Last updated: 15/09/2026
1. Who we are
Just The Facts is an independent publication operated by James Murray-Hodcroft in the United Kingdom at justthefacts.org.uk. It is the successor to The Hodlines.
James Murray-Hodcroft is the data controller: the person responsible for deciding how and why personal information is used for the activities described here. “We”, “us” and “our” mean James operating Just The Facts.
For privacy enquiries, requests or complaints, email james@justthefacts.org.uk. You may use “Privacy enquiry” as the subject, although this is not required.
This policy covers our website, reader comments, correspondence, reporting and associated records, including relevant material retained from The Hodlines. It does not govern Newcastle University research, which requires its own applicable privacy information.
2. Information we collect
The information we hold depends on how you interact with us and whether you feature in our journalism. It can include:
- Contact information: names, email addresses, telephone numbers, roles and organisations supplied in correspondence.
- Messages and submissions: enquiries, tips, corrections, complaints, responses to questions, attachments and relevant correspondence history.
- Comments: the details entered in the comment form, comment text, submission time and associated technical information such as an IP address and browser details.
- Reporting material: interview notes, audio/video recordings, photographs, documents, screenshots, statements, source contact details and records of verification or editorial decisions.
- Website technical information: IP addresses, requested pages, request times, browser/device information and diagnostic or security records generated when the website is used.
Reporting material may include sensitive information, such as health, ethnicity, religion, political opinions or sexual orientation, and information about alleged offences, convictions or legal proceedings. Its inclusion in a submission does not mean that it will be published.
We obtain information directly from people who contact us and from sources including interviewees, witnesses, other journalists, public records, court material where lawfully accessible, organisations, websites and social media. We assess relevance, provenance and accuracy rather than treating allegations as established facts.
3. Why we use information and our lawful bases
We use personal information under the UK GDPR and Data Protection Act 2018, as amended, and comply with applicable rules on cookies and electronic communications.
| Purpose | Usual lawful basis |
|---|---|
| Answering enquiries, considering tips and handling editorial correspondence | Legitimate interests in communicating with readers and carrying out responsible journalism |
| Researching, verifying, producing and maintaining public-interest reporting | Legitimate interests in journalism, public accountability and freedom of expression, subject to the safeguards in section 6 |
| Publishing and moderating reader comments | Legitimate interests in facilitating discussion and protecting readers from misuse |
| Running, securing and troubleshooting the website and associated records | Legitimate interests in operating a reliable publication and preventing abuse |
| Handling privacy requests and meeting applicable legal duties | Compliance with legal obligations |
| Establishing, exercising or defending legal claims | Legitimate interests in protecting legal rights, with any additional sensitive-data condition required |
| An optional activity for which we specifically request consent | Consent for that identified activity |
When relying on legitimate interests, we consider whether the use is necessary and proportionate and balance it against the interests, rights and reasonable expectations of those affected. Visiting the website or sending an email does not amount to blanket consent to every possible use of information.
For special-category or criminal-offence information, an ordinary lawful basis alone is not enough. We identify an applicable additional legal condition or assess whether a relevant journalism exemption applies. Where appropriate, this can include explicit consent, a legal-claims condition or a specific statutory public-interest condition whose requirements are satisfied.
You are not normally legally required to contact us or supply information. However, without sufficient details we may be unable to answer, verify a submission or act on a request. Required website fields are identified on the relevant form.
We do not use your information to make solely automated decisions that produce legal or similarly significant effects on you. Automated technical filtering, where enabled, is described with the relevant website services.
4. Contact forms and reader comments
We use Contact Form 7 to receive website messages and Zoho Mail to handle email. We use the details you submit to consider and respond to your message and, where relevant, for the reporting purposes explained here. Messages may form part of our correspondence or investigation records.
Contact Form 7 is configured to transmit form submissions as email. At the date of this policy, no separate form-database or mail-logging plugin is installed. Form submissions are therefore retained in the relevant Zoho mailbox and any associated email backups rather than intentionally saved as a separate searchable archive in WordPress.
Comments are intended for public discussion. When published, your comment and public display name will be visible to other readers; a website link you provide may also be displayed. We do not intentionally publish your email address or IP address as part of a comment. Anything you put in the comment text itself may become public.
Please do not post confidential documents, private contact details or unnecessary sensitive information about yourself or others. Contact us privately about sensitive reporting material. Published comments may be copied or indexed by third parties, so removal from our website cannot guarantee removal of every external copy.
5. Sources, interviews and recordings
We use tips and interview material to assess possible stories, verify claims, seek responses and prepare accurate reporting. Contacting us does not guarantee publication. Sharing information also does not automatically establish agreed anonymity, an off-the-record arrangement or permission to publish every detail.
If confidentiality is important, tell us before sending sensitive documents so we can agree suitable communication and attribution arrangements. We take source protection seriously, but cannot promise that ordinary email or website forms are anonymous or immune from interception or disclosure.
We may record interviews or calls to preserve an accurate account, support verification and prepare reporting. Our normal approach is to explain that recording is taking place and its intended use. Any exceptional use of covert recording requires a separate assessment of legality, necessity, proportionality and public interest. This policy is not blanket consent to recording.
Before publishing identifying details or recordings, we consider the reporting purpose, agreed terms, potential harm and relevant legal and ethical obligations. Protecting source identities remains a distinct consideration when responding to requests for information or sharing material.
6. Journalism and the public interest
Data protection law recognises the importance of journalism and freedom of expression. Certain requirements may be disapplied under the journalism provisions of Schedule 2, Part 5 of the Data Protection Act 2018 where the legal conditions are met.
In particular, the processing must be carried out with a view to publication of journalistic material; we must reasonably believe publication would be in the public interest; and we must reasonably believe compliance with the particular requirement would be incompatible with journalism. We consider relevant public-interest factors and applicable editorial codes or guidance.
This is not a blanket exemption for the publication or its website. We assess it in relation to the information and requirement concerned. Where justified, it may affect what notice we provide or how we respond to a request, for example where disclosure would expose a confidential source or prejudice an investigation.
We assess corrections, objections and removal requests individually. Accurate, necessary public-interest reporting is not automatically removed solely because somebody objects to it.
7. Cookies and other website technologies
Cookies and similar technologies can store or access information on your device. At the date of this policy, we have not installed a separate analytics, behavioural-advertising or newsletter plugin.
If you choose the option to save your details when leaving a comment, WordPress may store comment-preference cookies containing the name, email address and website you entered. Their purpose is to save you re-entering those details on a later comment. These optional convenience cookies normally last for approximately one year. If you do not choose that option, those preference cookies should not be set.
WordPress and the hosting service may also use temporary or strictly necessary technologies for security, load balancing, authentication and administration. Public visitors who do not sign in should not receive administrator authentication cookies.
Where consent is legally required, the relevant technology must not operate before you give it. Where a statutory exception applies, its conditions must be met. Optional consent can be withdrawn through the relevant controls. You can also use browser settings to block or delete cookies, although some features may be affected. Browser settings do not replace any consent mechanism the site is required to provide.
An ordinary link to another website differs from content loaded from another provider inside our pages. External providers may receive technical information when their content loads. Any such active integrations must be identified in the information above.
8. Who receives information
We use service providers to operate the publication. Confirmed categories include website hosting, Zoho email, and cloud storage or shared folders. Information is also held on devices used for our work.
| Service | Provider and use |
|---|---|
| Website hosting | Fasthosts Internet Limited — WordPress website files, database, backups and relevant technical/security records. Fasthosts states that its hosting data centres are in Worcester and London in the UK. |
| Zoho Mail — messages, attachments and related email records | |
| Cloud storage/shared folders | [INSERT PROVIDER(S)] — stored or shared reporting and administrative material |
| Other active services | [INSERT RELEVANT BACKUP, SECURITY, FORM, SPAM OR MEDIA PROVIDERS; REMOVE IF NONE] |
WordPress and Contact Form 7 are software used on the site; using them does not by itself mean their developers receive the information you submit. The active Fasthosts/IONOS and Extendify plugins primarily provide hosting, onboarding and administrative functions. If any of those services are later configured to process visitor submissions or tracking data, this policy will be updated to describe that use.
Where necessary for a particular matter, information may also be shared with authorised reporting collaborators, a commissioning publisher or broadcaster, professional advisers, or an authority where there is a lawful and justified basis. A request from an authority does not automatically entitle it to confidential material. We consider necessity, legal obligations and source protection before responding.
An organisation receiving information for its own editorial or legal purposes may act as a separate controller. Technical providers acting on our behalf are subject to appropriate data-processing arrangements. Access should be limited to what is needed for the relevant purpose.
Published reporting and comments are available to the public. We do not sell reader contact details or source information for marketing.
9. International processing
The website is hosted by Fasthosts, which states that it keeps hosting data in its UK data centres in Worcester and London. Connectivity, support, security providers or subprocessors may still involve access or processing elsewhere where permitted by the applicable service arrangements.
Email and cloud services may involve storage or authorised access outside the UK. The applicable arrangements depend on the provider, contracting entity and account configuration.
Where safeguards are required, we assess the transfer and use an appropriate lawful arrangement. You can ask us for further information or a copy of relevant safeguards, with confidential commercial or security details protected where appropriate.
10. How long information is kept
We retain information for as long as reasonably necessary for its purpose, considering its sensitivity, ongoing relevance and any legal obligations or disputes. We use these criteria:
| Information | Retention approach |
|---|---|
| Routine enquiries | Keep while dealing with the enquiry and for a proportionate follow-up period; remove when no longer needed for a continuing matter |
| Tips not pursued | Retain only while there is a credible reporting, verification or source-protection reason; remove unnecessary personal details when that reason ends |
| Investigation files and recordings | Review against continuing reporting needs, verification, source agreements, corrections, complaints and legal claims; retain relevant evidence while those needs continue |
| Published articles and supporting records | May remain as a long-term journalistic archive, subject to review of accuracy, necessity and privacy concerns |
| Comments and moderation records | Keep while relevant to the discussion or necessary for moderation, security or a dispute; reassess identifying information no longer needed |
| Privacy requests and complaints | Keep enough to handle the matter and demonstrate the response for a proportionate period afterwards |
| Technical logs and backups | Follow the verified service retention and backup cycles, subject to justified preservation for incidents or claims |
We review retained information and delete, anonymise or reduce it when the reason for keeping it ends. A legal dispute or preservation obligation may justify longer retention of relevant material. Deleted information may remain in protected backups until the normal overwrite or expiry cycle; it is not retained there for routine use.
11. Security
We use proportionate technical and organisational measures to protect personal information, including account and device protection, appropriate access permissions and careful handling of sensitive material. Shared-folder access is limited to people who need it for the relevant work and reviewed when that need changes.
No system offers absolute security. We assess suspected breaches and notify the regulator and affected people where legally required. If you believe information has been exposed or sent to the wrong person, please contact james@justthefacts.org.uk promptly.
12. Your rights
Depending on the circumstances, you may have rights to access your personal information, correct inaccuracies, request erasure or restriction, receive certain information in a portable format, and withdraw consent where consent is the basis used. Withdrawal does not invalidate processing that was lawful before withdrawal.
Your right to object: You may object to processing based on legitimate interests for reasons relating to your circumstances. We will assess the objection and stop unless a lawful justification permits continuation. Any objection to direct marketing must be honoured.
Email james@justthefacts.org.uk to exercise your rights. You do not need special wording. We may request proportionate identity information where needed to avoid disclosing information to the wrong person.
We normally respond to rights requests within one month, subject to lawful timing rules and extensions. We explain any applicable extension or refusal. Rights are not absolute: relevant exemptions, other people’s rights, legal claims and the journalism provisions may affect the response.
13. Privacy complaints
To complain about our use of your information, email james@justthefacts.org.uk with enough detail to identify the concern. “Privacy complaint” is a helpful subject line but is not required.
We acknowledge complaints within 30 days, investigate appropriately, keep you informed and provide an outcome without undue delay. This acknowledgement period is separate from the deadline for handling a rights request.
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator, through its complaints service. You do not have to accept our conclusion before approaching the ICO.
14. Children and vulnerable people
Our reporting may concern children or vulnerable people. We consider their interests, capacity, safety and the consequences of identification when collecting, using or publishing information. A parent or guardian’s involvement is considered where appropriate, taking account of the young person’s rights and safeguarding circumstances.
Please avoid putting sensitive information about children in public comments. Contact us privately if you have concerns about information we hold or have published.
15. Changes to services and this policy
We will update this policy when our practices or relevant requirements change and revise the date above. Where a change requires additional notice or fresh consent, updating this page alone will not replace that requirement.
If we introduce new services, such as a newsletter, analytics or donations, we will provide appropriate privacy information before they begin collecting information. We do not add people to a marketing mailing list merely because they contact us or leave a comment.