Privacy policy

1. Who we are

Our Centuries, at ourcenturies.com, is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy “we”, “us” and “our” mean that company. We decide why and how the personal data described here is used, which makes us its “controller” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Item	Details
Company	FALLINGHIPPO LIMITED
Company number	17415391, registered in England and Wales
Registered office	71-75 Shelton Street, London, England, WC2H 9JQ
Privacy contact	privacy@fallinghippo.com
General contact	hello@fallinghippo.com
Data protection fee	Paid. Registration reference ZC264249 on the Information Commission’s register of fee payers

We haven’t appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. Privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you:

• visit ourcenturies.com or any page on it;
• email us, or write to us by post, for example to report a mistake or ask about using our work.

It doesn’t cover other websites that we link to, such as museums, archives and the research papers we cite. They are run by other people and have their own policies. Our other websites and apps have their own privacy policies as well.

3. A few terms we use

• Personal data means any information about you from which you can be identified, directly or indirectly. Your name, email address and IP address are all personal data.
• Controller means the organisation that decides why and how personal data is used. For this policy that’s us.
• Processor means a company that handles personal data on a controller’s behalf and only on its instructions, such as our web host.
• Processing means anything done with personal data, including collecting, storing, reading, sharing and deleting it.

4. What we collect and where it comes from

When you visit the site

You don’t have to sign up or give us anything to use Our Centuries. When your browser asks for a page or a file, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

This comes from your device. We don’t combine it with anything else to work out who you are. We don’t download, copy or keep these logs ourselves, and we don’t use them to follow what individual visitors do.

If your browser reports a network problem

Cloudflare asks some browsers to send it a short report when a page fails to load because of a network fault. The report contains the address of the page, your IP address, your browser type and what went wrong. It is sent by your browser, not by any script of ours, only when something has failed. It lets Cloudflare find and fix faults on its network. We can’t see these reports and we don’t use them.

When you email or write to us

We receive your email address, your name if your email shows it, the content of your message, any attachments, and the technical details that come with any email, such as the time it was sent. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don’t send us sensitive information, such as details about your health, unless we’ve asked for it.

What we don’t collect

There are no accounts, comments, forums, forms that send data to us, newsletters, surveys or competitions on this site. We don’t use analytics, advertising, social media buttons, embedded videos or fingerprinting. We don’t collect sensitive (“special category”) data or information about criminal convictions. We don’t buy personal data from anyone. Our fonts, maps, pictures and scripts are all served from ourcenturies.com, so loading a page doesn’t send your details to Google or any other company.

5. How we use it and our lawful basis

Data protection law only lets us use personal data where we have a lawful basis. The table lists every way we use the data in section 4, the basis we rely on and how long we keep it. Section 6 explains our legitimate interests.

What we do	Data used	Lawful basis	How long
Deliver web pages and files to your browser	Server log data	Legitimate interests: running a website that works	Handled by Cloudflare for as long as it needs for this purpose, then deleted (see section 11). We keep none.
Protect the site from attacks and abuse, and investigate faults	Server log data, network error reports	Legitimate interests: keeping the site and its visitors safe	As above
Read and reply to your emails and letters	Contact details, message content, attachments	Legitimate interests: answering people who contact us	Up to 24 months after our last exchange
Look into corrections, ideas and feedback you send	Contact details, what you tell us	Legitimate interests: keeping the site accurate and improving it	Up to 24 months after our last exchange. A correction we publish names no one unless you ask to be credited.
Keep accounting and tax records, if you ever pay us or we pay you	Names and details on invoices	Legal obligation (Companies Act 2006 and tax law)	6 years from the end of the financial year they relate to
Handle privacy requests and complaints	Your contact details, the request and our reply, and any identity check	Legal obligation	2 years after we close the request, or longer if a related claim is open
Establish, bring or defend legal claims	Any of the above that is relevant	Legitimate interests: protecting our legal rights	Until the claim, and any appeal, is finished
Comply with a court order or a lawful request from a regulator or the police	Only what is required	Legal obligation	As long as the law requires
Sell or reorganise the business (see section 9)	Records relevant to the sale	Legitimate interests: being able to sell or restructure the company	For the length of the process

You don’t have to give us any personal data to use this site. If you want a reply to a message, we need a way to contact you. We don’t use your data for any purpose that isn’t in this table. If we ever want to use it for a new purpose, we’ll check it’s compatible with the original one, or ask for your consent, and update this policy first.

The motion setting described in section 7 stays on your device, so it is covered by the Privacy and Electronic Communications Regulations 2003 rather than by a lawful basis under the UK GDPR.

6. Our legitimate interests

“Legitimate interests” is a lawful basis that lets an organisation use personal data for a genuine reason, as long as that use is necessary and isn’t outweighed by your interests, rights and freedoms. Where we rely on it, we have done this balancing exercise. In summary:

• Running and securing the site. Every website has to receive basic technical information to send pages to your browser. Using it to spot attacks protects you as well as us. The data is limited, short-lived and not used to identify or profile you. Protecting the security of networks and systems is one of the “recognised legitimate interests” listed in the Data (Use and Access) Act 2025.
• Answering messages. If you write to us, you expect a reply. We only use your message for that conversation and the record of it.
• Keeping the site accurate. History is easy to get wrong. If you tell us about a mistake, you expect us to look at it and perhaps to write back. We keep a note of what was changed and why, and list corrections publicly on the corrections page without naming you.
• Legal claims. Keeping relevant records for the time a claim could be made protects both sides.

You have the right to object to any use based on legitimate interests (see section 13). If you’d like a copy of our assessment for a particular use, email us.

7. Cookies and similar technologies

Cookies are small files a website saves on your device. Similar technologies include local storage, pixels and device fingerprinting. The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must ask for your consent before storing or reading anything on your device, unless it’s strictly necessary for a service you asked for or falls within another exception listed in the regulations. Since 5 February 2026 those exceptions include one for adapting how a website looks or works to your preferences, as long as you are told and can easily object.

Our Centuries sets no cookies. It keeps one small thing in your browser, and only if you use the Motion button at the bottom of every page: a note in local storage that says whether you want animation on or off. Nothing is stored until you press the button. It is described in full on the cookies and storage page.

The site also asks your browser whether you have turned on “reduce motion” in your device’s settings, so that it can keep still if you have. That answer stays in your browser.

If we ever decide to add anything else that stores or reads information on your device, we’ll update this section first and ask for your consent where the law requires it. That is also why there is no cookie banner.

8. Marketing

We don’t have a mailing list for this site and we don’t send marketing emails. If you email us, we won’t add you to a list. If we ever start a newsletter, we’ll only send it to people who have actively signed up, and every email will have a simple way to unsubscribe, as PECR requires.

9. Who we share it with

We don’t sell personal data, rent it or share it with advertisers. We share it only in the situations below.

Companies that process data for us

These companies act as our processors. They may only use personal data on our instructions and to provide their service to us, under written terms that meet the requirements of Article 28 of the UK GDPR.

Company	What they do for us	Contract and safeguards
Cloudflare, Inc. (United States)	Hosts and delivers the website, protects it from attacks and keeps the server logs	Cloudflare customer data processing agreement
Google (Google Workspace)	Runs our email, including the addresses on this page, and stores our working documents	Google Cloud data processing addendum

Professional advisers

We may share relevant information with our accountants, lawyers and insurers where they need it to advise us or provide their service. They are bound by professional duties of confidentiality and act as controllers in their own right.

The authorities

We’ll disclose personal data to the police, a court, a regulator or another public body if the law requires us to, or where it’s necessary to prevent or detect crime or to protect someone’s safety. We share only what is needed and check that each request is lawful.

If the business changes hands

If we sell or transfer all or part of our business, or merge with another company, personal data may pass to the buyer or new owner, and to their advisers during the process under confidentiality terms. The new owner would have to use it in line with this policy, and we’d tell you if what happens to your data changed.

Other websites

Many pages link to other websites, such as museums, archives, heritage bodies and research journals, to show where a fact comes from. If you follow a link, that site receives your IP address and the address of the page you came from, and its own policy applies from then on. We don’t pass them anything else.

10. Data sent outside the UK

Cloudflare runs a global network and is based in the United States, and Google can process data in the United States and other countries. This means personal data may be transferred outside the UK. UK law allows this only where the destination has been found to give adequate protection, or where a safeguard approved by UK law is in place.

• The UK has made “adequacy regulations” for the countries of the European Economic Area and some others, so data can flow there freely.
• For the United States, both companies take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies.
• Both companies’ data processing terms also include standard contractual clauses with the UK’s International Data Transfer Addendum, which apply where the Data Privacy Framework doesn’t.

If you’d like more detail on the safeguard that applies to a particular transfer, or a copy of the relevant terms, email us.

11. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, including any legal, accounting or reporting requirements. The table in section 5 gives the period for each use. When a period ends we delete the data, or anonymise it so it can no longer identify you.

Cloudflare doesn’t publish a fixed retention period for the server logs it keeps when serving a customer’s site. Its privacy policy says it keeps personal information for a period that is consistent with its business purposes and then deletes it. We don’t download, copy or keep these logs ourselves.

The motion setting stays in your browser until you clear it. We can’t delete it for you, because we never have it.

Emails deleted from our mailbox may remain in Google’s backups for a short time before they are permanently removed, in line with Google’s data processing terms.

12. How we keep it safe

We use technical and organisational measures that are appropriate to the risk, including:

• serving the site over HTTPS, and redirecting any request made over plain HTTP, so pages can’t be read or changed on their way to you;
• collecting nothing from you that we don’t need, which is the surest way to keep it safe;
• loading no scripts, fonts or images from anyone else’s servers, which removes a common route for data leaks;
• a strict content security policy that tells your browser to refuse anything from elsewhere;
• limiting access to our mailboxes and accounts to the people who need it, with passwords kept in a password manager.

No system is completely secure. If a breach of security led to personal data being lost, changed or disclosed, we would assess it straight away. Where the law requires, we’d report it to the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach was likely to put you at high risk, we’d also tell you directly and explain what you can do to protect yourself.

If you think you’ve found a security problem with this site, please tell us at security@fallinghippo.com.

13. Your rights

The UK GDPR gives you the following rights over your personal data. Some only apply in certain situations, and we’ll explain if one doesn’t apply to your request.

Your right	What it means
To be informed	To be told clearly how your data is used. This policy is how we do that.
Of access	To get confirmation that we hold your data, a copy of it, and the other information in this policy. This is often called a subject access request.
To rectification	To have inaccurate data corrected and incomplete data completed.
To erasure	To have your data deleted, for example where we no longer need it, where you’ve objected and we have no overriding reason to continue, or where it was used unlawfully. It doesn’t apply where we must keep data by law or to deal with a legal claim.
To restrict processing	To have us store your data but not otherwise use it, for example while we check whether it’s accurate or consider an objection.
To data portability	To receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we rely on consent or a contract and the processing is automated.
To object	To object at any time to processing based on legitimate interests, on grounds relating to your situation. We must stop unless we can show compelling legitimate grounds, or we need the data for a legal claim.
About automated decisions	Not to be subject to certain significant decisions made by computer alone. We don’t make any (see section 15).
To withdraw consent	Where we rely on consent, to withdraw it at any time. We don’t currently rely on consent on this site.
To complain	To complain to us, and to the Information Commission (see section 18).

14. How to use your rights

Email privacy@fallinghippo.com with “Privacy request” in the subject line, or write to us at our registered office. Tell us which right you want to use and give us enough detail to find the data, such as the email address you wrote from. You don’t have to use a particular form or particular words, and you can ask someone else, such as a solicitor or relative, to make the request for you with your written permission.

• Checking it’s you. We may ask for information to confirm your identity, so we don’t give your data to someone else. We’ll only ask for what we need.
• How long it takes. We’ll respond without undue delay and within one month of receiving your request. If we need to confirm your identity or ask you to clarify the request, the month starts when we get your reply. If a request is complex, or you’ve made several, we can extend this by up to two further months. We’d tell you within the first month and explain why.
• Cost. It’s free. If a request is clearly unfounded or excessive, we can charge a reasonable fee based on our costs or refuse it. We’d explain why and tell you about your right to complain.
• Server logs. If you ask about data in Cloudflare’s logs, we’ll tell you what we can, but we don’t hold those logs ourselves and can’t search them by visitor. Please include the date, the page and your IP address if you want us to ask Cloudflare.

15. Automated decisions

We don’t make any decisions about you by automated means alone, and we don’t use your data to build a profile of you.

16. Children

Our Centuries is an educational site, and many of the people who use it will be children, including pupils in school. It is built to need nothing from them. There are no accounts, no ads, no tracking and no way to talk to other visitors. We have kept the ICO’s Age-Appropriate Design Code (the “Children’s code”) in mind in building it: we collect as little as we can, we don’t profile anyone and we don’t use nudges to keep people on the site.

If you are under 13, please ask a parent or carer before you email us. If you’re a parent or carer and believe a child has sent us personal data, email us and we’ll delete it. We never knowingly ask children for personal data.

17. Other websites

This site links to other websites, including museums, archives and research journals, and to our own other sites. Those sites have their own privacy policies and we’re not responsible for how they use your data.

18. Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us first so we can try to put it right. The quickest way is to email privacy@fallinghippo.com with “Complaint” in the subject. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay and keep you updated on our progress;
• tell you the outcome and what we’ve done about it.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026 and still uses the ICO name and website. Its website is ico.org.uk/make-a-complaint and its helpline is 0303 123 1113. It will usually expect you to have raised the matter with us first. You also have the right to go to court if you believe your rights have been breached.

19. Changes to this policy

We review this policy at least once a year and whenever we change how the site handles personal data. If we make a change, we’ll update this page before the change takes effect and change the date at the top. Earlier versions are available on request.

• 11 November 2026. First version, written before the site’s launch.

20. Contact us

For anything about this policy or your personal data, email privacy@fallinghippo.com. For anything else, email hello@fallinghippo.com. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, which is used for official post, so email is quicker.