriate, and limiting direct access to databases and hosting controls.

5. Service providers

Providers may be used for hosting, infrastructure, email, security, payments or other service-specific functions. Where a provider processes personal information on behalf of Through the Ether, it should only receive the information reasonably required for its role and appropriate contractual or legal safeguards should apply.

6. International transfers

Where a provider processes personal information outside the United Kingdom, appropriate safeguards should be used where required by UK data-protection law.

7. Retention and deletion

Retention depends on the purpose and any legal, security, accounting or contractual requirements. Personal information should be reviewed and deleted or anonymised when it is no longer reasonably required. Individual products may publish more specific retention periods in their own privacy notices.

8. Individual rights

Depending on the circumstances, you may have rights including access, correction, erasure, restriction, objection and data portability, and the right to withdraw consent where consent is the lawful basis.

To make a request, use the contact page and state that it is a data-protection request. Reasonable information may be requested to confirm identity before disclosing or changing personal data.

9. Data incidents

Suspected personal-data incidents should be investigated promptly. Where UK law requires notification to the Information Commissioner's Office or affected individuals, the required steps should be taken within the applicable timescales.

10. Complaints and the ICO

Please contact Through the Ether first if you have a concern so it can be investigated. You may also complain to the UK Information Commissioner's Office (ICO), the independent regulator for data protection in the United Kingdom.