PRIVACY POLICY
PRIVACY POLICY OF "MORNING CHRONICLE"
Controller and privacy contact
SCANDIC TRUST GROUP LLC is responsible for the processing of personal data described in this Privacy Policy where it determines the purposes and means of that processing. References to "we", "us" and "our" mean SCANDIC TRUST GROUP LLC in its capacity as the publisher and service provider of "MORNING CHRONICLE".
SCANDIC TRUST GROUP LLC
IQ Business Centre
Bolsunovska Street 13–15
01014 Kyiv / Ukraine
Email: [email protected]
Legal form: limited liability company incorporated under Ukrainian law, LLC.
Registration number: 1010351020000018952.
The address above is our operational and correspondence address. Privacy enquiries, complaints and requests to exercise your rights may be sent to this address or to the email address above. The registration number identifies the Ukrainian company and is not a United Kingdom company registration number.
Registered office and company address
SCANDIC TRUST GROUP LLC
Oksamytova Street 1-b, Office 30
Sofiivska Borshchahivka
Kyiv Region - 08147 / Ukraine
Technical operation and administration
SCANDIC ASSETS FZCO
Dubai Silicon Oasis DDP
Building A1/A2
Dubai - 342001 / United Arab Emirates
Telephone: +971 54 221 5217.
SCANDIC ASSETS FZCO provides technical services within the scope of its appointment. Where it processes personal data on behalf of SCANDIC TRUST GROUP LLC and under its instructions, that processing must be governed by the arrangements required by Article 28 of the United Kingdom General Data Protection Regulation. Access must be limited to the information and functions necessary for the assigned work. The status of a controller, joint controller or processor depends on the actual activities and decisions of each organisation. Technical involvement or membership of the same corporate group does not, by itself, determine that status.
United Kingdom representative under Article 27 of the UK GDPR
SCANDIC TRUST GROUP LLC
Oksamytova Street 1-b, Office 30
Sofiivska Borshchahivka
Kyiv Region - 08147 / Ukraine
Commercial cooperation
LEGIER Beteiligungs mbH
Kurfürstendamm 14
10719 Berlin
Federal Republic of Germany
Commercial register: HRB 57837
Register court: Amtsgericht Charlottenburg, Berlin
VAT identification number: DE413445833
Telephone: +49 30 99211 3469
Fax: +49 30 99211 3225
Email: [email protected]
Where LEGIER Beteiligungs mbH is involved in an advertising enquiry or commercial arrangement, personal data may be disclosed to it only for a specified lawful purpose and to the extent necessary for its role. Commercial cooperation does not give that company unrestricted access to reader, subscriber or editorial information. Where it determines its own purposes and means of processing, its responsibilities as a separate controller and the relevant privacy information must be identified in connection with the particular service.
Introduction and scope
This Privacy Policy explains how personal data is handled in connection with the websites, applications, editorial activities and other services of "MORNING CHRONICLE". It covers the purposes of processing, applicable legal grounds, recipients, international transfers, retention and your rights. Provisions concerning accounts, subscriptions, orders, newsletters, comments, events or other additional functions apply where those functions are actually provided. References to external technologies describe the processing associated with their use and do not mean that every technology mentioned is active on every page. Information supplied when a particular service collects your data supplements this Policy and must accurately identify the processing concerned. Your statutory rights do not depend on accepting this Policy, and reading or accepting it does not constitute consent to advertising, tracking or other optional processing.
Applicable United Kingdom law
The principal framework is the United Kingdom General Data Protection Regulation, referred to as the "UK GDPR", together with the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, referred to as "PECR", as amended, including by the provisions of the Data (Use and Access) Act 2025 that are in force. The UK GDPR may apply to an organisation established outside the United Kingdom where its processing relates to offering goods or services to people in the United Kingdom or monitoring their behaviour there, within Article 3. The overseas addresses of the companies identified above do not remove obligations arising under that provision. The European Union General Data Protection Regulation is a separate legal regime and applies additionally where its own territorial requirements are met. The rules concerning privacy, confidentiality and freedom of expression also remain relevant, including the Human Rights Act 1998 and Articles 8 and 10 of the European Convention on Human Rights.
A) General information on personal data processing
Personal data is information relating to an identified or identifiable living individual. Depending on the relevant activity, it may include names, contact details, account identifiers, correspondence, transaction records, contributions, photographs, recordings, IP addresses, device information and information about the use of our services. Pseudonymised information remains personal data where an individual can be identified using additional information. Aggregation, removal of a name or replacement of an identifier does not automatically make information anonymous. We limit processing to what is necessary for a specified purpose and apply the principles of fairness, transparency, accuracy, data minimisation, storage limitation, security and accountability. Data protection must be considered when services are designed and in their default settings.
Purposes and lawful bases
The lawful basis depends on the particular purpose and circumstances. The principal grounds relevant to our services are:
- Contract and requested preliminary steps: Article 6(1)(b) of the UK GDPR, where processing is objectively necessary to provide a service you have agreed to receive or to take steps at your request before entering into a contract.
- Legal obligations: Article 6(1)(c), read with Article 6(3), where processing is necessary to comply with an applicable obligation laid down by United Kingdom law, including relevant record-keeping requirements.
- Legitimate interests: Article 6(1)(f), where processing is necessary for a legitimate purpose, such as protecting our services, responding to ordinary correspondence, preventing abuse or establishing, exercising or defending legal claims, and your interests or fundamental rights and freedoms do not override that purpose.
- Consent: Article 6(1)(a), where you freely agree to a specific, clearly explained use of your data, including optional processing for which consent is required. Consent must be informed, unambiguous and capable of withdrawal.
A contractual clause does not make unrelated advertising or tracking necessary for a contract. Where legitimate interests are relied upon, the relevant interest, necessity and impact on individuals must be assessed. Withdrawal of consent or a valid objection must not be circumvented by changing the stated legal basis merely to continue the same processing.
Recognised legitimate interests and exceptional grounds
Article 6(1)(ea) of the UK GDPR provides a separate basis for processing necessary for a recognised legitimate interest meeting a condition in Annex 1. These conditions concern specified circumstances such as crime prevention, safeguarding vulnerable individuals and certain emergencies or disclosures supporting public functions. This basis is not a general exemption for commercial activities and does not remove transparency, necessity, security or objection rights. If it is relied upon, the applicable condition must be identified. Article 6(1)(d) may apply where processing is necessary to protect someone’s vital interests. Publishing news does not, by itself, establish that the publisher has a statutory public task under Article 6(1)(e).
Sources of personal data and information duties
We may obtain personal data directly from you, through the technical operation of a service, from contributors or authorised representatives, or from sources relevant to legitimate editorial work, including interviews, public records and published material. For non-editorial activities, information obtained from another organisation must have an identified lawful source and purpose. Where Article 14 applies, we provide the required information about the data, its source and processing within the applicable period, normally no later than one month after obtaining it, and earlier where required by the first communication with you or first disclosure to another recipient. Any statutory exception must be assessed individually. Public availability does not make personal data unrestricted information that may be collected, combined or republished for any purpose.
Editorial and journalistic processing
Personal data may be processed when researching, verifying, preparing, publishing, correcting and retaining journalistic material. The relevant framework includes Article 85 of the UK GDPR and Schedule 2, Part 5, paragraph 26 of the Data Protection Act 2018. The journalism exemption applies only where its conditions are satisfied: processing must be carried out with a view to publication of journalistic material, the controller must reasonably believe publication would be in the public interest, and it must reasonably believe that compliance with the particular provision concerned would be incompatible with journalism. The special importance of freedom of expression and information must be considered, together with relevant statutory considerations and editorial standards. The exemption is limited to the provisions and extent permitted by law. It does not exempt every activity of a newspaper from data protection requirements and does not automatically extend to subscriptions, accounts, advertising, audience tracking or commercial administration.
Privacy, confidential sources and editorial archives
Editorial decisions must take account of the nature of the information, its sensitivity, accuracy, public interest, the circumstances in which it was obtained and the likely consequences of publication. Particular care is required with information about children, health, sexual life, criminal allegations and people in vulnerable circumstances. Confidential sources and unpublished material require appropriate protection, having regard to Article 10 of the European Convention on Human Rights, section 10 of the Contempt of Court Act 1981 and other applicable safeguards. Source confidentiality is not an unrestricted exemption from every legal obligation. Retaining an article in a journalistic archive requires a continuing assessment of the relevant interests; neither automatic deletion of accurate historical reporting nor indefinite retention of every item of personal data follows merely from describing information as archival.
External platforms and distribution services
Where our content is made available through social networks, video or audio platforms, applications, connected televisions or voice assistants, the platform operator may process personal data for its own purposes. Such services may include X, Facebook, Instagram, YouTube, Telegram, TikTok, Apple services, Amazon services, Google services, Roku, Huawei, Spotify or other distribution platforms where actually used. A normal link, an embedded player and an externally loaded image can involve different disclosures: an embedded resource may contact its provider when the page loads, before you interact with it. A platform account or acceptance of that platform’s terms does not constitute general consent to disclosures from our website. Our responsibility for processing that we determine or initiate remains subject to applicable law.
Technical information and voice assistants
When content is requested from our servers, technical records may be generated. Depending on the service and connection, these may contain:
- The requested page or file, together with the date and time of access.
- The amount of data transferred, response status and technical error information.
- The IP address and information about the browser, operating system or device.
- Referring-page information, where transmitted by the browser or platform.
- Network or connection information available as part of the request.
Technical records are used for delivery, troubleshooting and security within the purposes described in section E. Their collection does not authorise unrelated advertising profiles. Providers of voice assistants may process commands, recordings, transcripts or interaction records according to their service and settings. Use of a voice assistant does not necessarily mean that "MORNING CHRONICLE" receives the original recording or complete conversation.
Special category data and criminal offence information
Information revealing matters such as health, racial or ethnic origin, political opinions, religious beliefs, trade union membership or sexual orientation, and genetic or qualifying biometric data, receives additional protection under Article 9 of the UK GDPR. Outside a properly applicable exemption, processing requires both a lawful basis under Article 6 and an applicable Article 9 condition. Criminal conviction and offence data is subject to Article 10 and the relevant provisions of the Data Protection Act 2018. Where Schedule 1 requires an additional condition, safeguards or an appropriate policy document, those requirements must be met. Ordinary photographs and voice recordings are not automatically special category biometric data; their processing for the purpose of uniquely identifying a person can bring the biometric rules into operation. The journalistic provisions described above require their own assessment and do not provide a blanket permission for sensitive commercial profiling.
B) Contacting us
When you contact us by email, telephone or an available contact form, we process the information needed to understand and respond to your enquiry, including your contact details and the content of your message. Article 6(1)(b) applies where the correspondence is necessary for a contract with you or requested preliminary steps. Ordinary enquiries may be handled under Article 6(1)(f), on the basis of our legitimate interest in responding to correspondence, while statutory requests and complaints may involve Article 6(1)(c). Editorial submissions are also assessed under the journalistic provisions where applicable. Please provide only information relevant to the matter. Without sufficient information, we may be unable to investigate or reply. Contacting us does not subscribe you to advertising. Routine correspondence is retained while the matter is being handled and thereafter under the periods and exceptions in section H.
C) Reservations, orders, subscriptions and user accounts
Where these services are offered, we process the identification, contact, account, contractual, order and payment information necessary to provide them. Account processing may include credentials, preferences, subscription status and records of account administration. Article 6(1)(b) applies to processing necessary for the contract; proportionate security and fraud prevention may rely on Article 6(1)(f), while applicable legal duties have their own basis. Required information and the consequences of not providing it must be explained when it is collected. Optional information and marketing choices must remain distinguishable from information necessary for the service. Payment providers may process information independently for payment, authentication, fraud prevention or regulatory purposes; their involvement does not necessarily give us access to full card or bank details. Account closure, subscription cancellation and a request to erase personal data are distinct matters, and we will help clarify a request that concerns more than one of them.
D) Accounting and statutory record retention
Financial and transaction records are retained for the period required by the law applicable to the company and transaction concerned. Where United Kingdom corporation tax record-keeping rules apply, relevant records are ordinarily retained for six years from the end of the accounting period concerned, subject to circumstances requiring longer retention. United Kingdom VAT records are generally retained for six years where those requirements apply; particular schemes or circumstances can require a different period. These periods do not apply automatically to every overseas company or every category of personal data. The ordinary retention limits in section H do not override an applicable statutory obligation. An obligation arising solely under foreign law does not, by itself, establish the United Kingdom legal-obligation basis under Article 6(1)(c); any processing within the UK GDPR’s scope must have an appropriate lawful basis. Records retained for accounting, tax or legal purposes must not be kept available for unrelated marketing merely because retention is required.
E) Technical provision of the website and operational security
Technical information is processed to deliver requested content, maintain functionality, investigate faults and protect services against unauthorised access, attacks and misuse. This normally relies on Article 6(1)(f) and our legitimate interest in operating a secure and reliable service. Article 6(1)(b) applies where particular processing is necessary to perform a contract with you. These grounds do not replace consent required under PECR for storing or accessing information on a device. Technical suppliers receive access only to the extent necessary for their work. Routine operational records are retained for the shortest period justified by their purpose, subject to the maximum and exceptions in section H. A specific incident may justify separately retaining relevant evidence, with restricted access, while the incident or associated legal matter is addressed.
Cloudflare and cdnjs
Where Cloudflare services are used for content delivery, network protection or the distribution of technical resources through cdnjs, the provider may receive IP addresses, request times, requested resource details and technical information transmitted by the browser. The purposes and lawful basis depend on the particular service and configuration. Necessary security or delivery processing must be distinguished from optional audience analysis or advertising. Storage of a technical file in a browser cache is not the same as retention of personal data in server logs. A resource described as essential must actually satisfy the relevant legal test; the use of a content delivery network does not automatically make every related operation exempt from consent. International transfers and the respective responsibilities of providers are addressed in section G.
Google Fonts and externally loaded resources
Where fonts or other resources are loaded directly from Google or another external provider, the browser may disclose the IP address, requested resource and associated technical information to that provider. The absence of cookies does not necessarily mean that no personal data is processed. The lawful basis must reflect the actual necessity, purpose and impact of the connection. Serving a font file locally avoids the separate browser request to the external font provider for that file. Information about an external resource must distinguish its technical delivery from any additional tracking or independent use of data.
F) Cookies, device access and tracking technologies
Cookies and similar technologies can store information on your device or access information already stored there. This includes relevant uses of browser storage, tracking pixels, software identifiers and device fingerprinting. Regulation 6 of PECR applies according to how a technology operates, including where the information is not personal data. Where personal data is processed, the UK GDPR applies in addition. Descriptions such as "cookieless", "statistics", "personalisation" or "optimisation" do not, by themselves, determine whether consent is required.
Consent and statutory exceptions
Prior consent is required for storage or access that is not covered by an applicable PECR exception. Exceptions include operations necessary for transmitting a communication and operations strictly necessary to provide a service you have requested. The amended rules also contain limited exceptions for specified purposes, including qualifying statistical activities and certain appearance or functionality preferences, subject to their individual conditions. An exception must be assessed against the actual operation and all its purposes. Legitimate interests under the UK GDPR cannot replace consent that PECR requires. Information must explain the purpose, relevant provider, duration and access by other parties before the activity takes place.
Statistics used to improve our services
The statistical purposes exception may apply where the sole purpose of the storage or access is to collect information about the use of our website or service with a view to improving it, and all statutory conditions are met. It requires clear information and a simple, free means of objecting. Resulting statistics must be aggregate information rather than information used to make decisions about particular individuals. Individual-level information must not be kept beyond what is needed for aggregation. The exception does not generally cover advertising measurement, behavioural advertising, cross-service tracking or the creation of individual audience profiles. Sharing with a supplier is permissible under this exception only within its limited purpose of assisting improvements to the relevant service.
Your choices and withdrawal of consent
Where consent is required, the relevant technology must remain inactive until valid consent has been obtained. Silence, continued browsing, preselected options and general acceptance of the Terms of Service do not constitute that consent. Optional purposes must be explained and capable of appropriate separate selection. Refusing optional processing must be straightforward, and withdrawing consent must be as easy as giving it. Choices can be changed through the available cookie and privacy settings or communicated to [email protected]. An option described as "Essential only" must reflect that description. Browser settings can also block or delete cookies, although deleting a cookie does not necessarily communicate withdrawal to every recipient. Withdrawal does not invalidate earlier lawful processing but must stop further reliance on the withdrawn consent.
Remembering cookie and language choices
Our own record of a cookie or consent choice is retained for no longer than 12 months from the last active choice, subject to any limited evidential retention described in section H. Where a cookie named "laravel_cookie_consent" is used for this purpose, it must serve to remember your decision and must not be repurposed as an advertising identifier. A language preference, including a session cookie named "language" where used, is retained for the relevant session or, where a persistent preference is requested, for the necessary period up to 12 months. Session restoration by a browser may affect the practical lifetime of a session cookie. These are limits adopted in this Policy, not a claim that United Kingdom law prescribes a universal 12-month cookie period. A further visit does not itself renew consent, and material changes may require a fresh choice sooner.
Cloudflare Web Analytics
Where Cloudflare Web Analytics is used, the service may process information concerning page views, performance, referring pages and browser or device characteristics. Its configuration and operation must be assessed under PECR and the UK GDPR; describing analytics as privacy-focused does not establish an automatic legal exemption. Where the analytics relies on consent, it must be activated only after that choice. Where the statistical purposes exception is relied upon, its requirements, including the right to object and restrictions on further use, must be satisfied. Cloudflare’s published product documentation describes retention of unsampled beacon data for seven days, followed by sampling or aggregation, and access to historical reports for the preceding six months. Sampling is not itself proof of anonymisation, and these product periods do not establish the retention periods of every other Cloudflare service or log.
Advertising, personalisation and measurement purposes
Where the relevant functions are offered, separately explained processing purposes may include:
- Selecting advertising using limited information.
- Creating profiles for personalised advertising.
- Using profiles to select personalised advertising.
- Creating profiles to personalise content.
- Using profiles to select personalised content.
- Measuring advertising performance.
- Measuring content use and performance.
- Analysing audiences using statistics or information from different sources.
- Developing and improving services.
- Selecting content using limited information.
This list does not authorise every activity or establish that all of them take place. For an active purpose, the relevant providers, information, recipients, retention and international transfers must be disclosed sufficiently clearly. Advertising consent must not be expanded to unrelated purposes, and sensitive inferences require additional legal consideration. Industry frameworks, including IAB systems, do not replace statutory requirements. Selection of a general category cannot provide unlimited consent to unidentified organisations or unspecified future uses.
G) Recipients and international transfers
Personal data is disclosed only for an identified lawful purpose and to the extent justified by that purpose. Recipients may include technical service providers, providers involved in a requested transaction, professional advisers subject to confidentiality, relevant editorial contributors and competent authorities or courts where disclosure is lawful. A processor must be bound by the requirements of Article 28, including appropriate instructions, confidentiality, security and controls on further processors. Where organisations jointly determine purposes and means, Article 26 requires an appropriate allocation of responsibilities and availability of the essence of that arrangement. Your ability to exercise rights against a joint controller is not removed by an internal allocation of tasks. A commercial relationship or common ownership does not itself authorise sharing.
Principal organisations and service-related recipients
The relevant roles include:
- SCANDIC TRUST GROUP LLC, Ukraine: controller for the activities described in this Policy for which it determines the purposes and means of processing.
- SCANDIC ASSETS FZCO, United Arab Emirates: technical operation and administration, with access limited to its actual tasks and the applicable processing arrangements.
- Cloudflare, Inc., United States: where the relevant content delivery, security, cdnjs or Web Analytics services are used.
- The relevant Google service provider: where Google-hosted fonts, YouTube or other Google resources are used; the responsible entity and processing role depend on the particular service and applicable terms.
- Payment, delivery, communication and other service providers: where involved in an actual order or service, with their identity and role explained in the relevant service information.
The information provided about recipients must reflect actual disclosures. You may request the recipient information available under Article 15 and information about safeguards for applicable international transfers.
Overseas processing and remote access
The controller is established in Ukraine and the technical company is established in the United Arab Emirates. Processing may therefore involve locations outside the United Kingdom. Access by a separate overseas organisation can constitute a restricted transfer even where the server itself is located in the United Kingdom. Conversely, information supplied directly by an individual to an overseas controller is not automatically a restricted transfer by that individual under Chapter V. This distinction does not remove the controller’s other UK GDPR duties or the rules governing subsequent disclosures. Ukraine and the United Arab Emirates are not covered by general United Kingdom adequacy regulations. A corporate address, contractual promise or overseas server location does not establish an adequate transfer mechanism.
Safeguards for restricted transfers
Where Chapter V of the UK GDPR applies, a restricted transfer must be covered by applicable United Kingdom adequacy regulations, appropriate safeguards or a relevant statutory exception. Appropriate safeguards may include the International Data Transfer Agreement or the United Kingdom Addendum to the European Commission’s standard contractual clauses, properly incorporated and completed for the transfer concerned. European Commission clauses alone do not automatically satisfy the United Kingdom requirements. Where required, the transfer must be assessed against the statutory data protection test, acting reasonably and proportionately, including whether the protection after transfer would be materially lower than under United Kingdom law. Additional contractual, technical or organisational measures may be necessary. Exceptions such as explicit consent to a specified transfer require their own conditions and must not be treated as a general solution for routine overseas operations. You may request information about the mechanism used and a copy of relevant safeguards, subject to necessary protection of confidential information.
Transfers to the United States
The Data Protection (Adequacy) (United States of America) Regulations 2023 provide a limited mechanism through the United Kingdom Extension to the EU–US Data Privacy Framework. Reliance requires confirmation that the actual United States recipient has an active certification covering the United Kingdom Extension and the relevant type of information. Participation in the EU framework alone is insufficient. Additional requirements apply to certain sensitive and criminal offence information. Personal information used for journalism is not covered for transfer under the United Kingdom Extension and requires a separately assessed lawful arrangement. The mechanism does not cover every United States business, every purpose or transfers to Ukraine or the United Arab Emirates. A provider’s public description of its safeguards does not, by itself, demonstrate that a particular agreement or transfer arrangement has been put in place for our services.
H) Retention and deletion of personal data
Under this Policy, the ordinary maximum for our own routine operational records is 12 months from the event specified below. Information is deleted or irreversibly anonymised earlier where it is no longer necessary. Longer retention is limited to what is justified by a continuing service, a specific legal obligation, the establishment, exercise or defence of legal claims, continuing respect for an objection, or a properly assessed journalistic purpose. The existence of a maximum period does not justify keeping unnecessary data until that period expires.
- Enquiries and correspondence: while the matter is being handled and ordinarily no longer than 12 months after it is closed, subject to necessary legal or evidential retention.
- Accounts and contracts: while necessary for an active account or continuing contract, followed by retention of necessary remaining records for ordinarily no longer than 12 months after closure or termination, except for applicable accounting, legal or claims requirements.
- Technical and security records: only for the period justified by their operational purpose and ordinarily no longer than 12 months from recording; evidence of a particular incident may be retained separately while necessary for investigation or related legal proceedings.
- Cookie and preference records: ordinarily no longer than 12 months from the last active choice, with shorter periods where appropriate to the function.
- Consent, withdrawal and objection records: while necessary to demonstrate and respect the relevant choice, and ordinarily no longer than 12 months after the consent ends or matter is closed, except for a necessary limited compliance or evidential record.
- Marketing suppression records: a minimum record may be retained for as long as necessary to respect an objection and prevent further unwanted marketing; it must not be used to resume marketing.
- Accounting and tax records: for the applicable statutory period described in section D, where those rules apply.
- Journalistic material and archives: for the period justified by the editorial purpose, public interest, source protection and freedom of expression, with appropriate review and safeguards.
- Information processed independently by external providers: according to their actual service, role and applicable law; our ordinary 12-month limit does not determine their independent retention or extend a shorter period that applies to them.
Deletion must also be reflected in backup management. Information temporarily remaining in backups must be protected from ordinary use and removed through the applicable replacement or deletion cycle. Restoring a backup must not permanently undo an earlier deletion, objection or restriction. Legal holds must be limited to relevant information and reviewed when the reason for preservation ends.
I) Your rights
Where the UK GDPR applies, you have the following rights, subject to the conditions and lawful exceptions relevant to each right:
- Information: to receive clear information about the processing of your personal data under Articles 13 and 14.
- Access: under Article 15, to obtain confirmation of processing, access to your personal data, the prescribed supplementary information and a copy of your personal data, subject to the applicable requirements.
- Rectification: under Article 16, to have inaccurate personal data corrected and incomplete data completed where appropriate.
- Erasure: under Article 17, to have personal data erased where the statutory conditions are met, subject to exceptions including relevant legal duties, legal claims and freedom of expression and information.
- Restriction: under Article 18, to restrict processing in the circumstances specified by law.
- Portability: under Article 20, to receive qualifying information you have provided in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller, where the processing is automated and based on consent or contract.
- Objection: under Article 21, to object to relevant processing, including an unconditional right to object to processing for direct marketing.
- Withdrawal of consent: under Article 7(3), to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Safeguards concerning automated decisions: to receive the protections required by Articles 22A to 22D where decisions based solely on automated processing have legal or similarly significant effects.
Where Article 19 requires it, rectification, erasure or restriction must be communicated to recipients unless this is impossible or involves disproportionate effort. Information about those recipients is available on request. The rights and exceptions relating to journalistic processing are addressed below.
Your right to object
You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e), Article 6(1)(ea) or Article 6(1)(f), including associated profiling. The processing must then cease unless the controller demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds connected with establishing, exercising or defending legal claims. You may object to direct marketing at any time without giving a reason. This includes profiling connected with that marketing. Following such an objection, your personal data must no longer be processed for those purposes. A limited suppression record may remain necessary to ensure that your objection continues to be respected.
Requests concerning journalism and published material
Requests concerning an article, image, recording or editorial record are assessed in their specific context. Please identify the material and explain the correction, restriction or other action sought where this will help us locate and assess it. The journalism exemption may affect particular rights only where its statutory conditions are satisfied. Confidentiality of sources, the rights of other people, freedom of expression, accuracy, the public interest and relevant legal restrictions must be considered. The fact that information is embarrassing or unfavourable does not automatically require its removal, and the fact that it has already been published does not automatically justify continuing publication. Where appropriate, a correction, update, qualification, anonymisation or limitation of access may address the issue. Any restriction of your rights must be grounded in applicable law rather than a general assertion of editorial independence.
How to exercise your rights and response periods
You may send requests to [email protected] or the controller’s correspondence address above. A request need not use a prescribed form or cite legislation, and legally valid requests made through other available channels must also be recognised. Requests are normally free of charge. A fee or refusal is permitted only where the applicable statutory conditions are met, including the rules on manifestly unfounded or excessive requests. Where there are reasonable doubts about identity, we may request information necessary to verify it; a complete identity document is not automatically required. Responses must be provided without undue delay and within the applicable period under Articles 12 and 12A, normally one month. The statutory starting point takes account of any necessary identity information or lawfully chargeable fee. An extension of up to two further months is permitted where necessary because of complexity or the number of requests, with notice and reasons within the applicable initial period. For an access request, the period may be paused where further information is reasonably required to identify the information or processing activities concerned. Clarification must not be used to impose unnecessary obstacles or delay.
Access searches and reasons for decisions
Article 15 requires a reasonable and proportionate search for the personal data and information to which the access right applies. This is not a general discretion to ignore inconvenient records or refuse access because an organisation holds a large amount of information. We must consider the nature of the request and the relevant systems and records. Protection of another person’s information, legal professional privilege or a properly applicable exemption may require redaction or withholding of particular material. Where a request is not fulfilled, the response must explain the position to the extent required by law and identify the available complaint and judicial remedies. A complaint about our handling of a request does not automatically extend the original statutory deadline.
Privacy complaints and the supervisory authority
You may complain directly to us using the contact details above. Under section 164A of the Data Protection Act 2018, complaints must be acknowledged within the statutory 30-day period, investigated appropriately, and answered without undue delay, with appropriate information about progress. The acknowledgement period does not provide a general right to postpone investigating the complaint or replace the separate time limits for exercising data protection rights. You also have the right to complain to the United Kingdom’s supervisory authority, the Information Commission, operating as the Information Commission’s Office, or ICO. The regulator normally recommends giving the organisation an opportunity to address the issue first; this Policy does not impose an additional contractual restriction on access to the regulator.
Information Commission’s Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL / United Kingdom
Telephone: 0303 123 1113.
Website and complaint information: ico.org.uk
Privacy contacts, representatives and data protection officers
The controller’s privacy contact is [email protected]. The requirement to designate a representative in the United Kingdom under Article 27, where applicable, is separate from the requirement to appoint a data protection officer under Article 37. Any required appointment must be made and the relevant contact information made available in accordance with the law. The overseas correspondence addresses above do not replace a legally required United Kingdom representative. Appointment of a representative or data protection officer does not remove the controller’s responsibility or your ability to exercise rights directly against it.
J) Security and personal data breaches
Personal data must be protected by technical and organisational measures appropriate to the risks, taking account of the nature, scope, context and purposes of processing. Depending on the activity, these include access restrictions, confidentiality controls, secure authentication, appropriate encryption, maintenance, recovery arrangements and supplier oversight. Measures must be reviewed as systems and risks change. No system can guarantee that every security incident will be prevented. A personal data breach requiring notification under Article 33 of the UK GDPR must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours after awareness. Where that period is exceeded, reasons must accompany the notification. If a breach is likely to result in a high risk to individuals, Article 34 requires notification to those affected without undue delay unless an applicable exception permits otherwise. The journalism exemption does not create a general exemption from security or notification to the supervisory authority.
Risk assessment and responsible use of technology
Where processing is likely to create a high risk to people’s rights and freedoms, a data protection impact assessment must be carried out before it begins. This may be relevant to intrusive profiling, systematic monitoring, significant automated decisions, sensitive information or services likely to be accessed by children. The assessment must address necessity, proportionality, potential harm and measures to reduce risk. Where prior consultation with the supervisory authority is required, that requirement must be met. A supplier’s description of a product as secure, anonymous or compliant does not replace the assessment of its actual use within our services.
K) Disputes, judicial remedies and compensation
This Policy does not restrict the right to complain to the supervisory authority, seek an appropriate court remedy or claim compensation where the legal requirements are met. Article 82 of the UK GDPR and the relevant provisions of the Data Protection Act 2018 govern compensation for qualifying material or non-material damage; section 168 confirms that non-material damage includes distress. Entitlement depends on the applicable legal requirements and circumstances. No automatic compensation amount is promised, and no general exclusion of liability is imposed by this Policy. Data protection remedies do not depend on participation in consumer arbitration or an online dispute-resolution platform. Jurisdiction, procedure and limitation periods are determined by applicable law, and internal correspondence does not automatically suspend those periods.
L) Relevant legislation and case law
The following legislation and decisions inform the processing and protections described in this Policy. Each applies according to its scope, the facts and subsequent legal developments.
- United Kingdom General Data Protection Regulation: governs lawful processing, transparency, individual rights, controller and processor obligations, security, international transfers and the relationship between data protection and freedom of expression.
- Data Protection Act 2018: supplements the UK GDPR, including conditions for sensitive and criminal offence information, specified exemptions, regulatory powers, complaints and remedies. Schedule 2, Part 5, paragraph 26 is particularly relevant to journalism.
- Data (Use and Access) Act 2025: amends the United Kingdom framework, including recognised legitimate interests, purpose limitation, request-handling periods, automated decisions, protection of children, international transfers, electronic privacy and complaints. Only provisions in force apply as current law.
- Privacy and Electronic Communications (EC Directive) Regulations 2003: regulate storage and access technologies and relevant electronic marketing, including regulation 6 and regulations 22 and 23, as amended.
- Human Rights Act 1998 and Articles 8 and 10 of the European Convention on Human Rights: protect private life and freedom of expression and inform the assessment of competing rights, including the considerations in section 12 of the Act.
- Contempt of Court Act 1981, section 10: provides statutory protection concerning disclosure of journalistic sources, subject to the exceptions and conditions set out in that provision.
- Campbell v MGN Ltd [2004] UKHL 22, judgment of 6 May 2004: addresses the protection of private information and the balancing of privacy against freedom of expression in the circumstances of publication. Public prominence does not eliminate a person’s privacy rights.
- Bloomberg LP v ZXC [2022] UKSC 5, judgment of 16 February 2022: establishes that, as a legitimate starting point, a person under criminal investigation before charge has a reasonable expectation of privacy in information relating to that investigation. The circumstances and competing publication interests remain relevant.
- Lloyd v Google LLC [2021] UKSC 50, judgment of 10 November 2021: concerns compensation and representative proceedings under the Data Protection Act 1998. It rejected the particular claim for uniform compensation without the necessary individual basis; it must not be presented as abolishing remedies under the UK GDPR or for misuse of private information.
- Goodwin v the United Kingdom, application no. 17488/90, judgment of the European Court of Human Rights of 27 March 1996: recognises the particular importance of protecting journalistic sources under Article 10 and the need for sufficient justification for interference.
- The Data Protection (Adequacy) (United States of America) Regulations 2023: provide the limited United Kingdom transfer mechanism associated with the United Kingdom Extension to the EU–US Data Privacy Framework, subject to its actual coverage.
- Applicable United Kingdom accounting and tax legislation, including relevant requirements under the Finance Act 1998 and the Value Added Tax Act 1994 and associated regulations: governs retention where the company and records concerned fall within those requirements.
The statutory Data Protection and Journalism Code and the Age Appropriate Design Code are also relevant within their respective scope. Their application does not imply membership of a press regulator or approval of this publication by the supervisory authority.
M) Additional information about particular services
Newsletters and electronic marketing
Where we offer newsletters or promotional communications, the subscription process must explain their nature, the information used and any relevant delivery provider. Unsolicited electronic marketing to individual subscribers generally requires consent under regulation 22 of PECR unless a specific exception applies. The customer exception is limited to contact details obtained in the course of a sale or negotiations for a sale, marketing of the sender’s own similar products or services, and a simple opportunity to refuse both when the details are collected and in each subsequent message. It does not permit general sharing of customer addresses for unrelated third-party advertising. Different rules may apply to corporate subscribers, while the UK GDPR continues to protect identifiable individuals. The sender must be identifiable and a valid means of stopping the messages must be provided. You may unsubscribe through the mechanism in the message or by contacting [email protected].
Newsletter measurement and service messages
Subscribing to a newsletter does not automatically authorise individual tracking of message opening, reading or link use. Tracking pixels and similar techniques require their own assessment under PECR and the UK GDPR, with appropriate information and consent where required. Necessary communications about an account, payment, security incident or service request must be limited to their purpose and must not be used to circumvent an objection to marketing. Subscription information is retained while needed to provide the requested communications, followed by the limited retention and suppression arrangements in section H.
Embedded content, social networks and affiliate links
Embedded video, audio, images, social functions and other external resources may disclose your IP address, device information, the page visited and interaction details to their providers. Disclosure may occur without a platform account, while being signed in can allow the provider to connect activity with that account. Elements requiring consent must not be activated before that consent is obtained. Where we jointly determine particular processing with a platform, our responsibilities must be assessed accordingly. A link to a provider’s privacy notice does not replace information or consent for which we are responsible. Receiving commission from an affiliate link does not itself establish a lawful basis for tracking the user or disclosing personal data.
YouTube and external video resources
Where YouTube is embedded, both the player and an externally hosted preview image can initiate connections to Google or YouTube servers. A preview image may disclose technical information before playback begins. Activating the player may involve further requests, cookies, local storage or account-related processing, depending on configuration and the user’s settings. A privacy-enhanced player does not necessarily eliminate every disclosure or storage operation. The requirements for a lawful basis, information and any necessary consent therefore apply to the actual combination of preview, player and related resources.
Examples of Google cookie durations
Google’s published information describes the following examples. Actual use depends on the service, location, settings and account status; their inclusion is not a statement that every cookie is placed through our website.
- "YSC": associated with security during a browsing session and ordinarily retained for that session.
- "__Secure-YNID": used for YouTube functions and troubleshooting, with a stated duration of six months; Google identifies it as replacing "VISITOR_INFO1_LIVE".
- "PREF": stores playback or display preferences and expires eight months after the user’s last use.
- "SOCS": remembers Google cookie choices, with a stated duration of 13 months.
A cookie’s expiry period is not the same as the retention period for information already transmitted to a provider. Provider descriptions of functionality or security do not, by themselves, establish that every use of the cookie is exempt from consent under PECR. The information presented for the actual implementation must remain accurate.
Profiling and automated decisions
Personalisation can involve evaluating identifiers, viewed content and interactions to infer interests or preferences. This may constitute profiling even where it does not produce a legally or similarly significant decision. The lawful basis, information duties, consent requirements and objection rights depend on the actual activity. Under the amended UK GDPR, Articles 22A to 22D govern decisions based solely on automated processing that have legal or similarly significant effects. The assessment includes whether there is meaningful human involvement. Where the safeguards apply, individuals must receive the required information and be able to make representations, obtain human intervention and contest the decision. Additional restrictions apply to significant automated decisions involving special category data. Such decisions must not be based entirely or partly on the recognised legitimate interest ground in Article 6(1)(ea). The safeguards cannot be replaced by general acceptance of this Policy or the Terms of Service.
Children and young people
Children’s information requires particular protection and explanations appropriate to their age and understanding. Where Article 8 of the UK GDPR applies to an information society service offered directly to a child and the processing relies on consent, the child may give that consent from the age of 13. Below that age, consent must be given or authorised by a holder of parental responsibility, with reasonable efforts to verify that authorisation. This rule does not establish a general minimum age for reading public news and does not replace the separate rules on contractual capacity. For online services likely to be accessed by children, Article 25 requires consideration of their higher protection needs, including different ages and stages of development. The Age Appropriate Design Code applies within its scope, including expectations concerning privacy settings, data minimisation, profiling and the avoidance of design that encourages unnecessary disclosure. Age assurance must itself be proportionate and must not become a reason to collect unnecessary identity documents.
Events, competitions, photographs and access control
Where we organise events, competitions, reservations or controlled access, the relevant collection must be explained at the time, including the required information, purpose, lawful basis, recipients and retention. Participation must not automatically include consent to unrelated marketing. Photography, filming or CCTV requires an appropriate assessment and clear information; attendance alone is not blanket consent to every future promotional use. Particular care is required with children and sensitive circumstances. Identity checks, dates of birth and copies of documents may be requested only where justified by the actual purpose. Security footage must be retained for a period appropriate to that purpose and deleted earlier than the general maximum in section H where continued retention is unnecessary.
Changes to this Privacy Policy
This Policy may be updated to reflect changes in services, processing or applicable law. Material changes must be communicated in a manner appropriate to their significance. Before using personal data for a further purpose, we must provide the information required by law, assess the applicable purpose-limitation requirements and obtain fresh consent where necessary. Publication of a new Policy, silence or continued use does not constitute consent to new processing. Consent may be withdrawn at any time; there is no two-week deadline limiting that right. The date at the end identifies the latest revision of this text.
Contact:
"MORNING CHRONICLE"
Email: [email protected]
© 2026 "MORNING CHRONICLE" - All rights reserved, subject to statutory exceptions.
Last updated: 31 October 2026.