Last updated: 07/9/26
Who is responsible for your information
Oxfordshire Guardian is operated by Finn Media, trading as Oxfordshire Guardian. We are the controller responsible for the personal information described in this policy.
Website: https://migration.oxfordshireguardian.co.uk/
Postal address: One St Aldate’s, Oxford, OX1 1DE
Privacy contact: new@oxfordshireguardian.co.uk
This policy explains how we use personal information when you visit our website, contact us, submit material, or appear in our reporting. We follow the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended.
We explain each use of information below. Where we rely on consent, we ask for a specific choice. Visiting the website or reading this policy does not give consent to optional tracking.
Information we collect and our reasons for using your data
Contact messages and submissions
When you email us or submit a website form, we receive the details you provide. These include your name, email address, message, attachments and any other contact details you choose to supply. Our email and website services also process technical information needed to deliver messages and detect abuse.
We use this information to answer messages, handle corrections and complaints, assess story suggestions, and manage relationships with readers, contributors and business contacts. Our lawful basis is legitimate interests: communicating with people who contact us and running our publication. For statutory privacy requests and complaints, we also process information to meet our legal obligations.
Providing contact information is voluntary. Without a reply address or sufficient detail, we will be unable to answer your message or investigate your request fully. Please include only information relevant to your message. Contacting us does not subscribe you to marketing emails.
Website operation and security
Our hosting and security services process information such as your IP address, browser and device details, requested pages, access times and error records. We use these records to deliver the website, investigate faults, detect spam and prevent unauthorised access. Our lawful basis is legitimate interests: maintaining a reliable and secure publication.
Authorised accounts
If you have an authorised website account, we process your account name, email address, profile details, authentication information and relevant activity records. We use these details to manage access, support publishing and protect the website. Our lawful basis is legitimate interests: administering contributor and administrator access. Public author names and biographies appear alongside published work where relevant.
Public comments are currently disabled. If we hold comments from before this change, the information includes the submitted comment, display name, contact details and associated moderation records. We use this information to maintain the discussion archive and address complaints, relying on legitimate interests. We review continued retention as described below.
Advertising and commercial correspondence
If you ask about advertising or work with us commercially, we process contact details, correspondence, order information and relevant billing records. We rely on contract where processing is necessary to enter into or perform a contract with you. For contacts acting on behalf of an organisation, we rely on legitimate interests in managing business relationships. We retain accounting information where required by law.
Cookies, analytics and advertising
Cookies and similar technologies store information on your device or access information from your device. We use these technologies for website functions, audience measurement and advertising, as described below.
Essential functions
We use necessary technologies to deliver requested functions, protect account sessions and remember privacy choices. Consent is not required where a technology meets a relevant legal exception. This does not permit use of the same information for unrelated advertising purposes.
Google Analytics
We use Google Analytics to understand website use, including page views, visit duration, referral sources and interactions with links. Depending on the settings and your choices, Google processes device and browser information, online identifiers and interaction records. IP information is processed to derive approximate location information.
Our chosen approach is to request consent before activating optional Google Analytics tracking. We use the resulting reports to assess readership and improve our website. Our lawful basis for the associated personal information is consent.
Google AdSense
We use Google AdSense to display advertisements. With your consent, Google and participating advertising partners use cookies, online identifiers, device information and browsing activity to select personalised adverts, measure performance and associate activity with interests or an existing profile. This includes profiling for advertising purposes.
Our lawful basis for personalised advertising and consent-based advertising measurement is consent. Choosing against personalised advertising does not necessarily remove every advert. We only enable advertising storage or access technologies with the consent required by law. An advert labelled non-personalised still requires consent if the delivery or measurement involves technologies subject to consent requirements.
Google explains its processing here:
https://policies.google.com/technologies/partner-sites
https://policies.google.com/privacy
Your choices
Use the Google popup to accept or reject optional purposes and review the partners involved. The same control lets you withdraw consent or change your choices later. Rejecting optional tracking does not prevent access to our articles. Some optional embedded features will remain unavailable until you enable the relevant service.
Withdrawing consent stops future processing based on your consent. Withdrawal does not affect processing lawfully carried out before your change. Browser settings also let you remove stored cookies, although removing essential cookies affects functions such as remaining signed in.
Our Cookie Policy lists the technologies in use, their providers, purposes and durations, together with the applicable consent choices. Cookie expiry and a provider’s retention of information already collected are separate matters.
Affiliate links and embedded content
Some articles contain affiliate links. A retailer or affiliate network pays us a commission when a qualifying purchase follows a link from our website. Affiliate partners process referral information and, depending on the programme, transaction or commission references to attribute purchases. We use referral and commission reports to administer these arrangements. Our lawful basis for business reporting and reconciliation is legitimate interests in accounting for referral income. Advertising-related tracking on your device requires consent.
Our affiliate partners include Awin, Amazon, CJ and Webgains. Their notices explain the information they receive when you follow their links or shop with them.
Articles sometimes include videos, social posts, maps or other content supplied by another organisation. Loading embedded content sends information, such as your IP address, browser details and the page visited, to the provider. The provider also processes interactions and, depending on your settings, associates activity with an account you hold with them.
Our consent controls block embedded technologies requiring consent until you agree to the relevant service. Providers and their privacy information are identified in our Cookie Policy and privacy settings. External websites apply their own privacy policies when you visit them.
News reporting and photographs
We collect and use information to research, verify, produce and publish local journalism. Information includes names, professional roles, statements, photographs, recordings and details relevant to a story. Sources include the people concerned, contributors, interviews, press releases, public meetings, public records and publicly accessible websites or social media.
Our usual lawful basis is legitimate interests in responsible journalism, informing readers and maintaining an accurate publication archive. We consider the public interest, relevance and the effect on the people involved. Published material is available worldwide and other websites or search engines sometimes reproduce or index public content.
Where reporting involves sensitive information or criminal allegations, we assess the additional legal conditions and protections required. We apply the journalism exemption only where processing supports intended publication, we reasonably believe publication serves the public interest, and compliance with a particular requirement would be incompatible with journalism. We assess and record the reasons in each case. This is not a general exemption for everything we do.
If you submit images, remove unnecessary embedded location information before sending them. Tell us about any confidentiality concern before sending sensitive material. Contact our privacy address to raise concerns about information relating to you in an article or image.
Who receives information
Our authorised staff, editors and contributors receive information needed for their roles. External recipients include website hosting, technical support, security, backup and email providers. They support delivery of the website, storage of correspondence and protection of our systems.
Our principal operational providers are Siteground and Cloudflare. Google, advertising partners, affiliate networks and embedded-content providers receive information as explained above.
We use contracts with providers who process personal information on our behalf. Other organisations, including some advertising and affiliate partners, determine purposes of their own and act as separate controllers. Their privacy notices explain those purposes and how to exercise rights directly with them. Ask us about the relevant recipient if you need help identifying the organisation involved.
We also disclose relevant information to professional advisers, insurers, courts, regulators or law enforcement where necessary to meet legal duties, obtain advice or establish, exercise or defend legal claims. We rely on legal obligation or legitimate interests in protecting legal rights, according to the circumstances.
International processing
Some providers process personal information outside the UK.
For a restricted transfer, we rely on applicable UK adequacy regulations or an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses. Where required, we assess whether the protection after transfer meets the legal standard. The arrangements listed above identify the mechanism used in practice.
Contact new@oxfordshireguardian.co.uk for further details or a copy of relevant safeguards, subject to appropriate redaction of confidential information.
How long we keep information
We retain personal information for the purpose for which we collected the information and for relevant legal requirements. We use the following periods or decision criteria.
General correspondence and unsuccessful story submissions: [INSERT PERIOD] after the last substantive exchange, unless the material becomes part of an editorial record, complaint or legal matter.
Server and security logs: 30 days. We retain records linked to a specific incident until investigation and any related legal or regulatory action have ended.
Google Analytics: 30 days. Truly anonymous aggregate reports are retained for readership comparisons.
Consent records: 30 days to remember choices and demonstrate how consent was obtained or withdrawn.
Account records: for the duration of authorised access, followed by [INSERT DELETION PERIOD]. Published bylines and information needed for article history are assessed separately as editorial records.
Commercial and accounting records: for the relevant relationship and the statutory recordkeeping period applicable to each record. Information needed for unresolved disputes or legal claims is retained until the matter ends and the relevant retention requirement expires.
Editorial material, published articles and legacy comments: for as long as continued retention serves a documented editorial, archival or legal purpose. Published articles form part of our continuing news archive. We assess accuracy, relevance, privacy concerns and requests for correction or removal. Unpublished material and confidential source records receive separate retention assessments.
Privacy requests and complaints: 30 days after closure, to demonstrate our response and handle follow-up issues.
Backups: deleted information expires through our backup cycle within 30 days. Backup copies are restricted to recovery purposes. If we restore a backup, we reapply relevant deletion decisions.
Where information is no longer needed, we delete or anonymise the information securely. Where a partner acts as an independent controller, its own notice explains its retention periods.
Security
We use proportionate technical and organisational safeguards to protect personal information against unauthorised access, alteration, loss and disclosure. Our measures include limited staff access and 2fa on accounts. Access is limited to people who need the information for their work.
We investigate suspected personal data breaches, take steps to contain harm, and notify the regulator and affected people when legally required.
Children’s information
Children sometimes appear in local news and community coverage. We consider their privacy, safety and interests when collecting or publishing information. A child, parent or guardian should contact our privacy address with concerns about a child’s information. We assess each request, including the child’s understanding and any representative’s authority.
Your rights
Depending on the processing and applicable legal conditions, you have rights to receive information about our use of your data, request access and a copy, correct inaccurate information, request deletion, or restrict processing. For information you provided which we process automatically on the basis of consent or contract, the right to data portability also applies where its conditions are met.
Where we rely on consent, you are entitled to withdraw consent at any time using the relevant privacy control or by contacting us.
Your right to object
You have the right to object to processing based on legitimate interests for reasons relating to your situation. We will stop unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or we need the information for legal claims.
Your right to object to direct marketing is absolute, including related profiling. We will stop using your personal information for those purposes following an objection.
Making a request
Contact new@oxfordshireguardian.co.uk or write to the address above. An account is not required to exercise your rights. We only request identity or authority evidence where reasonably necessary to protect your information.
We respond without undue delay, normally within one month. Where the law permits an extension of up to two further months for complexity or the number of requests, we explain the reason within the initial month. Necessary identity checks or legally permitted clarification affect the response timetable. Requests are normally free.
Some rights are subject to exemptions, including protections for freedom of expression and journalism. If we refuse all or part of a request, we explain the decision and your complaint rights to the extent permitted by law.
[CONFIRM BEFORE RETAINING: We do not make decisions about you based solely on automated processing which produce legal or similarly significant effects. Advertising profiling is described above.]
Privacy complaints
Send a privacy complaint to new@oxfordshireguardian.co.uk or write to our postal address. Please explain your concern and the outcome you seek. We acknowledge complaints within 30 days, investigate without undue delay, provide progress information where appropriate and explain the outcome and any action taken.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator:
https://ico.org.uk/make-a-complaint/
Changes to this policy
We review this policy when our practices or legal obligations change. We publish the revised wording and update the date above. Where a change materially affects how we use your information, we provide further information through an appropriate channel. We obtain fresh consent where required before starting a new consent-based use.
