PRIVACY POLICY
PRIVACY POLICY FOR "NOTTINGHAM GUARDIAN"
Data controller
SCANDIC TRUST GROUP LLC is responsible for the processing of personal data described in this Privacy Policy wherever it determines the purposes and means of that processing. References to “we”, “us” and “our” mean SCANDIC TRUST GROUP LLC. "NOTTINGHAM GUARDIAN" is the publication’s title and does not constitute a separate legal entity.
SCANDIC TRUST GROUP LLC
IQ Business Centre
Bolsunovska Street 13–15
01014 Kyiv / Ukraine
Email: [email protected]
Legal form: limited liability company incorporated under Ukrainian law, LLC.
Ukrainian registration entry: 1010351020000018952.
The address above is our operational and correspondence address. You may use the email or postal address to ask questions about personal data, exercise your rights or make a data protection complaint.
Registered office and registered address
SCANDIC TRUST GROUP LLC
Oksamytova Street 1-b, Office 30
Sofiivska Borshchahivka
Kyiv Region - 08147 / Ukraine
SCANDIC ASSETS FZCO provides technical services and website administration within the scope of its appointment. Where it processes personal data on behalf of SCANDIC TRUST GROUP LLC, it must act under documented instructions and an arrangement meeting Article 28 of the United Kingdom General Data Protection Regulation. Access must be limited to the information required for its authorised tasks. A company’s status as controller, joint controller or processor depends on its actual responsibilities and activities; membership of the same corporate group does not, by itself, determine that status.
Commercial cooperation
LEGIER Beteiligungs mbH
Kurfürstendamm 14
10719 Berlin
Federal Republic of Germany
Commercial register: HRB 57837
Register court: Amtsgericht Charlottenburg, Berlin
VAT identification number: DE413445833
Telephone: +49 30 99211 3469
Fax: +49 30 99211 3225
Email: [email protected]
Where LEGIER Beteiligungs mbH is involved in an advertising enquiry or commercial arrangement, personal data may be disclosed to it only for a specified lawful purpose and to the extent necessary for its role. Commercial cooperation does not give that company unrestricted access to reader, subscriber or editorial information. Where it determines its own purposes and means of processing, its responsibilities as a separate controller and the relevant privacy information must be identified in connection with the particular service.
United Kingdom representative under Article 27 of the UK GDPR
SCANDIC TRUST GROUP LLC
Oksamytova Street 1-b, Office 30
Sofiivska Borshchahivka
Kyiv Region - 08147 / Ukraine
Introduction and scope
This Privacy Policy explains how personal data is handled in connection with the website, editorial activities and related digital services of "NOTTINGHAM GUARDIAN". It covers readers, correspondents, contributors, people mentioned in journalistic material and, where the relevant services are offered, account holders, subscribers, customers and event participants. Descriptions of optional services and external technologies apply only when those services or technologies are actually provided or used. Service-specific information must identify any additional processing before it begins. This Privacy Policy provides information; it is not a request for blanket consent, and your statutory rights do not depend on accepting it.
Applicable data protection framework
Processing within the territorial scope of United Kingdom law is governed by the United Kingdom General Data Protection Regulation, referred to below as the “UK GDPR”, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, referred to as “PECR”, as amended, including by the applicable provisions of the Data (Use and Access) Act 2025. The UK GDPR can apply to an organisation established outside the United Kingdom where its processing relates to offering goods or services to people in the United Kingdom or monitoring their behaviour there. The European Union General Data Protection Regulation applies separately where its own territorial requirements are met; it does not replace the United Kingdom framework for the processing addressed here.
A) General information about personal data processing
Personal data means information relating to an identified or identifiable living individual. It may include names, contact details, correspondence, photographs, recordings, account information, transaction records, IP addresses, online identifiers and information about the use of our services. Replacing a name with an identifier does not necessarily make information anonymous. Pseudonymised information remains personal data where a person can still be identified using additional information. We limit processing to information that is adequate, relevant and necessary for a specified purpose and apply data protection considerations when designing services and choosing their default settings.
Purposes and lawful bases
The lawful basis depends on the particular activity and is identified before processing begins.
- Consent — Article 6(1)(a) UK GDPR: optional processing for clearly explained purposes, including marketing, tracking or personalisation where consent is the appropriate or required basis. Consent must be freely given, specific, informed and unambiguous, and may be withdrawn at any time.
- Contract — Article 6(1)(b) UK GDPR: processing objectively necessary to perform a contract with you or take steps at your request before entering into one, such as administering an order or providing a requested subscription. Including an activity in contractual terms does not, by itself, make that activity necessary.
- Legal obligation — Article 6(1)(c) UK GDPR: processing necessary to comply with an applicable legal obligation that satisfies the requirements of Article 6(3), including relevant statutory record-keeping duties.
- Legitimate interests — Article 6(1)(f) UK GDPR: proportionate processing for operating and protecting our services, handling ordinary correspondence, preventing misuse, pursuing legitimate editorial activities and establishing, exercising or defending legal claims, provided those interests are not overridden by your interests, rights or freedoms.
- Recognised legitimate interests — Article 6(1)(ea) UK GDPR: processing meeting a specific condition in Annex 1, where applicable, such as necessary processing for preventing crime or safeguarding vulnerable individuals. This is a separate, limited basis and does not provide general permission for advertising, profiling or commercial data sharing.
Where legitimate interests are relied upon, we assess the purpose, necessity and effect on individuals. Consent cannot be avoided by retrospectively changing the stated lawful basis simply because it has been refused or withdrawn. Publishing news does not, by itself, give a private publisher a statutory public-task mandate.
Sources of personal data
We receive information directly from individuals through correspondence, submissions, accounts, orders and other interactions; automatically from devices when our digital services are accessed; and, where relevant, from payment or technical providers, contributors, news agencies, interviewees, public records and other journalistic sources. Information that is publicly accessible remains subject to data protection requirements. Where information is obtained indirectly, we provide the information required by Article 14 UK GDPR within the applicable period, normally no later than one month and, where relevant, by the first communication or disclosure. Any exception, including an applicable journalistic exemption, must be assessed for the particular processing.
Editorial and journalistic processing
Journalistic work may involve collecting, checking, organising, retaining and publishing information about identifiable people. This can include information obtained through interviews, documents, photographs, recordings, correspondence, public proceedings and confidential sources. We consider accuracy, relevance, necessity, the public interest, reasonable expectations of privacy and the potential consequences of publication. The fact that information is interesting to readers does not automatically establish a public interest in publishing it.
Journalistic exemptions and protection of sources
Schedule 2, Part 5, paragraph 26 of the Data Protection Act 2018 provides exemptions from specified UK GDPR provisions where processing is undertaken with a view to publication of journalistic, academic, artistic or literary material, the controller reasonably believes publication would be in the public interest, and the controller reasonably believes compliance with the particular provision would be incompatible with those purposes. These conditions require an assessment of the circumstances; the exemption does not apply automatically to every activity of a newspaper. Relevant statutory considerations and applicable codes must be taken into account. Confidential sources, unpublished material and the rights of other individuals may affect what can lawfully be disclosed. Ordinary account administration, advertising, subscriptions and website analytics do not become exempt merely because they are carried out by a publisher.
Special category data and criminal offence information
Some information requires additional protection, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and genetic or biometric data used for unique identification. Where Article 9 UK GDPR applies, an Article 6 lawful basis must be accompanied by an appropriate Article 9 condition. Criminal conviction and offence information is subject to Article 10 and the relevant requirements of the Data Protection Act 2018. Additional safeguards, including an appropriate policy document where required, must be observed. Any reliance on the journalistic exemption is assessed separately. A person’s public disclosure of sensitive information is not unrestricted permission to reuse it for advertising or unrelated profiling.
External platforms and distribution services
Our material may be accessed through third-party platforms where we maintain an account, distribute content or provide a supported integration. Depending on the service actually offered, these may include X, Instagram, Facebook, YouTube, Telegram, TikTok, Apple services, Google services, Amazon services, Roku, Telekom Magenta, Huawei services, Spotify and other audio or content platforms. Their own processing is governed by their respective privacy information and applicable law. Following an ordinary external link, using an embedded player and interacting with our account on a platform can involve different disclosures. Being registered with a platform does not amount to consent to every disclosure made through our website, and a platform’s privacy notice does not remove our responsibility for processing that we determine.
Technical information and voice-enabled services
Requests to our services may generate technical information such as the requested resource, date and time, response status, volume of data transferred, IP address, browser and operating system information, and a referring page where the browser supplies it. This does not mean that we automatically know every website you visit before or after using our services. Where content is accessed through a voice assistant, connected television, wearable device or similar service, the device or platform operator may separately process voice commands, recordings, transcripts or account information. We receive only the information actually transmitted to us by the relevant integration; access to our content does not necessarily give us access to the platform’s complete recordings or account history.
Additional activities and information supplied voluntarily
Where we offer events, competitions, reservations or other additional activities, we provide information appropriate to the particular activity when collecting personal data. Additional identification, accessibility, dietary or health information is requested only where justified and subject to the applicable conditions. Providing information for participation does not automatically authorise publication, marketing or disclosure to sponsors. Any photography, recording or monitoring associated with an activity requires its own appropriate assessment and information. Please avoid sending unnecessary identity documents, payment credentials or sensitive information in ordinary correspondence.
B) Contacting us
When you contact us, we process your contact details, the content of your message and relevant correspondence to understand and respond to your enquiry. The basis is Article 6(1)(b) UK GDPR where the enquiry concerns a contract with you or steps you request before entering into one; Article 6(1)(f) for ordinary correspondence and the legitimate administration of enquiries; or Article 6(1)(c) where a legal obligation applies. Editorial submissions may also involve the journalistic processing described in section A. Contacting us does not subscribe you to marketing. Correspondence is retained while the matter remains active and afterwards only to the extent justified by follow-up requirements, applicable obligations or identifiable legal claims.
C) Accounts, subscriptions, reservations and orders
Where these services are available, we process the identity, contact, account, order and transaction information necessary to provide them, authenticate access, communicate about performance and administer payment or cancellation. Article 6(1)(b) UK GDPR applies to processing necessary for your contract. Security and fraud prevention may involve Article 6(1)(f), or another applicable basis where its conditions are met. Information required to provide a service must be distinguished from optional information, and the consequences of not providing required details must be explained at collection. Payment providers may process payment credentials and transaction information under their own responsibilities or as processors, depending on the service. Their identity and relevant processing information must be made available when payment is arranged. An account or purchase does not automatically authorise behavioural advertising, optional tracking or disclosure of personal data to unrelated businesses.
D) Accounting, tax and statutory records
Invoices, transaction records and related correspondence are retained where necessary to comply with legal obligations applicable to the relevant company or transaction. Where United Kingdom VAT record-keeping requirements apply, the ordinary retention period is at least six years, subject to applicable exceptions and special schemes. This does not establish a six-year retention period for all personal data. A requirement arising under foreign law does not automatically qualify as an Article 6(1)(c) UK GDPR obligation; the appropriate basis must be assessed within the United Kingdom framework. Records needed for legal claims are retained only where there is a justified need, taking account of the relevant limitation period, the nature of the dispute and any proceedings. Access to retained financial and legal records is restricted to their continuing purpose.
E) Technical provision, reliability and security
We process technical information necessary to deliver requested pages and files, maintain sessions, identify faults, protect accounts and systems, investigate misuse and maintain service reliability. The principal basis for necessary operational security is Article 6(1)(f) UK GDPR, subject to a necessity and balancing assessment; Article 6(1)(b) applies where processing is objectively necessary for an agreed service. Applicable PECR requirements remain separate. Operational information is not automatically available for advertising or cross-service profiling. Technical providers must receive only the access and information necessary for their assigned functions, and incident records must be distinguished from routine operational logs.
Content delivery networks and external technical resources
Where a content delivery network or external library service, such as Cloudflare or cdnjs, is used, the provider may receive an IP address, the requested resource, the time of the request and technical information supplied by the browser. Such processing must be assessed for its actual purpose, necessity, recipients and international transfers. A resource described as technical is not automatically exempt from consent requirements. A browser cache lifetime is not the same as the retention period for personal data in server logs. External services must not be introduced under a general claim that all technical processing is essential.
Fonts and other externally loaded resources
Where fonts or other resources are loaded directly from an external provider, such as Google Fonts, a connection may disclose an IP address and technical request information even if no advertising cookie is used. Local hosting can avoid that particular external connection. The applicable lawful basis and any device-access requirements depend on the implementation. Describing a service as cookie-free does not establish that no personal data is processed or that no international transfer occurs.
F) Cookies, device access and tracking technologies
Cookies and similar technologies can store information on a device or access information already held there. Relevant technologies may include browser storage, pixels, software development kits, identifiers and techniques that collect or monitor information emitted by a device. The legal assessment depends on how a technology works and why it is used. PECR can apply even where the information concerned is not personal data. Where personal data is also processed, the UK GDPR applies alongside PECR.
United Kingdom rules and statutory exceptions
Regulation 6 and Schedule A1 PECR govern storage and access. Prior consent is required unless a statutory exception applies. Exceptions include operations solely necessary to transmit a communication and operations strictly necessary to provide a service requested by the user. Limited exceptions also exist for qualifying statistical purposes and specified appearance or functionality preferences, subject to their conditions, clear information and a simple means of objecting free of charge. The statistical exception concerns improving the relevant service through statistical information; it does not provide a general exemption for online advertising, individual advertising profiles or tracking across unrelated services. Any provider assisting with exempt statistical processing must remain within the permitted purpose.
Consent and genuine choice
Where consent is required, the relevant technology must remain inactive until valid consent has been given. Pre-selected options, silence, continued browsing or general acceptance of Terms of Service do not constitute that consent. Choices must identify the relevant purposes and providers without misleading design or unnecessary obstacles. Rejecting optional processing must be readily accessible, and withdrawing consent must be as easy as giving it. Consent to device access does not dispense with the need for a lawful basis for subsequent personal data processing. A consent management platform or industry framework does not itself establish compliance.
Remembering choices and requested preferences
Information used to remember a privacy choice, maintain a requested session or apply a selected preference must be limited to that function. Its duration must be proportionate and explained in the relevant cookie information. A record that you declined optional processing must not be repurposed as an advertising identifier. A later visit does not, by itself, renew consent. Consent records and preference cookies have different functions from advertising profiles and must not be treated as interchangeable. There is no universal United Kingdom rule making every cookie consent valid for twelve months.
Analytics and audience measurement
Where analytics are used, we distinguish aggregate service measurement from individual tracking, advertising measurement and cross-service profiling. An analytics product, including a product described as cookie-free, must be assessed against its actual operation. Where a statutory exception is relied upon, all its conditions must be met and the required objection mechanism provided. Otherwise, consent must be obtained before device access that requires it. Any associated personal data processing must also have an appropriate lawful basis. Analytics providers must not be assumed to have permission to reuse information for their own unrelated purposes merely because they supply a measurement service.
Purposes requiring specific information and choices
Where the corresponding functions are actually offered, the information presented before activation must distinguish relevant purposes, including:
- Selecting advertising using limited information.
- Creating profiles for personalised advertising.
- Using profiles to select personalised advertising.
- Creating profiles for personalised content.
- Using profiles to select personalised content.
- Measuring advertising performance.
- Measuring content use and performance.
- Producing audience statistics or combining information from different sources.
- Developing or improving services.
- Selecting content using limited information.
This list describes possible categories, not a statement that every activity takes place. Each actual activity requires appropriate information about its purpose, data, providers, recipients, retention and transfers. Processing that reveals or infers special category information requires additional assessment under Article 9 UK GDPR.
Changing settings and withdrawing consent
You may change or withdraw a choice through the privacy controls provided for the relevant service or by contacting [email protected]. Browser settings can also block or delete cookies, but deletion alone does not necessarily communicate withdrawal to every provider. Withdrawal does not affect processing lawfully undertaken beforehand. Processing that depends on the withdrawn consent must cease; information is then deleted or otherwise dealt with according to any separate, valid and limited retention requirement. An objection to processing under an applicable PECR exception must likewise be respected. No deadline limits your ability to withdraw consent.
G) Recipients and international transfers
Personal data is disclosed only for an identified lawful purpose and to the extent necessary. Depending on the activity, recipients may include:
- SCANDIC ASSETS FZCO and other authorised providers of hosting, technical support, security, communications, storage and backup services.
- Providers involved in delivering a requested subscription, payment, reservation, event or other service.
- External content, analytics or advertising providers where their involvement has been properly explained and the applicable legal requirements have been met.
- Professional advisers, auditors, insurers and representatives where necessary and subject to appropriate confidentiality.
- Courts, regulators, law enforcement bodies or other competent authorities where disclosure is legally required or otherwise justified under applicable law.
- Readers and other members of the public where personal data is lawfully included in published journalistic material or in a contribution intended for publication.
Group membership does not authorise unrestricted sharing. Processors must act under appropriate contractual arrangements and documented instructions. Where organisations jointly determine the purposes and means of processing, Article 26 UK GDPR applies and the essence of the relevant allocation of responsibilities must be made available. Independent controllers remain responsible for their own processing.
Processing outside the United Kingdom
SCANDIC TRUST GROUP LLC is established in Ukraine and SCANDIC ASSETS FZCO is established in the United Arab Emirates. Processing associated with their activities may therefore take place outside the United Kingdom. Restricted transfers can also arise when a separate overseas organisation accesses information remotely; locating a server in the United Kingdom does not necessarily prevent a transfer. Ukraine and the United Arab Emirates are not covered by general United Kingdom adequacy arrangements. The applicable transfer requirements must be assessed for each flow of information, including onward access by suppliers and subcontractors.
Transfer safeguards and the data protection test
Where a restricted transfer is covered by applicable United Kingdom adequacy regulations, that mechanism may be used within its scope. Otherwise, an appropriate safeguard is generally required, such as the United Kingdom International Data Transfer Agreement or the United Kingdom Addendum to the European Commission’s standard contractual clauses. European standard contractual clauses alone do not automatically provide the required United Kingdom safeguard. Before relying on an Article 46 mechanism, the applicable data protection test must be completed, assessing reasonably and proportionately whether protection after transfer is not materially lower than under United Kingdom law. Necessary supplementary measures and binding agreements must be in place. A transfer must not proceed on that basis if the required protection cannot be achieved.
Transfers to the United States
The United Kingdom Extension to the EU–US Data Privacy Framework may support a transfer only where the receiving organisation has a valid participating certification and the transfer falls within its scope. It is not a general adequacy finding covering every United States business or every category of processing. Participation in the European Union framework without the relevant United Kingdom extension is not sufficient for this mechanism. Where the extension does not cover a transfer, another valid mechanism is required. A supplier’s general statement about its transfer arrangements does not establish that a particular contract or transfer involving our services is covered.
Information about safeguards and exceptional transfers
You may request information about the mechanism applicable to a particular transfer and a copy of relevant safeguards by contacting [email protected]. Necessary redactions may protect confidential information without preventing meaningful information about the safeguards. Article 49 derogations are assessed restrictively and must not be treated as a routine substitute for safeguards in continuing overseas service arrangements. Where explicit consent to an exceptional transfer is relied upon, the required information about relevant risks must be provided beforehand.
H) Retention and deletion
We retain personal data only for as long as necessary for its stated purpose and any justified continuing obligation. Where a fixed period cannot appropriately be stated, retention is determined by the criteria below. The fact that storage remains technically possible is not a reason to retain information.
- Enquiries and correspondence: while the matter is being handled and for a justified follow-up period, taking account of unresolved issues, applicable obligations and identifiable legal claims.
- Accounts and subscriptions: while information is necessary for the active account or service, followed by deletion or restricted retention of the records still required for financial, legal or security purposes.
- Orders and payments: for performance, reconciliation, refunds and complaints, with relevant accounting and tax records retained for the applicable statutory period.
- Technical logs: for the period necessary to operate the service, identify faults and address security risks, with longer retention of particular incident records only where separately justified.
- Marketing information: while a valid subscription or other lawful marketing basis continues, subject to withdrawal, objection and periodic review.
- Consent and preference records: for the period needed to apply and demonstrate the relevant choice, with limited further retention where necessary to establish compliance or address a legal claim.
- Suppression records: a minimal record may be retained for as long as necessary to ensure that an objection or unsubscribe request continues to be respected.
- Journalistic material and archives: for as long as justified by the editorial purpose, the public interest, evidential requirements and freedom of expression, with appropriate consideration of continuing accuracy, relevance and privacy.
- Complaints and rights requests: for handling the matter, demonstrating the response and addressing reasonably foreseeable review, enforcement or legal proceedings.
A legal hold must be limited to relevant information and reviewed when the reason for it ends. Retention by an independent external controller is governed by that controller’s responsibilities and privacy information; it is not determined by a general retention statement in this Policy.
Deletion, anonymisation and backups
When personal data is no longer required, it is deleted or effectively anonymised. Removing a name is insufficient if identification remains reasonably possible. Backup arrangements must incorporate retention and deletion requirements. Information awaiting removal through a controlled backup replacement cycle must remain protected and unavailable for ordinary reuse. If a backup is restored, applicable deletion requests and processing restrictions must be reapplied.
I) Your data protection rights
Subject to the applicable statutory conditions and exemptions, you have the following rights:
- Access — Article 15 UK GDPR: to obtain confirmation of processing, access to your personal data, a copy of it and the required supplementary information.
- Rectification — Article 16 UK GDPR: to have inaccurate personal data corrected and incomplete personal data completed where appropriate.
- Erasure — Article 17 UK GDPR: to have personal data deleted where the relevant conditions are met, subject to exceptions including legal obligations, legal claims and freedom of expression and information.
- Restriction — Article 18 UK GDPR: to limit processing in the circumstances specified by law.
- Portability — Article 20 UK GDPR: to receive qualifying personal data you have provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller. This applies to qualifying automated processing based on consent or contract.
- Objection — Article 21 UK GDPR: to object to qualifying processing, including an unconditional objection to processing for direct marketing and related profiling.
- Withdrawal of consent — Article 7(3) UK GDPR: to withdraw consent at any time without affecting the lawfulness of processing undertaken before withdrawal.
- Safeguards concerning automated decisions — Articles 22A to 22D UK GDPR: to receive the applicable information and safeguards where a significant decision is made solely through automated processing.
Where Article 19 requires it, rectification, erasure or restriction is communicated to recipients unless this is impossible or involves disproportionate effort. Information about those recipients is provided on request.
Your right to object
Where Article 21(1) applies to processing based on Article 6(1)(e) or Article 6(1)(f), you may object on grounds relating to your particular situation. We must then stop the relevant processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is required for establishing, exercising or defending legal claims. You may object to direct marketing at any time without giving a reason. After such an objection, your information must no longer be processed for that marketing, including related profiling. Keeping a minimal suppression record to respect the objection does not authorise further marketing.
Requests concerning journalistic material
Requests relating to reporting, unpublished research, sources or editorial archives are considered individually. Please identify the material and the information concerned so that the request can be understood and investigated. The journalistic exemption described in section A may affect particular rights where its conditions are met; it is not a blanket refusal mechanism. We consider accuracy, the public interest, source protection, the rights of other people and the effect of altering an archive. Where appropriate, correction, clarification, updating or another proportionate measure may address the issue. The continuing public availability of material is not, by itself, a complete answer to a privacy concern.
Making a request and response periods
You may contact us at [email protected] or at the correspondence address above. A valid request does not require a particular form, legal terminology or a reference to an Article. Requests are generally free of charge. A reasonable fee or refusal is permitted only where the relevant statutory conditions are satisfied. If there are reasonable doubts about identity, we may request proportionate information needed to verify it; a complete identity document is not automatically required. We respond without undue delay and within the applicable period, ordinarily one month. An extension of up to two further months may be available because of complexity or the number of requests, with notice and reasons provided within the first month.
Clarification and searches
For an access request, we undertake reasonable and proportionate searches. Where clarification is reasonably required to identify the information or processing concerned, the response period may be paused in accordance with the statutory rules. This does not allow us to require an individual to narrow a valid request merely for convenience. Any identity verification, clarification, extension or exemption must be used only where justified. If we do not act on a request, we explain the reasons and available complaint or judicial remedies to the extent required by law.
J) Security of personal data
Personal data must be protected by technical and organisational measures appropriate to the risk, taking account of the nature, scope, context and purposes of processing. Relevant measures include proportionate access controls, confidentiality requirements, secure configuration, protection of communications and stored information where appropriate, supplier oversight, recovery arrangements and procedures for identifying and responding to incidents. Access is limited according to legitimate operational needs. Measures require review as systems and risks change. No website, transmission method or storage environment can guarantee the complete absence of security incidents.
Personal data breaches
Where a breach is likely to result in a risk to individuals’ rights and freedoms, it must be reported to the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness, in accordance with Article 33 UK GDPR. Where a breach is likely to result in a high risk, affected individuals must also be informed without undue delay under Article 34 unless a lawful exception applies. Breaches and the response to them must be documented. Any applicable journalistic exemption requires its own assessment and does not remove the general obligation to maintain appropriate security.
K) Data protection complaints and remedies
If you believe your personal data has been handled improperly, you may complain by email to [email protected] or by post to our correspondence address. Please describe the issue and, where possible, the relevant service or correspondence. You do not need to use a prescribed form. In accordance with section 164A of the Data Protection Act 2018, we acknowledge a data protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you appropriately informed and communicate the outcome without undue delay. The acknowledgement period is not a general entitlement to postpone investigation or a substitute for the separate deadlines applying to rights requests.
United Kingdom supervisory authority
You have the right to complain to the United Kingdom data protection supervisory authority. Since 30 September 2026, that authority is the Information Commission, which succeeded the Information Commissioner’s Office. Raising the matter with us can assist investigation and resolution, but this Policy does not remove your statutory right to approach the regulator. Its published head office address is:
Information Commission
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL / United Kingdom
The regulator’s functions and the procedure applicable to a complaint are determined by law.
Judicial remedies and compensation
This Policy does not restrict your right to seek a judicial remedy or claim compensation where the statutory conditions are met. Article 82 UK GDPR and section 168 of the Data Protection Act 2018 address compensation for qualifying material and non-material damage, including distress. A contractual limitation of liability or choice-of-law provision cannot remove mandatory data protection rights. Exercising those rights is not conditional on participation in a consumer alternative dispute resolution scheme, and the former European Union online dispute resolution platform is not a data protection complaints mechanism.
L) Applicable legislation and case law
The following provisions and decisions inform the interpretation of this Policy where relevant to the activity and circumstances concerned. Their inclusion does not create an exemption, lawful basis or contractual restriction beyond what the law permits.
United Kingdom legislation
- United Kingdom General Data Protection Regulation: the principles and lawful bases for processing; transparency; individual rights; controller and processor responsibilities; security; international transfers; and the relationship between data protection and freedom of expression.
- Data Protection Act 2018: supplementary United Kingdom provisions, including conditions for particular categories of processing, exemptions, regulatory powers, remedies and the journalistic provisions in Schedule 2, Part 5, paragraph 26.
- Data (Use and Access) Act 2025: amendments to the United Kingdom framework, including recognised legitimate interests, automated decision-making, aspects of subject access, international transfers, children’s protection, complaints and PECR. The Act amends the existing framework rather than replacing it.
- Privacy and Electronic Communications (EC Directive) Regulations 2003: particularly regulation 6 and Schedule A1 concerning device storage and access, and regulations 22 and 23 concerning electronic mail marketing.
- Human Rights Act 1998 and Articles 8 and 10 of the European Convention on Human Rights: respect for private and family life and freedom of expression, including the assessment required where privacy and publication interests conflict.
- Contempt of Court Act 1981, section 10: protection against compulsory disclosure of journalistic sources, subject to the conditions and exceptions established by law.
Overseas controllers and statutory appointments
Article 27 UK GDPR requires an overseas controller within Article 3(2) to designate a United Kingdom representative unless a statutory exception applies. A general correspondence address outside the United Kingdom does not fulfil that appointment. Where required, the representative’s identity and contact details must be made available to affected individuals. Appointment of a data protection officer is a separate question governed by Articles 37 to 39 and depends on the relevant statutory criteria. An ordinary privacy contact address does not, by itself, identify an appointed data protection officer or United Kingdom representative.
Privacy and reporting
In Bloomberg LP v ZXC [2022] UKSC 5, decided on 16 February 2022, the Supreme Court confirmed that a person under criminal investigation ordinarily has a reasonable expectation of privacy concerning that investigation before being charged. The assessment remains sensitive to the circumstances and requires consideration of the competing privacy and expression rights. Accurate information is not automatically outside privacy protection, and professional or business activities can fall within the protected sphere.
Journalistic sources
In Goodwin v the United Kingdom, application no. 17488/90, judgment of 27 March 1996, the European Court of Human Rights recognised protection of journalistic sources as a fundamental condition of press freedom. Compulsory disclosure requires an overriding public-interest justification. Source protection is therefore an important consideration when handling requests for information, while remaining subject to the applicable legal framework.
Compensation and individual circumstances
In Lloyd v Google LLC [2021] UKSC 50, decided on 10 November 2021, the Supreme Court rejected the particular representative claim for uniform damages advanced under section 13 of the Data Protection Act 1998 without proof of the relevant individual circumstances and damage. The judgment concerned that earlier legislation and the claim as pleaded. It does not provide a general exclusion of compensation under the UK GDPR or the Data Protection Act 2018.
M) Additional information about individual services
Newsletters and electronic marketing
Where a newsletter or marketing subscription is offered, information about its content, the use of contact details and any relevant delivery provider is supplied before subscription. Electronic marketing to individual subscribers requires consent unless a specific PECR exception applies. The products and services soft opt-in is limited to qualifying details obtained during a sale or negotiations for a sale, marketing of our own similar products or services, and a clear opportunity to refuse marketing both when details are collected and in each subsequent message. It does not authorise marketing to purchased lists or automatically extend to other group companies. Creating an account, submitting an enquiry or agreeing to general terms is not, by itself, marketing consent.
Unsubscribing and message tracking
Marketing messages must identify the sender and provide a straightforward means of stopping further marketing. You may use the unsubscribe facility or contact [email protected]. Necessary service communications, such as an order confirmation or a security notice, are distinguished from promotional messages. Subscription to a newsletter does not automatically authorise individual tracking of opens or link activity. Any such tracking requires specific information, an appropriate lawful basis and prior consent wherever PECR requires it. A minimal suppression record may be retained to honour an unsubscribe request.
Embedded content, social functions and affiliate links
Embedded video, audio, social media features and other external elements may transmit an IP address, device information, the page being viewed and interaction data to their providers. This can occur without an account with that provider; where an account is active, the provider may be able to associate activity with it. Elements requiring consent must not be activated before the relevant consent. An external provider’s notice does not replace our own information or consent responsibilities. Receiving a commission from an affiliate link does not, by itself, supply a lawful basis for tracking the user.
YouTube and externally loaded previews
Where a YouTube video or another external player is embedded, both the player and externally hosted preview images must be considered. Loading a preview can disclose technical information before playback begins. Activating the player may result in additional processing, cookies or other device access, depending on the configuration and the user’s account status. A privacy-enhanced setting does not automatically eliminate every disclosure or every consent requirement. The relevant information and any required consent must cover the actual operation, including requests made before playback.
Cookie names, durations and provider information
Information for an active technology must state its actual purpose, provider, relevant storage or access duration and any associated personal data retention or transfer arrangements. Generic examples from another website are not a substitute for an accurate description of this service. Cookie expiry, renewal on a later visit, browser session restoration and retention of information on a provider’s servers are separate matters. A change of cookie name does not necessarily mean that the underlying processing purpose has changed, and an unchanged name does not establish that its purpose or recipients remain the same.
Profiling and automated decisions
Personalisation may involve evaluating identifiers, reading activity or interactions to infer interests or preferences. This can constitute profiling even where it does not produce a legally significant decision. Where profiling is used, its purpose, relevant information, lawful basis and available controls must be explained. Under Articles 22A to 22D UK GDPR, a significant decision is one producing a legal or similarly significant effect, and a decision is solely automated where there is no meaningful human involvement. The applicable safeguards include information about the decision, an opportunity to make representations, human intervention and a means of contesting it. Additional restrictions apply to decisions involving special category data, and significant solely automated decisions cannot rely wholly or partly on the recognised legitimate interests basis in Article 6(1)(ea).
Children and young people
Children’s personal data requires particular protection and information they can understand. Where an information society service is offered directly to a child and consent is the lawful basis, Article 8 UK GDPR generally permits a child aged 13 or over to give that consent. Below that age, consent must be given or authorised by a person with parental responsibility, with reasonable efforts to verify it. This is not a general minimum age for reading public news articles and does not determine contractual capacity. Where an online service is likely to be accessed by children, the applicable requirements of Article 25 and the Age Appropriate Design Code must be considered, including children’s best interests, high privacy settings and protection against detrimental use of their information. Age assurance must itself be proportionate and minimise personal data collection.
Changes to this Privacy Policy
This Policy may be updated to reflect changes in the services, processing practices or applicable law. Material changes must be communicated appropriately. Before personal data is used for a new purpose, the required information must be provided and any necessary consent obtained. A revised notice cannot retrospectively authorise unlawful processing. Silence, continued browsing or failure to object within a stated period does not constitute consent to new processing. Consent already given may be withdrawn at any time.
Contact:
"NOTTINGHAM GUARDIAN"
Email: [email protected]
© 2026 "NOTTINGHAM GUARDIAN" - All rights reserved, subject to statutory exceptions.
Last updated: 31 October 2026.