Privacy

Last updated: 7 May 2026

This policy explains what personal information Merlin Archive collects, why we collect it, how long we keep it, and what rights you have over it. We've tried to keep it short and plain. If anything is unclear, email info@merlinarchive.uk.

Who we are

Merlin Archive is a public-interest archive of UK military vehicle records, operated by Robert Wilson, a sole trader trading as Merlin Archive, based in the United Kingdom.

For any privacy or data-protection question, contact us at info@merlinarchive.uk.

What we collect

We collect different categories of information depending on how you use the site.

• Account information — when you register, your name, email address, and a hashed copy of your password (we never store passwords in plain text).
• Garage and contribution activity — vehicles you save to your garage, ERMs you submit, images you upload, and any service-history entries you contribute. This activity is associated with your account.
• Donation records — when you donate via PayPal, the donation amount, date, and the PayPal transaction reference. PayPal handles the payment itself; we never see your card details.
• Contact and research requests — when you write to us via the contact form or submit a research request, we keep a record of the message, your name, your email, and any vehicle reference (ERM) you provide.
• Search activity — anonymised search terms used on the site, retained for up to 365 days to help us improve the search experience. This data is not associated with your account.
• Analytics — if you grant consent, we collect Google Analytics data about your visit (pages viewed, session duration, approximate region). If you reject the cookie banner, no analytics are collected.
• Server logs — our hosting provider keeps standard web-server logs, which include your IP address. These are retained for operational and security purposes.

Why we collect it (lawful bases)

Under UK GDPR every category of personal data we process must have a lawful basis. Here's how we map each one:

• Account information, garage, contributions — legitimate interest in operating the archive, plus contract (registering creates an agreement to use the site).
• Donation records — legitimate interest, plus legal obligation (we are required to keep tax records for 7 years).
• Contact and research requests — legitimate interest in responding to you.
• Analytics cookies — your consent. Google Analytics cookies are only set if you click Accept on the cookie banner.
• Server logs — legitimate interest in keeping the site secure and operational.

You can withdraw consent for analytics cookies at any time via the cookie settings page.

How long we keep it

• Active user accounts — indefinite while the account is in use.
• Deleted accounts — purged within 30 days of a delete request.
• Donation records — 7 years (HMRC tax-record requirement).
• Contact and research requests — 2 years after the request is resolved.
• Activity log — 12 months.
• Search log — 365 days, anonymised.
• Soft-gate cookie — 24 hours rolling, used to count guest views against the daily limit.
• Server logs — retained per our hosting provider's standard logging policy.

If you want your account and associated data deleted, email us at info@merlinarchive.uk and we'll action your request within 30 days. We may retain donation records beyond that point because we have to (the 7-year HMRC obligation), but everything else will go.

Who we share it with

We use a small number of third-party services to run the archive. Each is listed below with the role they play.

• Laravel Cloud — web hosting and application infrastructure.
• Cloudflare — content delivery, image storage (R2), and bot protection (Turnstile, on the contact and research-request forms). Cloudflare may process traffic data outside the UK.
• 20i — outbound and inbound email handling for the merlinarchive.uk domain.
• PayPal — donation processing. PayPal is the data controller for the payment itself.
• Google Analytics — site usage analytics. Only active if you grant consent. Google may process this data outside the UK.

We do not sell your data. We do not share it with any third party for marketing purposes. We do not share it with anyone other than the providers listed above, except where required by law.

International transfers

Some of the providers above may process data outside the UK. Where this happens, we rely on the providers' standard contractual clauses or equivalent safeguards as required by UK GDPR.

Your rights

Under UK GDPR you have the right to:

• access the data we hold about you
• correct inaccurate data
• ask us to delete your data, subject to lawful obligations such as the HMRC 7-year retention
• object to or restrict processing
• withdraw consent for analytics cookies at any time
• complain to the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email info@merlinarchive.uk.

Cookies

We use a small number of cookies. The full list and their purposes are explained on the cookies page. In summary:

• Strictly necessary cookies — set automatically. These keep you signed in, remember your dark-mode preference, and track guest view counts for the daily limit. They cannot be turned off without breaking the site.
• Analytics cookies — only set if you accept on the cookie banner. Used by Google Analytics. You can change your choice at any time via cookie settings.

Children

The archive is not designed for children. Account registration requires you to be at least 16 years old. We do not knowingly collect data from anyone under 16; if you believe we have, contact us and we'll delete the account.

Changes to this policy

We'll update this page when our processing changes. The "last updated" date at the top reflects the most recent revision. Material changes will be flagged via a notice on the homepage for at least 30 days.

How to complain

If you have a concern about how we handle your data, please email us first at info@merlinarchive.uk so we have a chance to put it right.

If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office at ico.org.uk or by writing to:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF