Privacy Policy – Our Media Policies

Last Updated: July 2026

Effective as at: 27^th July 2026

1. ABOUT US AND THIS PRIVACY POLICY

Our Media Limited (“we”, “us”, “our”) is a UK media and publishing company. This Privacy Policy explains what personal data we collect, how and why we use it, how we protect it, and your rights under applicable law. We are committed to handling your data lawfully, fairly, and transparently.

Data Controller: Our Media Limited, with its registered company number 05715415 and its registered address at: Eagle House, Colston Avenue, Bristol BS1 4ST, UK.

ICO Registration Number: Z9454757

Data Protection Officer (DPO): +44(0)117 927 9009 dataprotection@ourmedia.co.uk

If you have any questions or concerns about this Privacy Policy or our data handling practices, please contact our DPO in the first instance.

2. WHAT PERSONAL DATA WE COLLECT

Personal data is any information that identifies you. We may collect, use, store and transfer the following categories of personal data.

Identity and contact data – title, first name, last name, address, email address, telephone number and other relevant contact information;
Subscription and account data – information you provide when completing our forms, corresponding with us, registering on our website, placing orders, or entering into contracts with us. This includes subscription history, renewals, customer service correspondence, and payment details;
Technical data – IP address, browser type, device identifiers, operating system, pages visited, time spent, referral URLs, click-stream data, cookies and similar technologies, account login details, and saved preferences;
Competition, survey and event data – information provided when entering competitions or prize draws, completing surveys or research, submitting feedback, or registering for events, webinars or offers;
Marketing data – your marketing consent records and communication preferences; and
Financial and transaction data – payment card details, bank account information transaction history, and details of products or services you have purchased or enquired about.

Our services are not directed at children under the age of 18. If you are under 18, please do not provide us with your personal data without the consent of a parent or legal guardian. If we become aware that we have collected personal data from a child without appropriate parental consent, we will delete it promptly.

We also collect and use aggregated statistical or demographic data that does not identify you. We do not collect or process special category personal data. If you voluntarily include such data in a free-text response or communication, we will use it only to address your immediate query, and delete or redact it promptly once that purpose is fulfilled. We do not use special category data for any secondary purpose.

3. HOW IS YOUR PERSONAL DATA COLLECTED

We collect your personal data in the following ways.

Direct interactions – you provide data when you complete forms, subscribe, place orders, or contact us by post, phone, email or otherwise;

Third parties and public sources – we may receive personal data from analytics and search providers (e.g., Google), technical, payment and delivery service providers, and publicly available UK sources such as Companies House.

For more information about the cookies we use and how to change your cookie preferences, please see our Cookies Policy – Our Media Policies.

4. WHY WE USE YOUR PERSONAL DATA

Under the UK GDPR and applicable data protection legislation, we must have a lawful basis for each purpose for which we collect and use your personal data. We rely on one or more of the following legal bases.

Performance of a contract – where processing is necessary to enter into or perform a contract with you (e.g., providing subscriptions or services);
Legitimate interests – where processing is necessary for our legitimate interests, such as improving our services, preventing fraud, and ensuring security. We balance our interests against your rights and do not process your data where the potential impact on you and your rights override our legitimate interests (unless we have your consent or are otherwise permitted or required under law);
Legal Obligations – where processing is necessary to comply with a legal or regulatory requirement; and
Consent – where you have given clear, informed and free consent for a specific purpose (e.g., receiving marketing emails). You can withdraw your consent at any time by contacting us, updating your account settings, or adjusting your cookie preferences. You can also opt out of marketing in every communication we send. We will act on your request as soon as reasonably practicable and within one month.

5. PURPOSES FOR USING YOUR PERSONAL DATA AND DATA RETENTION

We use your personal data only for the purposes described in this Privacy Policy and rely on the relevant lawful bases set out in section 4 for each type of processing.

We retain personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to meet legal, regulatory, tax, accounting, or reporting requirements.

We may retain data for longer where necessary to deal with complaints or where we reasonably anticipate litigation. When determining retention periods, we consider the nature, sensitivity and volume of the data, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, and applicable legal and regulatory requirements.

PURPOSE/USE	TYPE OF DATA	LEGAL BASIS	RETENTION PERIOD
To register you as a new or prospective customer or supplier, and to manage your account	Identity and contact data	Performance of a contract with you	Duration of the customer or supplier relationship, plus 6 years from termination
To process and deliver your order, manage payments, fees and charges, and recover money owed to us	Identity and contact data Financial and transaction data	Performance of a contract Legitimate interests (debt recovery)	6 years from the date of transaction or end of the relationship (whichever is later)
To introduce you to regulated financial products offered by FCA-authorized providers	Identity and contact data	Performance of a contract with you Legitimate interests (facilitating introductions)	6 years from the date of introduction
To manage our relationship with you, including notifying you about changes to our terms or this Privacy Policy, and handling your requests, complaints and queries	Identity and contact data Subscription and account data Request, complaint and query call recordings	Performance of a contract with you Legal obligation Legitimate interests (improving customer service)	6 years from resolution (12 weeks in the case of call recordings)
To send you marketing communications where you have consented, and to maintain records of your marketing preferences	Identity and contact data Marketing data	Consent (for direct marketing) Legitimate interests	For as long as you remain an active contact or until you withdraw consent or object (whichever is the earlier) Consent records are retained for 3 years after the end of the marketing relationship
To administer and protect our business and websites (e.g., troubleshooting, data analysis, testing, system maintenance, fraud prevention, and IT security)	Identity and contact data Technical data	Legitimate interests (IT administration, network security, fraud prevention) Legal obligation	6 years
To comply with our financial, tax and accounting obligations	Identity and contact data Financial and transaction data	Legal obligation	6 years from the end of the relevant financial year
To deliver website content and measure the effectiveness of advertisements to you (where you have consented)	Technical data	Consent	3 months from collection, or until consent is withdrawn
To use aggregated analytics to improve our website, products and services	Technical Data	Legitimate interests (improving our services and understanding user behavior)	13 months from collection
To administer competitions, prize draws, surveys and events	Identity and contact data Competition, survey and event data	Performance of a contract with you (competition entry) Consent (where applicable)	Duration of the competition/event plus 12 months

6. WHO WE SHARE YOUR PERSONAL DATA WITH

We do not sell your personal data and we do not share your personal data with affiliates. We share your personal data only where necessary and for the purposes described in this Privacy Policy. We may share your personal data with:

Our employees and workers who need access for the relevant business purpose;
Service providers who support our operations, including e-commerce platforms, payment processors (Stripe), hosting and cloud hosting providers (e.g., Vercel, AWS), subscription and order management providers (e.g., DSB.net, Darwin CX), identity and access management providers (e.g., Cognito), CRM systems, IT and database providers, postage and courier services, debt collection agencies, email marketing providers (e.g., Adestra), survey and research platforms (e.g., QuestionPro), event and webinar providers (e.g., Bigmarket), embedded content providers (e.g., YouTube API, JW Player), and auditors where required;
Meta, where we use embedded social media tools such as social plug-ins or the Meta Pixel. For these tools, Meta and Our Media act as joint controllers, and our respective responsibilities are set out in Meta’s Controller Addendum, available at: Facebook;
Third parties where we sell, transfer or merge parts of our business or assets. Any new owner may use your personal data in line with this Privacy Policy; and
Regulators or authorities where required to comply with legal or regulatory obligations.

We require all third parties to protect your personal data, process it only for specified purposes, and act in accordance with applicable law and in accordance with our instructions.

7. INTERNATIONAL DATA TRANSFERS

Some of our service providers are based outside the United Kingdom. Where we transfer your

personal data to a country outside the UK, we do so only where one of the following safeguards

applies:

The country has been granted adequacy regulations by the UK Secretary of State;
We have put in place a UK International Data Transfers Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
Another lawful transfer mechanism applies.

You can request details of the safeguards in place for any specific transfer by contacting our DPO.

8. ARTIFICIAL INTELLIGENCE (AI) AND AUTOMATED TOOLS

We may use artificial intelligence (AI) and automated tools to support our operations, including to improve our services, personalize content, detect fraud and security threats, and support customer service functions. Any such use is carried out in accordance with applicable data protection law and on a lawful basis as described in this Privacy Policy.

Where AI tools process your personal data, we take steps to ensure that processing is fair, transparent and proportionate. In some cases, we may use automated processing to make decisions that affect you. Where a decision is based solely on automated processing and process a legal or similarly significant effect on you, you have the right to request human review of that decision. We will tell you when such a decision has been made and explain the basis on which it was reached. To exercise this right, please contact our DPO using the details in section 1.

We do not use your personal data to train external AI models, and we take appropriate steps to ensure that any third-party AI tools we use process your data only in accordance with our instructions and applicable law.

9. DATA SECURITY

We are committed to protecting your personal data and take appropriate technical and organizational measures to protect your personal data from accidental loss, unauthorized access, use, alteration or disclosure. Access is limited to employees, agents, contractors and third parties who have a business need to know and who process your data only on our instructions and under a duty of confidentiality.

We have procedures in place to respond to suspected personal data breaches and will notify you and any applicable regulator where we are legally required to do so. While we use robust safeguards, please note that no internet transmission is completely secure.

10. YOUR LEGAL RIGHTS

Under UK GDPR (as amended), you have the following rights in relation to your personal data.

Right of access – you may request a copy of the personal data we hold about you and confirm that we are processing it lawfully. We will carry out a reasonable and proportionate search and respond within one month (extendable by up to two months for complex or multiple requests);
Right to rectification – you may ask us to correct inaccurate or incomplete data;
Right to erasure – you may request deletion of your personal data where there is no lawful reason for us to continue processing it;
Right to object – you may object to the processing of your personal data where we rely on legitimate interests. You also have an unconditional right to object at any time to the processing of your personal data for direct marketing purposes. To object to direct marketing purposes, please contact us, update your account settings, or adjust your cookie preferences. You can also object to marketing in every communication we send. We will act on your request as soon as reasonably practicable and within one month;
Right to data portability – where we process your personal data by automated means on the basis of consent or contract, you may request we provide it to you or a third party in a structured and machine-readable format;
Right to restrict processing – you may ask us to suspend processing in certain circumstances, including where you contest its accuracy or object to processing; and
Rights relating to automated decision-making – where a solely automated decision has a legal or similarly significant effect on you, you may request human review, challenge the decision, and obtain an explanation of the logic involved.

To exercise any of these rights, please contact us as detailed in section 1. We will respond within one month. Occasionally it could take us longer where your request is complex or you have made a number of requests. In this case, we will notify you and keep you updated. We may need to verify your identity before processing your request.

There is no fee for exercising your rights, although we may charge a reasonable fee for unfounded, repetitive or excessive requests.

11. MAKING A DATA PROTECTION COMPLAINT

If you have any questions about this Privacy Policy, our use of your personal data, or wish to exercise your rights, please contact us at:

Email address: dataprotection@ourmedia.co.uk
Telephone: +44 (0)117 927 9009
Postal address: Data Protection Officer, Our Media Limited, Eagle House, Colston Avenue, Bristol BS1 4ST, United Kingdom

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would appreciate the opportunity to address your concerns first, so please contact us in the first instance.

12. CHANGES TO THIS PRIVACY POLICY

We review and update this Privacy Policy regularly to reflect legal, regulatory or operational changes. The latest version and its effective date will always be shown at the top of this document.

Where we make material changes to this Privacy Policy, we will notify active subscribers by email and/or display a prominent notice on our website for at least 30 days. We encourage you to review this Privacy Policy periodically. This Privacy Policy is governed by the laws of England and Wales.

13. THIRD-PARTY LINKS

Our website may contain links to third-party websites, plug-ins, and applications. If you follow these links, third parties may collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any personal data.