Website: www.worldofcruising.co.uk
Last updated: 22 July 2026
Published by Real Response Media.
1. Who we are
This privacy policy explains how World of Cruising (published by Real Response Media, "we", "us", "our") collects, uses, shares and protects your personal data when you visit www.worldofcruising.co.uk or interact with us by email, phone, post or through our social media channels.
Data controller: Real Response Media
Registered address: 445 Caledonian Road, London N7 9BG
Contact / data protection queries: info@realresponsemedia.com
ICO registration number: C1989576
2. Personal data we collect
We collect personal data in the following ways:
Account registration and login details, including via Facebook Login or Google Login (name, email address, public profile information).
Newsletter sign-up details (email address).
Magazine subscription and shop order details (name, postal address, email address, telephone number, payment details - processed securely, not stored on our systems).
Cruise Finder / Cruise Matchmaker preferences and saved wishlists.
Competition entries and reader offer enquiries.
Customer reviews you submit.
Enquiries made via our contact forms, telephone or email.
Technical data such as IP address, browser type and device information, collected automatically via cookies (see Section 4).
3. How and why we use your data
We use your personal data for the following purposes, and rely on the lawful basis stated for each:
Fulfilling a magazine subscription or shop order - performance of a contract.
Operating your account, Cruise Matchmaker and wishlists - performance of a contract / legitimate interests in providing the service you've asked for.
Sending our newsletter and marketing communications - consent, which you can withdraw at any time.
Running competitions and reader offers - performance of a contract (entering you into the competition) and legitimate interests in administering it fairly.
Website analytics (GA4) and on-site personalisation - consent (via the Cookiebot banner) for non-essential cookies.
Advertising (Facebook pixel, OpenX) - consent (via the Cookiebot banner).
Preventing fraud and keeping our site secure - legitimate interests.
4. Cookies and similar technologies
Our website uses cookies and similar tracking technologies to operate correctly, understand how the site is used, and support advertising and marketing. We use Cookiebot to manage cookie consent: under UK PECR, non-essential cookies (Preferences, Statistics and Marketing categories) are only set once you've given consent via the Cookiebot banner shown on your first visit, and strictly necessary cookies are set automatically as they're needed to run the site. You can change your consent choices at any time using the "Manage cookie preferences"/Cookiebot link in the site footer, or by clearing your cookies.
Strictly necessary / website cookies
Cookie name | Purpose | Provider / service | Type | Expiry |
CRAFT_CSRF_TOKEN | Protects the website against cross-site request forgery attacks. | Website (Craft CMS) | HTTP cookie | Session |
CraftSessionId | Maintains your session as you browse the site (e.g. login state, form progress). | Website (Craft CMS) | HTTP cookie | Session |
CookieConsent | Stores your cookie consent preferences so we don't ask again on every visit. | Cookiebot | HTTP cookie | 1 year |
Analytics cookies
We use Google Analytics 4 (GA4) to understand how visitors use our site in aggregate. GA4 only sets two cookies:
Cookie name | Purpose | Provider / service | Type | Expiry |
_ga | Distinguishes unique users for analytics reporting. | Google Analytics 4 | HTTP cookie | 2 years (capped by the browser, e.g. ~400 days in Chrome, 7 days in Safari) |
_ga_<container-id> | Persists GA4 session state. | Google Analytics 4 | HTTP cookie | 2 years (browser-capped as above) |
Note: earlier policies referenced a "_gid" cookie and 1-minute "_gat" cookie - these belonged to the legacy Universal Analytics product, which Google retired on 1 July 2024, and should be removed from the new policy since the site now runs GA4 only.
Advertising cookies
Cookie name | Purpose | Provider / service | Type | Expiry |
_fbp | Facebook/Meta tracking pixel used to identify visitors for personalised advertising. | Meta (Facebook) | HTTP cookie | 3 months |
OAID | Used to manage ads placed on the site and monitor clicks. | OpenX Ad Server | Server cookie | 12 months |
SessionId | Maintains your session with our advertising platform as you browse. | OpenX / Website | Server cookie | Session |
Insider One (marketing automation) cookies and browser storage
We use Insider One's customer engagement platform to send marketing emails, personalise on-site content and (where enabled) web push, SMS or WhatsApp messages. This replaces the Force24 platform referenced in our previous privacy policy. In this relationship, Insider One acts as our data processor and we (Real Response Media) remain the data controller: Insider One does not itself collect your consent, but provides us with the tools to do so, and we are responsible for the Cookiebot banner and consent choices described in this policy.
Via its JavaScript, cookie and browser-storage-based tracking technology, Insider One may collect: clickstream data (the pages and links you interact with), the duration of your visits, your IP address, and transaction/engagement information, which is used to personalise content and messaging. Insider One stores UK/EU end-user data in its EU data centre (AWS, Dublin, Ireland) and holds SOC 2 Type II, ISO/IEC 27001:2022 and ePrivacy Seal (GDPR) certifications. Insider One's data processing agreement and standard contractual clauses cover any transfer of data outside the UK/EU.
Insider One publishes a full, public inventory of the cookies, local storage and session storage items its tag can set — including exact names, sample values and expiry durations — at academy.insiderone.com/docs/insider-cookies-local-storage-session-storage. Most of Insider One's tracking uses browser local storage and session storage rather than traditional cookies, but under PECR these "similar technologies" are treated the same way as cookies for consent purposes, and are covered by the Cookiebot banner. Naming follows several different patterns depending on the product/feature involved — including an ins-... convention, spUID, sp-camp-{id}, and other feature-specific names — there is no single consistent prefix.
The table below is a representative selection of the items published on Insider One's own reference page (linked above), covering the core identity, consent-state and personalisation storage that applies across our sites. Insider One publishes a fuller list of around 90 local/session storage entries in total, covering optional features (Web Push, SMS, WhatsApp, Architect journeys, product recommendations, etc.) — see the link above for the complete inventory.
Cookie name | Purpose | Provider / service | Type | Expiry |
spUID | Holds a unique identifier for each user who visits the website, used to recognise you across visits. | Insider One (local storage) | Local storage | 1 year |
ins-lead-spuid | Temporary identifier ("insider_id") for a newly identified contact, e.g. just after a newsletter or form sign-up. | Insider One (local storage) | Local storage | 10 seconds |
sp-camp-{id} | Holds the ID of on-site campaigns/personalisation messages the user encounters. | Insider One (local storage) | Local storage | 14 days (default) |
insCustomAttributes | Holds custom user attributes used for personalisation. | Insider One (local storage) | Local storage | 1 year |
insUserPermissionGranted | Holds the state of the user's email marketing permission/consent. | Insider One (local storage) | Local storage | 1 year |
first-permission-impression | Records whether the user has already seen the marketing opt-in prompt, so it isn't shown repeatedly. | Insider One (local storage) | Local storage | 1 year |
userLocation / userIP | Holds city/country and (encrypted) IP address information used for personalisation. | Insider One (local storage) | Local storage | 1 day |
ins-gaSSId | Tracks users in 30-minute sessions, mirroring how Google Analytics defines a session. | Insider One (session storage) | Session storage | 30 minutes (session) |
ins-test-cookie | Tests whether cookies are enabled in the user's browser. | Insider One | HTTP cookie | Session |
As with our previous platform, emails and any SMS/WhatsApp/push messages sent via Insider One may contain tracking pixels and unique link-tracking references so we can measure opens and clicks for statistical purposes.
5. How we share your data
We share personal data with the following categories of recipient, only to the extent needed for the purposes set out above:
Google (Google Analytics 4) - website analytics.
Meta (Facebook) - advertising pixel and Facebook Login authentication.
OpenX - advertising ad-serving.
Cookiebot (Usercentrics) - recording and managing your cookie consent choices.
Insider One - email marketing, on-site personalisation and (where enabled) web push.
Payment processors and card-security services - to process shop and subscription payments (no card details are stored on our own systems).
Fulfilment / mailing houses - to despatch magazine subscriptions and promotional copies.
Carefully chosen third-party partners - only with your express consent, for offers that may interest you.
We do not sell, rent or exchange your personal data with other organisations for their own marketing purposes. Where we do want to pass your details to a carefully selected third-party partner for their own marketing, we will only do so with your express consent, requested at the point of collection.
6. International transfers
Some of the organisations we share data with (including Google and Meta) are based outside the UK or transfer data outside the UK as part of their global operations. Insider One stores UK/EU customer data in its EU data centre (Dublin, Ireland), but as a global platform it may also transfer data outside the UK/EU in the course of providing its services. Where any of these transfers happen, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (as recognised for UK transfers), or a UK adequacy regulation.
7. How long we keep your data
We retain personal data for as long as needed to provide the products and services you've asked for. For non-transactional data (such as newsletter sign-ups or general contact details), we retain data for no longer than 7 years from collection, unless it is updated or refreshed within that period.
8. Your rights
Under UK GDPR, you have the right to:
Access the personal data we hold about you
Have inaccurate data corrected
Have your data deleted in certain circumstances
Restrict or object to our processing of your data
Receive your data in a portable format
Withdraw consent at any time, where we rely on consent
Lodge a complaint with the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data
To exercise any of these rights, contact us at info@realresponsemedia.com.
Facebook Login and social profile data
If you choose to log in using Facebook or Google, we receive certain profile information from that provider (such as your name, email address and public profile details) to create and authenticate your account and personalise your experience. We don't share this information with third parties except as described in this policy. You can request deletion of data associated with your Facebook Login by emailing info@realresponsemedia.com or visiting www.worldofcruising.co.uk/data-deletion.
9. Children's privacy
World of Cruising is not directed at children, and we do not knowingly collect personal data from anyone under 16.
10. Changes to this policy
We may update this privacy policy from time to time, for example to reflect changes to the law or to the tools and platforms we use. The "last updated" date at the top of this page shows when it was last revised.
11. Contact us
If you have any questions about this policy or how we handle your data, contact us at info@realresponsemedia.com.
