Privacy Policy

1. Who runs this site

RealmFocus is an independent editorial project published at realmfocus.com from Australia. In this policy, "we", "us" and "the desk" mean the operator of RealmFocus. We decide how and why personal information collected through this site is handled, and we are responsible for keeping that handling in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Questions about this policy, requests for access to your information, and complaints all reach us at studio@realmfocus.com.

2. What we collect

We keep collection to what the site actually needs. Depending on how you use RealmFocus, that can include:

• Technical connection data — IP address, browser user-agent, operating system, screen size, referring page, requested URLs and the date and time of each request. These end up in standard server logs kept by our hosting provider.
• Cookies and similar storage — small files and browser storage entries set when you visit, including the record of your choice in the cookie notice, which is stored locally in your browser.
• Subscription form data — the e-mail address you enter, the name you optionally enter, and the fact and time of your consent.
• Plus membership data — if you join the Plus list, the e-mail address you gave us, the state of the membership (on the list, seat confirmed, active, cancelled) and the dates attached to it, including the date a seat was confirmed and the date of any cancellation.
• Push subscription identifiers — if you allow browser notifications, a subscription identifier and related technical attributes (browser type, device type, language, time zone) generated by our push provider.
• Analytics and advertising signals — aggregated usage measurements and identifiers set by third-party tags, where you have consented to the analytics or advertising categories.

We do not ask for a phone number, a postal address or identity documents, and we do not knowingly collect sensitive information as defined by the Privacy Act 1988. We never see or store card numbers or other payment credentials: anything to do with a Plus membership charge is handled by an external payment provider on its own systems, and only the state of the membership comes back to us.

3. Why we handle it, and on what basis

Technical connection data is handled so the site can be delivered, kept available and protected against abuse — this rests on our legitimate interest in running a functioning, secure website.

Form data and push identifiers are handled only after you give consent: you tick the consent box before submitting the form, and your browser asks you separately before notifications are allowed. Analytics and advertising storage is set only where you accept those categories in the cookie notice.

Plus membership data is handled so we can run the membership you asked for: to place you on the list, to confirm a seat by e-mail, to send the digest and the extended write-ups that a membership covers, to arrange the charge with our payment provider and to keep the record of the arrangement that Australian tax and accounting rules require us to keep.

Consent is voluntary and can be taken back at any time, without affecting the lawfulness of what happened before. To take it back, use the unsubscribe link in any e-mail we send, turn notifications off in your browser settings, clear the site's stored preference, or write to the address in section 1.

4. How long we keep it

• Server logs — up to 12 months, then deleted or aggregated.
• Subscription records (address, optional name, consent record) — until you unsubscribe or ask for deletion, and no longer than 24 months after the last contact.
• Plus membership records (address, membership state, dates) — while the membership runs and for as long afterwards as Australian tax and accounting rules require records of the arrangement to be kept, generally 5 years from the last period.
• Push subscription identifiers — until you turn notifications off or the subscription expires on the provider's side.
• Cookie preference — up to 12 months in your browser, or until you clear site data.
• Correspondence sent to our contact address — up to 24 months after the matter is closed.

5. Who else sees it

We do not sell personal information and we do not trade contact lists. Information is shared only with service providers who process it on our instructions, and only to the extent their service requires:

• Hosting and content delivery providers — they store the site files and process connection data in their server logs.
• OneSignal — our processor for push subscriptions and for e-mail addresses submitted through the subscription form. OneSignal stores the subscription identifier, the address and the tags attached to it so that catalogue notes can be delivered.
• Our payment provider — where you take out a Plus membership, the provider receives what it needs to arrange the charge and handles your card details on its own systems under its own policy. It returns to us only the state of the membership, never the card details themselves.
• Advertising networks and measurement partners — where you have accepted the advertising or analytics categories, these partners may receive identifiers and usage signals through their tags.

Some of these providers operate servers outside Australia. Where information is disclosed to an overseas recipient, we take reasonable steps to make sure it is handled consistently with the Australian Privacy Principles, including through the contractual terms of the provider.

We may also disclose information where we are required to by Australian law or by a lawful request from a public authority.

6. Cookies

Cookies, local storage and similar technologies are described in detail — by category, purpose and lifetime — in our cookie policy. Essential storage keeps the site working and your notice choice remembered; analytics and advertising storage is set only after you accept those categories.

7. Your rights and how to complain

Under the Privacy Act 1988 and the Australian Privacy Principles you may ask us to give you access to the personal information we hold about you, to correct it if it is inaccurate, out of date or incomplete, and to delete it where we have no ongoing reason to keep it. You may also ask us to stop sending marketing messages, and you may deal with us anonymously or under a pseudonym where that is practical.

Write to the address in section 1 and we will respond within 30 days. If we refuse access or correction, we will explain why in writing.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC), the national privacy regulator, at oaic.gov.au or by phone on 1300 363 992. We ask that you raise the matter with us first so we have a chance to fix it.

8. Security

The site is served over an encrypted HTTPS connection. Access to subscription data is limited to the people who run the desk, protected by individual credentials and multi-factor sign-in where the provider supports it. We review the third-party services we rely on and remove those we no longer need.

No transmission over the internet is ever completely secure, so we cannot guarantee absolute protection. If a data breach happens that is likely to cause serious harm, we will notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.

9. Children

RealmFocus is written for a general adult audience and the subscription form is not directed at children. If you believe a child has given us personal information, write to us and we will delete it.

10. Changes to this policy

We update this policy when the site, our providers or the law change. The date at the top always shows the current version, and material changes are announced on the main page. Continuing to use the site after an update means the current version applies to you.