Sharma on Governance
Last updated: 26 July 2026 · Version 1.0
In short
I am Suneet Sharma. I run Sharma on Governance on my own, as an individual, and I am the data controller for this site.
I collect as little data as possible. If you only browse the site, limited technical and usage information is processed, such as the pages viewed, referring site, approximate location, IP address and browser or device type. I use this to operate, secure and improve the site. The statistics available to me are generally aggregated, and I do not use them to identify individual visitors. Apart from limited technical information generated when you browse the site, I hold information about you only when you choose to provide it—for example, by commenting, subscribing or contacting me.
I do not sell your data. I do not use your information to track you across other websites or to serve advertising.
You can contact me at suneet_sharma@outlook.com or via the contact us form on the website about anything in this policy, including to object to the analytics described below.
The rest of this page sets out the detail required by the UK GDPR.
1. Who I am and how to contact me
Sharma on Governance is a personal website written and published by Suneet Sharma. It is not a company, partnership or registered charity.
I am the data controller for the personal data described in this policy.
Email: suneet_sharma@outlook.com Contact form: https://sharmaongovernance.co.uk/contact-us/
A postal address is available on request.
I have not appointed a Data Protection Officer. I am not required to.
2. What I collect, why, and my lawful basis
2.1 Comments
What: Your name, your email address, your website address if you give one, the content of your comment, your IP address and your browser’s user agent string. WordPress records the last two automatically.
Why: To publish and moderate discussion on the site, and to identify spam.
Lawful basis: Legitimate interests — UK GDPR Article 6(1)(f). My interest is in hosting a public discussion alongside what I publish. This is limited to what you have chosen to submit for publication, so I consider the impact on your privacy to be low. You can ask me to remove a comment at any time and I will.
Note on spam filtering: Comments are checked by Akismet, a service operated by Aut O’Mattic A8C Ireland Ltd. Your comment content, name, email address, IP address and user agent are sent to Automattic for that check. See section 4.
2.2 Email subscriptions
What: Your email address. If you subscribe through a WordPress.com account, your account details as well.
Why: To send you an email when I publish something new.
Lawful basis: Consent — UK GDPR Article 6(1)(a). Sending the emails also relies on your consent under Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR).
Withdrawing consent: Every email includes an unsubscribe link. You can also contact me using the contact page. Withdrawal takes effect immediately and does not affect anything sent before it.
Processor: Subscriptions are handled by Aut O’Mattic A8C Ireland Ltd. See section 4.
2.3 Enquiries through the contact form or by email
What: Your name, your email address, and whatever you choose to put in your message.
Why: To read and reply to you.
Lawful basis: Legitimate interests — Article 6(1)(f). My interest is in responding to someone who has deliberately got in touch. I have no way to reply without holding your details for as long as the exchange lasts.
Please do not send me confidential information about a specific charity, board or individual through this form. If you need to discuss something sensitive, say so and we can arrange a more appropriate route.
2.4 Likes
What: Your WordPress.com username and associated account details, if you like a post while signed in to WordPress.com.
Why: To display the like and to see which posts readers find useful.
Lawful basis: Legitimate interests — Article 6(1)(f).
2.5 Site statistics
What: The pages visited, referring website, approximate location derived from IP address, and device and browser type. I do not use this information to identify you, and the reports available to me are generally aggregated.
Why: To understand which resources people actually use, so I can decide what to write and what to improve.
Lawful basis: Legitimate interests — Article 6(1)(f). My interest is in improving a free public resource. The data is aggregated and not used to make decisions about individuals.
I use two tools:
- Burst Statistics, which runs on this website. It is configured not to set cookies. Instead it derives an anonymous identifier from your browser and device characteristics so that visits can be counted. All statistics are held in this website’s own database and are not sent to Burst Statistics or to anyone else.
- Jetpack Stats to be phased out by 31 July 2026, operated by Aut O’Mattic A8C Ireland Ltd. This does involve sending data to Automattic. See section 4.
Burst honours the “Do Not Track” setting if your browser sends one.
How to object: See section 3.
2.6 Children’s data
This site is not directed at children and I do not knowingly collect children’s data.
3. Cookies and similar technologies
PECR governs anything that stores information on your device or reads information from it — not only cookies, but also fingerprinting techniques, local storage and similar methods. This section covers all of it.
I do not use advertising, marketing or cross-site tracking technologies of any kind.
What is used, and on what basis
Strictly necessary. WordPress sets cookies to keep you logged in if you have an account, to remember details you enter in the comment form, and for security. These are exempt from consent because they are needed to provide what you have asked for.
Site statistics. Burst Statistics reads browser and device characteristics to generate an anonymous visitor identifier. This relies on the statistical purposes exception in Schedule A1 to PECR: the sole purpose is collecting statistics about how this site is used in order to improve it, and the information is not shared with anyone else.
I currently also use Jetpack Stats, provided by Aut O’Mattic A8C Ireland Ltd, to understand visits to the site. Jetpack processes technical and usage information, which may include your IP address, the page visited, referring website and browser or device information. I rely on the statistical purposes exception for this, on the basis that Automattic processes the information on my behalf to give me statistics about my own site. Burst Statistics, shares nothing with anyone, and I am therefore, phasing Jetpack Stats out — I intend to stop using it no later than 31 July 2026. You can object at any time using the preferences link in the footer or by contacting me.
Accessibility preferences. If you use the accessibility controls to change font size or colour scheme, that preference is stored on your device so the site remembers it. This relies on the appearance exception in Schedule A1 to PECR.
How to object
You can object to the statistics and appearance technologies described above at any time by:
- Selecting on the cookies banner upon your entry to the site
- Turning on “Do Not Track” in your browser, which the Burst Statistics tools will respect.
- Emailing me at suneet_sharma@outlook.com or contact us and I will exclude you.
You can also block or delete storage through your browser settings. Blocking everything may stop parts of the site working, including the accessibility controls.
Images
Images on this site are delivered through Automattic’s content delivery network. When your browser loads an image, the request goes to Automattic’s servers rather than mine, which means your IP address is disclosed to them. See section 4.
Cookie list as at 26 July 26
- cmplz_ (seven cookies) — record your privacy choices so the site can honour them. Strictly necessary.
- eucookielaw — records that you have dismissed the WordPress.com privacy notice. Strictly necessary.
- real-accessability — stores your font size and colour choices, set only if you use the accessibility controls and deleted when you close your browser. Appearance exception.
- tk_ai — an identifier set by Automattic in connection with WordPress.com and Jetpack services.
4. Who else receives your data
I do not sell, rent or trade personal data, and I do not share it for anyone else’s marketing.
Aut O’Mattic A8C Ireland Ltd. This website is built on WordPress and uses Automattic’s services which may provide:
- hosting and site infrastructure
- email subscriptions
- Jetpack Stats
- Akismet spam filtering for comment
- image delivery through their content delivery network
Automattic processes personal data in providing WordPress, Jetpack, Akismet, subscription and content-delivery services. It acts as my processor for some activities and may determine aspects of other processing under its own privacy notice.
Email hosting and correspondence: I use Microsoft Outlook to receive and respond to enquiries. Microsoft processes email addresses, message contents, attachments and associated technical information in providing that service.
Google Fonts: Is used across tools.
I may also disclose personal data where I am legally required to do so.
5. Transfers outside the UK
Aut O’Mattic A8C Ireland Ltd is based in Ireland, which is covered by UK adequacy regulations, so no additional safeguard is needed for the data I transfer to them. Automattic carries out some processing in the United States through its affiliate companies. Where that happens, Automattic applies the safeguards set out in its Data Processing Addendum, available at their website. Microsoft may also process email correspondence outside the UK under its own safeguards. You can contact me for further information.
6. How long I keep things
Comments: Published comments stay on the site for as long as the site exists, because they form part of the discussion under each post. Ask me and I will delete yours.
Subscriber email addresses: Until you unsubscribe.
Enquiries: 24 months from our last exchange, unless there is a continuing reason to keep them.
Statistics: For 36 months, via Burst Statistics, and Automattic’s Jetpack Stats.
7. Your rights
You have the following rights over your personal data. All of them are free to exercise, and I will respond within one month.
- Access — ask for a copy of the personal data I hold about you.
- Rectification — ask me to correct anything inaccurate or incomplete.
- Erasure — ask me to delete your personal data. This applies in certain circumstances, including where you withdraw consent or where I have no overriding reason to keep it.
- Restriction — ask me to stop using your data while a dispute about it is resolved.
- Objection — you may object at any time to processing based on my legitimate interests, including eligible site-statistics processing. I will consider your objection and stop the processing unless there is a lawful reason to continue.
- Portability — receive the data you have given me in a machine-readable format, or have it sent elsewhere. This applies only where processing is based on your consent and carried out automatically, so in practice it covers your subscription.
- Withdraw consent — where I rely on consent, you can withdraw it at any time.
To exercise any of these, email me at suneet_sharma@outlook.com.
I do not carry out automated decision-making or profiling.
8. Interactive tools
Some resources on this site — including the 10Ps board self-assessment — let you enter information and generate a summary.
These tools run entirely in your browser. Nothing you enter is transmitted to this website, stored, or seen by me. Closing the page discards it. If you want to keep your results, use the print or save option before you leave.
Because the tool holds nothing, I cannot recover a session for you if you close it.
9. Changes to this policy
I will update this page when the site changes, and I will change the date at the top. Significant changes will be noted in a post.
10. Complaints
If you are unhappy with how I have handled your personal data, please tell me first and I will try to put it right.
I will acknowledge a data-protection complaint within 30 days and respond without undue delay. Please provide enough information for me to understand and investigate your concern.
You can also complain to the Information Commissioner’s Office, which regulates data protection in the UK.
Website: https://ico.org.uk/make-a-complaint/ Helpline: 0303 123 1113
This policy covers privacy and data protection only. Content on this site is for information and commentary and does not constitute legal advice.
