Privacy Policy

Effective date: 06/09/26

This Privacy Policy explains how Sussex Guardian collects, uses, shares, stores and protects personal information in connection with:

• The Sussex Guardian website;
• Our journalism and editorial newsgathering;
• News tips, photographs, videos, press releases and other submissions;
• Accounts and website features;
• Advertising and commercial enquiries;
• Corrections, editorial complaints and data-protection requests; and
• Analytics, advertising and third-party content used on the Website.

In this policy, “Sussex Guardian”, “we”, “us” and “our” mean the person or organisation identified below. This policy is an information notice. It does not ask you to give blanket consent to all processing merely by using the Website. Where consent is legally required (for example, for non-essential advertising or analytics technologies) we ask for it separately.

1. Who we are

The Website is operated by:

• Legal name: Finn Digital Media LTD
• Trading name: Sussex Guardian
• Postal address: Hove Enterprise Centre Hove, East Sussex BN41 1UY
• Data-protection contact: [email protected]

The legal person named above is the controller of personal information processed for Sussex Guardian’s own purposes.

2. Who this policy applies to

This policy applies to people whose personal information we process, including:

• Website visitors;
• News sources and people who contact the newsroom;
• Contributors, photographers and people submitting material;
• People mentioned in, affected by or otherwise connected with our reporting;
• Account holders;
• Advertisers and commercial contacts;
• People making corrections, complaints or rights requests; and
• Representatives of businesses, public bodies, charities and community organisations.

3. Personal information we collect

The information we collect depends on how you interact with Sussex Guardian.

Information collected when you visit the Website

This may include:

• Your internet protocol address;
• The date and time of your visit;
• Pages, articles and files requested;
• Referring pages or search services;
• Browser, device and operating-system information;
• Approximate location derived from an internet protocol address;
• Website errors, security events and diagnostic information;
• Cookie identifiers and consent preferences; and
• Information about how you interact with the Website, where analytics consent has been given or a lawful analytics exception applies.

Information you provide when contacting us

This may include:

• Your name;
• Email address;
• Telephone number;
• Organisation, role or job title;
• The contents of your message;
• News tips, statements, press releases and correspondence;
• Photographs, videos, audio files or documents;
• Dates, locations and details of events;
• Information about other people contained in your submission; and
• Any confidentiality request or publication restriction you bring to our attention.

Messages may be retained in our email systems, Website systems, working files and backups.

Editorial and journalistic information

In the course of researching and reporting news, we may process:

• Names, photographs, contact details and professional information;
• Statements, interviews and quotations;
• Publicly available social-media posts;
• Information from official records, meetings and documents;
• Information supplied by councils, emergency services, courts, public bodies, businesses, charities and community organisations;
• Information supplied by witnesses, sources and other contributors;
• Allegations, opinions and claims that require verification;
• Audio or video recordings;
• Information relevant to obtaining a response or right of reply; and
• Sensitive information where it is relevant and lawful to report.

We may obtain this information directly from the person concerned or from public records, official sources, witnesses, contributors, news agencies, other publications and publicly accessible online sources.

Accounts and login information

Where account or login facilities are available, we may collect:

• Your username;
• Name and email address;
• Account and profile information;
• Login, authentication and security records;
• Website preferences; and
• Information about changes made through your account.

Advertising and commercial information

If you contact us about advertising, sponsorship or another commercial service, we may process:

• Your name and business contact details;
• The organisation you represent;
• Campaign requirements and correspondence;
• Contracts, booking records and invoices;
• Payment and accounting information; and
• Records necessary to administer the commercial relationship.

Complaints and rights requests

If you make a correction request, editorial complaint, copyright complaint or data-protection complaint, we may collect:

• Your identity and contact details;
• The article, image or processing activity concerned;
• Your complaint and requested outcome;
• Supporting correspondence, documents and evidence;
• Our investigation notes and decision; and
• Information necessary to confirm your identity where appropriate.

We will not normally request more information than is reasonably necessary to investigate the matter.

Photographs and media metadata

Digital photographs and videos may contain metadata, including the device used, the date and time of creation and geographical coordinates. You should remove hidden location data before sending material if revealing the location could put you or another person at risk. Where appropriate, we will avoid publishing unnecessary hidden location metadata.

4. Why we use personal information and our lawful bases

We process personal information only where we have a lawful basis or where an applicable journalistic exemption permits the processing.

Where we rely on legitimate interests, those interests may include:

• Operating and securing the Website;
• Communicating with readers, sources and organisations;
• Investigating matters of public interest;
• Producing accurate and responsible local journalism;
• Maintaining an editorial archive;
• Managing complaints and correcting errors;
• Protecting our legal rights; and
• Operating a sustainable independent publication.

We consider whether those interests are proportionate and whether they are overridden by the rights and interests of the people concerned. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

5. Journalism and the public-interest exemption

UK data-protection law recognises that some personal-information processing undertaken for journalism may qualify for the special purposes exemption. We do not treat journalism as a blanket exemption from data-protection law. We consider its application case by case. The exemption may apply only to the extent that:

• The processing is carried out with a view to publishing journalistic material;
• We reasonably believe that publication would be in the public interest; and
• We reasonably believe that complying with a particular data-protection provision would be incompatible with the journalistic purpose.

In reaching that decision, we may consider freedom of expression, the public interest in the particular story, the potential harm to individuals and relevant professional standards, including the Editors’ Code of Practice. Even where the journalism exemption applies, data-security and accountability responsibilities remain. Sussex Guardian should be able to record and explain why an exemption was considered necessary in a particular case. The exemption may affect the extent to which some rights described later in this policy apply to unpublished research, source material or published journalism.

6. Sensitive and criminal-offence information

Editorial material may sometimes include information about:

• Health;
• Racial or ethnic origin;
• Religious or philosophical beliefs;
• Political opinions;
• Trade-union membership;
• Sexual orientation or sex life;
• Genetic or biometric information; or
• Criminal allegations, investigations, convictions or offences.

We process this information only where it is relevant, necessary and lawful. Depending on the circumstances, we may rely on an applicable UK GDPR condition, another statutory condition or the journalism exemption described above. The fact that sensitive information has appeared on social media or elsewhere online does not automatically mean that Sussex Guardian will republish it.

7. Cookies and similar technologies

The Website may use cookies, local storage, pixels, tags and comparable technologies.

Strictly necessary technologies

These may be used without consent where they are essential to:

• Deliver a service you request;
• Maintain Website and account security;
• Keep you signed in;
• Remember privacy choices;
• Balance Website traffic; or
• Prevent fraud and abuse.

Analytics

Subject to your choices, we may use Google Analytics 4 in the future to understand matters such as:

• The number of visits to the Website;
• Which pages and articles are read;
• How visitors arrive at the Website;
• Browser and device categories;
• Broad geographical information;
• Time spent on pages; and
• Website performance and errors.

Google states that Google Analytics does not log or store individual internet protocol addresses from UK users, although an address may be used briefly to derive coarse geographical information before it is discarded. Google Analytics may still process other event, device and online-identifier information.

Advertising

Subject to your choices, we use Google AdSense to display and measure advertising. Google may receive information including the page address, internet protocol address, browser or device information and advertising identifiers. Depending on the choices and settings involved, Google may use information to deliver services, measure advertising, prevent fraud and personalise content or advertising. Online-advertising technologies are not “strictly necessary” merely because advertising helps fund the Website. Advertising-related storage and access (including ad measurement, performance reporting and frequency capping) requires consent under current ICO guidance.

8. Embedded content and third-party services

Articles and pages may contain content supplied by third parties, including:

• Google Maps;
• YouTube videos;
• Social-media posts;
• Audio players;
• Event or ticketing services; and
• Other interactive services.

Loading or activating this content may allow the third party to receive information such as your internet protocol address, the page you are visiting, your browser or device information and your interaction with the content. Where appropriate, we use privacy-enhanced modes, consent controls or click-to-load placeholders so that third-party technologies do not activate immediately when a page opens. ICO guidance recommends preventing embedded content from setting technologies automatically and providing clear information before the visitor activates it. Third-party services operate under their own privacy policies and controls.

9. Affiliate links

Some articles may contain clearly identified affiliate links. If you follow an affiliate link and make a purchase, Sussex Guardian may receive a commission from the retailer or affiliate network. This does not increase the price you pay unless expressly stated otherwise. The retailer or network may process information about your visit or purchase under its own privacy policy. Where an affiliate technology stores or accesses information on your device through our Website, it will be treated as an optional advertising technology and activated only with the required consent. We may receive conversion or commission information from an affiliate network. Unless specifically disclosed, we do not receive your complete payment-card information from the retailer. Affiliate relationships do not determine our independent editorial conclusions. Commercial or affiliate content will be identified where required.

10. Who we share personal information with

Depending on the circumstances, we may share information with:

• Sussex Guardian editors, journalists and authorised contributors;
• Website-hosting, content-management, email, backup, security and technical-support providers;
• Analytics, advertising and consent-management providers where permitted by your choices;
• Professional advisers, including legal advisers and accountants;
• Contractors providing services on our behalf;
• Public authorities, regulators, police, courts or other bodies where disclosure is required or lawfully justified;
• People or organisations contacted for verification, comment or a right of reply;
• A purchaser, successor or restructuring party if the Website or operating business is sold or reorganised; and
• The public, where information is lawfully included in published journalism.

Where we contact somebody for comment, we disclose only the information reasonably necessary to allow them to understand and respond to the matter. In some circumstances, the nature of the questions may allow them to infer the identity of a source. We consider source protection and potential harm before making such contact. Service providers acting as processors are required, where applicable, to use personal information only under our instructions and to protect it appropriately. We do not sell news tips, source identities, editorial submissions or readers’ contact details to advertisers or data brokers.

11. International transfers

Some service providers may process or store personal information outside the United Kingdom. Where UK data-protection rules on international transfers apply, we use an appropriate legal mechanism, which may include:

• UK adequacy regulations;
• The United Kingdom International Data Transfer Agreement;
• The United Kingdom Addendum to approved contractual clauses; or
• Another transfer mechanism permitted by law.

We also consider the nature of the information, the destination, the recipient and any supplementary security measures that may be appropriate. You may contact us for further information about the safeguards relevant to your information, although some contractual or security details may need to remain confidential.

12. How long we retain information

We keep information only for as long as reasonably necessary for the relevant purpose, taking account of editorial value, legal obligations, security, public interest, potential disputes and the rights of affected people.

Backups may retain deleted information for a limited additional period before being overwritten. Information held in backups will not normally be restored except for disaster recovery, security or legal reasons.

13. Published information and news archives

Information included in a published article becomes publicly accessible. It may be:

• Indexed by search engines;
• Shared on social media;
• Quoted by other publications;
• Stored in web caches or archives; and
• Copied by third parties outside our control.

Removing or amending the original Sussex Guardian article may not remove copies held by other organisations. The news archive is an important record of events. A request involving an archived article will therefore be assessed by considering accuracy, continuing relevance, public interest, freedom of expression, potential harm and applicable data-protection or media-law obligations. Where appropriate, a matter may be addressed through a correction, clarification, update, annotation, search-indexing measure or removal. Erasure is not automatic in every case.

14. Confidential sources and sensitive submissions

Sending information to Sussex Guardian does not automatically create a confidential-source agreement. If confidentiality, anonymity or an embargo is important, tell us before sending sensitive material and ask the newsroom to confirm how the information can be handled. Please do not send highly sensitive documents through ordinary email before discussing an appropriate transmission method with us. Where we agree to protect a source, we take reasonable steps to restrict access to identifying information. However, confidentiality can be affected by matters outside our control, including:

• Information already known to other parties;
• The content or metadata of the material supplied;
• Cybersecurity incidents;
• Court orders or other legally enforceable requirements; and
• Circumstances involving an immediate and serious risk of harm.

We will not disclose a confidential source merely because another party requests the information. Any proposed disclosure will be assessed against the agreement, the law, source protection and the public interest.

15. Children

Sussex Guardian reports on schools, families, young people and other matters affecting children. Where we process information about a child, we consider:

• The child’s age and understanding;
• Privacy and safeguarding;
• The child’s best interests;
• The sensitivity and long-term effect of publication;
• The role and authority of a parent or guardian;
• Whether identifying the child is necessary; and
• Relevant legal and professional standards.

Website accounts and other data-collection features should not be directed at children without appropriate safeguards and age-appropriate information. A parent or guardian may contact us about information concerning a child. The child’s own views and rights may also be relevant, depending on their age and understanding.

16. How we protect information

We use proportionate technical and organisational measures intended to protect personal information, which may include:

• Encrypted Website connections;
• Access restrictions;
• Account and password controls;
• Software updates and security monitoring;
• Backups and recovery controls;
• Processor and supplier due diligence;
• Staff and contributor guidance;
• Data-minimisation procedures; and
• Incident and breach-response arrangements.

No internet transmission, email system or storage service can be guaranteed completely secure. We therefore review risks and adjust safeguards according to the sensitivity of the information concerned. Where a personal-data breach creates a reportable risk, we will follow the applicable notification requirements.

17. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask whether we process your personal information;
• Obtain a copy of personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to erase information;
• Ask us to restrict how information is used;
• Object to processing based on legitimate interests;
• Receive certain information in a portable format;
• Withdraw consent;
• Object to direct marketing; and
• Complain about how your information has been handled.

These rights are not absolute. Their application may depend on:

• The purpose and lawful basis for processing;
• The rights and safety of other people;
• Freedom of expression;
• Legal claims and obligations;
• Confidential source protection; and
• Whether a journalistic or other statutory exemption applies.

To exercise a right, email [email protected] with “Data protection request” in the subject line. Please describe the information or processing concerned. We may request proportionate evidence of identity where necessary to prevent unauthorised disclosure. We will respond within the period required by applicable law. Cookie consent can be changed using the Website’s Privacy settings or Cookie settings control.

18. Data-protection complaints

A data-protection complaint concerns the way Sussex Guardian has collected, used, disclosed, retained, secured or otherwise handled personal information. To make a complaint, email [email protected] with “Data protection complaint” in the subject line. Please include:

• Your name and contact details;
• A description of the processing or information concerned;
• Relevant dates, pages or correspondence;
• Why you believe the handling was inappropriate; and
• The outcome you are seeking.

You do not need to use legal terminology. We will:

• Provide a way for you to submit the complaint;
• Acknowledge receipt promptly and no later than 30 days after receiving it;
• Make appropriate enquiries;
• Keep you reasonably informed;
• Respond and communicate the outcome without undue delay; and
• Explain any further review or complaint route available.

These obligations apply to data-protection complaints separately from our editorial complaints process. If you are dissatisfied with our response, you may raise the matter with the Information Commissioner’s Office. The ICO recommends normally giving the organisation an opportunity to address the concern first.

19. Automated processing and profiling

Sussex Guardian does not currently make decisions about people that produce legal or similarly significant effects solely through automated processing. Advertising providers may undertake profiling or ad personalisation where consent has been given. That activity does not determine Sussex Guardian’s editorial decisions. Where automated tools assist with security, spam filtering, transcription, search, administration or moderation, responsibility for substantive editorial decisions remains with a person. If our use of automated processing changes materially, we will update this policy before beginning the new processing and provide any additional information required by law.

20. Changes to this policy

We review this policy when our services, technology, suppliers or legal obligations change. The date at the top of the page shows when it was last updated. Where we propose a new or materially different use of personal information, we will update the relevant information and bring the change to people’s attention before beginning the new processing where required. Continued use of the Website will not be treated as consent where the law requires a separate, affirmative choice.

21. Contact us

Questions, rights requests and data-protection complaints may be sent to [email protected]

Editorial news tips should be sent to [email protected].

Press releases should be sent to [email protected].