Privacy Notice
Effective date: 11 August 2026 Last updated: 19 September 2026
Who we are
ELIN is a trading name of Nexum House Ltd. Nexum House Ltd is the controller of the personal information described in this notice.
Nexum House Ltd is a private limited company registered in England and Wales under company number 17299788. Its registered office is 66 Paul Street, London, United Kingdom, EC2A 4NA.
Privacy enquiries and complaints: hello@elinarc.com with the subject line Privacy.
What this notice covers
This notice explains how we use personal information when you:
- visit the ELIN website;
- contact us about the Journal, a commission, a partnership or another professional matter;
- take part in an interview or editorial project under separate agreed terms;
- register interest in, book, attend or propose to teach at ELIN Sessions;
- subscribe to an ELIN Dispatch, if and when that service is activated; or
- otherwise deal with ELIN or Nexum House Ltd in a professional capacity.
Information we collect
Depending on how you interact with us, we may collect:
- your name, role, organisation and professional contact details;
- the content and history of correspondence with us;
- commission enquiries, proposals and information needed to scope or perform a contract;
- interview recordings, transcripts, quotations, biographical details and agreed editorial material;
- Sessions interest, booking and attendance records, including the topics you select and, for practitioners, a link to your work;
- consent, release, licensing and preference records;
- subscription status and unsubscribe history, if Dispatch is activated;
- basic technical and security information made available by our hosting systems, such as IP address, device/browser information, request time and error/security logs; and
- records needed for accounting, legal claims, complaints and regulatory compliance.
We may receive professional information directly from you, from a colleague or referrer, or from public sources such as an organisation's website, published work or professional register. We do not ask you to send health information or other sensitive personal information through the website.
Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and deciding whether to work together | Our legitimate interests in operating ELIN; and, where relevant, steps requested before entering a contract |
| Performing and administering a commission or supplier relationship | Contract; legal obligation; and legitimate interests in managing our work and records |
| Researching, producing and maintaining editorial work | Legitimate interests in editorial and cultural publishing; consent or contract where specifically agreed; and applicable journalistic protections where their legal conditions are met |
| Recording Sessions interest and practitioner introductions, and contacting you when a relevant session opens | Consent, which you can withdraw at any time. Bookings and attendance are handled as a contract |
| Operating, securing and diagnosing the website | Legitimate interests in providing a secure, reliable service |
| Sending Dispatch to individual subscribers | Consent. Dispatch will not be activated until a compliant signup and withdrawal process is in place |
| Relevant business-to-business contact | Legitimate interests, subject to the electronic-marketing rules that apply to the recipient and an effective opt-out |
| Accounting, tax, disputes and compliance | Legal obligation and legitimate interests in establishing, exercising or defending legal rights |
Where we rely on legitimate interests, we consider the purpose, necessity and effect on the individual. You may object to this processing as explained below.
ELIN Sessions
If you register interest in ELIN Sessions, we use your name, email address and selected topics only to contact you about relevant sessions. Registering interest is not a booking or a payment commitment. We do not share your details with practitioners, hosts, sponsors or partner brands without your separate permission.
Where a practical session involves products applied to the skin, we will ask about relevant sensitivities or allergies at the booking stage, only to keep you safe at that session and only with your explicit consent. We delete that information after the session unless an incident or legal claim requires us to keep it.
Photography or filming at a session takes place only with notice. You may choose not to appear on camera, and we will ask for separate written consent before using your image in published material.
Who receives information
We disclose personal information only where reasonably necessary. Recipients may include:
- website hosting, domain, email, cloud-storage and other technology providers;
- professional advisers such as accountants, insurers and lawyers;
- photographers, editors, researchers or production partners working under appropriate obligations;
- a client or project partner where this is necessary and transparent for the agreed work; and
- courts, regulators, law-enforcement bodies or other authorities where legally required.
We do not sell personal information.
International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law requires a safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement/Addendum, or another lawful transfer mechanism. You may ask us for information about the relevant safeguard.
How long we keep information
We keep information only for as long as it is needed for its purpose, legal duties and the defence of legal claims. Our current working periods are:
- general enquiries that do not proceed: 12 months after the last meaningful contact;
- prospective commission discussions: 24 months after the last meaningful contact;
- Sessions interest registrations: until you withdraw, or 24 months after we last contacted you about a session, whichever is sooner;
- contracts, invoices and core accounting records: normally 6 years after the relevant financial period or relationship, subject to legal requirements;
- website security and diagnostic logs: normally up to 90 days unless needed for an incident;
- Dispatch consent evidence: while subscribed and for up to 3 years after withdrawal; a minimal suppression record may be kept longer so we do not contact someone who opted out;
- contributor releases, rights records and material actually published: for as long as the publication and associated rights need to be maintained; and
- unsuccessful or unused editorial material: reviewed at least every 24 months and deleted or anonymised when no longer needed.
We may retain information for longer when a complaint, dispute, safeguarding concern, legal hold or regulatory duty requires it. We may delete it earlier where it is no longer necessary.
Your rights
Depending on the circumstances, you may have the right to:
- be informed about our use of your information;
- ask for access to it;
- ask us to correct inaccurate or incomplete information;
- ask us to erase it;
- ask us to restrict its use;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format; and
- withdraw consent at any time, without affecting earlier lawful processing.
These rights are not absolute. In particular, data-protection law contains exemptions that may apply to journalism, freedom of expression, confidential sources, legal privilege or legal claims. If we rely on an exemption, we will consider and document why it applies.
To exercise a right, email hello@elinarc.com with the subject Privacy request. We may ask for information needed to confirm identity and locate the relevant records.
Data-protection complaints
Email hello@elinarc.com with the subject Data protection complaint. We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay and keep you informed of its progress and outcome.
You may also complain to the Information Commissioner's Office. Details are available at ico.org.uk/make-a-complaint.
Security
We use proportionate organisational and technical measures to protect personal information. No internet service is completely secure, so please do not send highly sensitive or confidential material unless a secure method has been agreed.
Children
The website and services are not directed to children. We do not knowingly collect personal information from children through the website. A project involving anyone under 18 requires a separate safeguarding, consent and privacy process before it begins.
Automated decisions
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.
Changes
We will update this notice when our services, suppliers or legal obligations change. The current version and effective date will remain on this page.