Last updated: 27 August 2026
Your privacy matters to me.
This notice explains what personal information I use, why I use it, where it may come from, who I may share it with, how long I may keep it and the rights you have.
I have tried to write it in ordinary English. If anything is unclear, you can contact me.
Who is responsible for your information?
I am Ryan Jarvis, an independent investigative journalist based in the United Kingdom.
I am the data controller for the personal information covered by this notice. This means I am responsible for deciding why and how that information is used.
I am registered with the Information Commissioner's Office.
Privacy contact: ryan@ryanjarvis.uk
I have not appointed a separate statutory Data Protection Officer. I am personally responsible for data protection matters relating to this journalism website and my journalistic work.
What does this notice cover?
This notice covers personal information I use in connection with:
- this website;
- correspondence sent to me as a journalist;
- newsletter subscriptions;
- story tips and journalistic sources;
- research and investigations;
- published journalism;
- contact with editors, publishers and journalistic collaborators;
- privacy and data protection requests or complaints.
I also undertake separate legal and advocacy work from time to time. That work is separate from my journalism and is not covered by this privacy notice.
Other websites and services, including Substack, may have their own privacy information covering the ways they use your information for their own purposes.
The short version
I do not sell your personal information.
I do not use your information to build advertising profiles.
I do not add advertising trackers to this website.
I try to collect as little personal information as I reasonably need.
The main website is hosted using ChatGPT Sites, provided by OpenAI.
Proton provides my email service. Email correspondence may therefore be processed through Proton's systems.
Messages between Proton Mail users can be automatically end to end encrypted. Messages received from other providers may not be end to end encrypted unless the sender uses OpenPGP or another supported encryption method.
The website publishes my public OpenPGP keys. Public encryption keys do not contain private encryption keys and are intended to be shared.
The newsletter is provided using Substack.
Sensitive source material is not collected through the website. Secure Tips currently operates through Proton Mail and OpenPGP encrypted email.
No digital service can promise absolute security or anonymity.
Information collected when you visit this website
You do not have to give me your name or contact details simply to read the website.
Like most web hosting services, the systems used to provide the website may automatically process some technical information. This can include:
- your IP address;
- browser and device information;
- pages or resources requested;
- date and time information;
- security and diagnostic information;
- cookies or similar technical information where these are needed to operate or protect the service.
OpenAI hosts the website and may process technical and usage information as necessary to host, maintain, secure and support it.
I do not use this information to try to identify ordinary readers of the website.
Cookies and similar technologies
I do not intentionally add advertising cookies, behavioural advertising, fingerprinting or cross-site tracking to this website.
The hosting platform may use cookies or similar technologies that are necessary to operate, secure or troubleshoot the website.
If I later introduce any non-essential cookies or tracking technologies that require consent under UK law, they will not be activated until the appropriate consent has been obtained.
If you follow a link to another service, such as Substack, that service may use its own cookies or similar technologies under its own policies.
More detail is available on the Cookies page.
If you contact me
If you email me or otherwise contact me as a journalist, I may receive information such as your:
- name;
- email address or other contact details;
- organisation or role, where relevant;
- message and anything you choose to include;
- date and time of correspondence;
- related correspondence or records.
I use this information to read and respond to your message, assess whether further contact is appropriate, keep necessary records and, where relevant, carry out journalistic work.
For ordinary enquiries, my usual legal basis is my legitimate interests in communicating with people about my journalism and running my professional work.
If your enquiry relates to a journalistic commission or another contract, I may also use information where necessary to take steps at your request before entering into a contract or to perform a contract.
I may also use information where necessary to comply with the law or establish, exercise or defend legal rights.
Newsletter subscriptions
My newsletter is provided through Substack. Subscriptions made through newsletter.ryanjarvis.uk are processed on Substack's systems.
This website does not embed a subscription form or maintain a separate newsletter subscriber database.
When you choose to subscribe, Substack may process information such as:
- your email address;
- your name or profile information if you provide it;
- your subscription status;
- when you subscribed or unsubscribed;
- records of your subscription choices;
- interaction information made available through Substack, where applicable.
I use your email address to send you the newsletter because you have chosen to subscribe.
The legal basis I use for sending newsletter emails to individual subscribers is consent.
You can withdraw that consent at any time by using the unsubscribe link in a newsletter or through your Substack settings.
Unsubscribing will not affect anything that was lawfully done before you withdrew your consent.
Substack generally processes subscriber information on behalf of publishers and may also process some information for its own platform purposes. Substack's own privacy information explains those activities.
I will not add somebody to the newsletter simply because they contacted me about a story, sent me a tip or corresponded with me for another reason.
Story tips and confidential sources
Journalism sometimes involves highly sensitive information.
If you contact me with a story tip, I may process:
- what you tell me;
- your identity, if you provide it;
- contact information, if you provide it;
- information about other people;
- documents or records you provide;
- information needed to assess, verify or investigate what you have told me.
Some information supplied for journalistic purposes may be particularly sensitive. It could include health information, political opinions, information about criminal allegations or convictions, or other private information.
You do not normally need to give me your name merely to provide a tip.
If you do not provide contact information, however, I may be unable to ask you questions or verify what you have told me.
I take source confidentiality seriously. I do not sell source information or use source contact details for marketing.
No journalist or digital system can promise that confidentiality or anonymity can never be overridden by law or defeated by circumstances outside their control.
The main ChatGPT Sites website is not intended to act as a repository for confidential source material.
The Secure Tips page explains the current Proton Mail and OpenPGP contact options before you send anything.
Information used for investigations and reporting
Journalism often requires information about people who have not contacted the journalist directly.
During research I may obtain personal information from sources including:
- people involved in or affected by a story;
- confidential and non-confidential sources;
- interviews;
- court records and proceedings;
- public authorities;
- freedom of information disclosures;
- public registers;
- official reports and datasets;
- documents supplied to me;
- publicly available websites;
- publicly available social media;
- published journalism;
- archives;
- companies and organisations;
- other journalists, researchers or publishers.
The information involved depends entirely on the investigation.
It can include names, professional roles, opinions, correspondence, public records, allegations, court information, criminal offence information, health information and other information relevant to the reporting.
I do not collect information merely because it exists. It should have a genuine connection with a legitimate journalistic purpose.
Data protection and journalism
UK data protection law recognises the importance of freedom of expression and journalism.
The Data Protection Act 2018 contains specific provisions for personal information processed for journalistic purposes.
These provisions are sometimes called the journalism exemption or special purposes exemption.
It is not a blanket exemption from data protection law.
I will only rely on it where the legal requirements are met. In broad terms, this means that:
I am processing information with a view to publishing journalistic material;
I reasonably believe publication would be in the public interest; and
I reasonably believe that complying with the particular data protection requirement would be incompatible with the journalistic purpose.
This must be considered in the circumstances of the particular case.
Where appropriate, I will also consider recognised editorial standards, including the Editors' Code of Practice and other relevant journalistic codes.
If I rely on a journalistic exemption, I should be able to explain and document why it was appropriate.
Data security and accountability remain important even when an exemption applies.
My legal basis for journalistic processing
Where the journalism exemption applies, some normal UK GDPR requirements, including some requirements concerning lawful bases and individual rights, may not apply to that particular processing.
Where the exemption does not apply, I will use an appropriate lawful basis under data protection law.
For journalistic research this will commonly be legitimate interests, including legitimate interests in journalism, freedom of expression, investigating matters of public interest, verifying information and publishing accurate reporting.
I balance those interests against the rights, freedoms and reasonable expectations of the people concerned.
Where particularly sensitive information or criminal offence information is processed and the journalism exemption does not apply, I will identify any additional legal condition required by the UK GDPR and Data Protection Act 2018 before carrying out the processing.
Information about children
This website is not designed specifically for children.
Journalistic reporting can sometimes concern children or young people.
Where that happens, I will take particular care with their privacy, safety, vulnerability and best interests and will consider applicable reporting restrictions, data protection requirements and journalistic standards.
Who may receive personal information?
I only share personal information where there is a reason to do so.
Depending on the circumstances, recipients may include:
OpenAI, which hosts this website through ChatGPT Sites.
Proton, which provides my email service.
Substack, where you choose to subscribe to the newsletter.
Editors, publishers or other journalists involved in a legitimate reporting project.
Professional advisers, including legal advisers, where advice is needed.
Courts, regulators, law enforcement bodies or other authorities where disclosure is required by law or is otherwise legally justified.
People or organisations approached for comment or right of reply, but only to the extent necessary and appropriate.
The public, where personal information forms part of journalism that is lawfully published.
Sharing information with an editor or publisher does not necessarily mean identifying a confidential source.
I do not disclose the identity of a confidential source merely because another person asks me to do so.
Information processed outside the United Kingdom
Some of the technology providers I use operate internationally.
This means that some personal information may be processed outside the United Kingdom.
ChatGPT Sites does not currently provide a UK data residency guarantee. OpenAI's applicable ChatGPT Sites data processing terms provide safeguards for transfers of UK personal data, including standard contractual clauses amended by the UK International Data Transfer Addendum where applicable.
Substack is based in the United States and may process subscriber information outside the UK. Substack provides contractual data transfer safeguards for publishers as described in its privacy and publisher documentation.
Proton is based in Switzerland and operates email infrastructure in Switzerland and other European locations.
Where UK law requires safeguards for an international transfer, I use providers or arrangements that provide an appropriate legal mechanism for that transfer.
You can contact me if you would like more information about the safeguards relevant to a particular service.
How long I keep information
I do not have one retention period for everything because the reason for holding different information varies.
General enquiries and correspondence
I will normally keep ordinary correspondence for up to two years after the matter has finished, unless there is a good reason to keep it for longer or delete it sooner.
Journalistic commissions and professional records
Records needed for contracts, tax, accounting, disputes or legal rights may normally be kept for up to six years after the relevant relationship or matter ends, unless the law requires a different period.
Newsletter information
Subscriber information is normally retained while you are subscribed. After you unsubscribe, limited information may need to remain so that your opt-out is respected and appropriate records of consent and withdrawal can be maintained.
Substack also applies its own retention arrangements to information processed through its platform.
Journalistic research, tips and source material
There is no sensible fixed period that applies to every investigation.
Material may need to be kept while a story is being researched and afterwards where it remains necessary to verify published reporting, deal with corrections or complaints, protect a source, establish or defend legal rights, continue an investigation, or preserve journalistic material of continuing public interest.
I periodically review material and should delete or anonymise it when there is no longer a reasonable journalistic, legal or other legitimate reason to keep it.
Some journalistic records may need to be retained for a long period.
Published journalism
Published journalism may remain publicly available for the long term as part of the journalistic and historical record, subject to applicable law, corrections and editorial decisions.
Data protection requests and complaints
I may retain records of data protection requests and complaints, and my responses to them, for up to six years where this is reasonably necessary to demonstrate compliance or deal with legal claims.
Website technical information
Some technical logs and operational information are controlled by the website hosting provider. Their retention is governed by the applicable hosting arrangements and provider terms.
How I protect information
I take reasonable technical and organisational steps to protect personal information.
These include measures intended to:
- minimise the amount of information collected;
- separate sensitive source handling from the main public website;
- restrict access to information;
- protect accounts with appropriate security controls;
- use encrypted services where appropriate;
- keep software and services appropriately secured;
- avoid unnecessary third-party tracking;
- review how sensitive material is stored and transferred.
Security is about reducing risk. No website, email service or communications system can honestly guarantee that information will never be lost, intercepted, disclosed or compromised.
Your data protection rights
Depending on why I am using your information, you may have the right to:
- ask what personal information I hold about you and receive a copy;
- ask me to correct inaccurate information;
- ask me to delete information;
- ask me to restrict how information is used;
- object to certain uses of your information;
- receive information you provided in a portable format where the right to data portability applies;
- withdraw consent where I rely on consent;
- object at any time to direct marketing;
- complain about how I use your personal information.
These rights are not absolute.
There are circumstances where data protection law allows or requires information to be withheld or processing to continue.
In particular, rights may be restricted where the journalism exemption applies and complying with a request would be incompatible with legitimate journalistic purposes.
I will not simply assume that an exemption applies. Any exemption relied upon should be considered in the circumstances of the particular request.
There is normally no charge for exercising your data protection rights.
I may ask for enough information to confirm your identity where this is reasonably necessary before disclosing personal information.
I will respond within the timescales required by data protection law.
Automated decisions and profiling
I do not use solely automated decision making to make decisions about website visitors that have legal or similarly significant effects on them.
The public website is not used to create advertising profiles about visitors.
If this changes materially, this privacy notice will be updated before the new processing begins where required.
Do you have to give me your information?
You do not have to provide personal information simply to browse this website.
You choose whether to contact me.
You choose whether to subscribe to the newsletter.
A journalistic source is not normally required to provide their name merely to submit information.
If you ask me to undertake work that requires a contract, there may be some information I need before I can enter into or carry out that arrangement.
If necessary information is not provided, I may not be able to respond, verify information or carry out the requested activity.
Making a data protection complaint to me
This section is for a data protection complaint about how I handle personal information. If your concern is about published journalism or journalistic conduct, use my separate Editorial Complaints procedure.
If you are unhappy with the way I have used your personal information, you can make a data protection complaint directly to me.
You do not need to use legal language or identify a particular section of data protection law.
Email:
If possible, use the subject:
Data protection complaint
Please explain what you are concerned about and include any information that may help me understand the issue.
I will acknowledge a data protection complaint within 30 days.
I will take appropriate steps to investigate it, keep you informed where necessary and communicate the outcome without undue delay.
Read the full complaint instructions, including how editorial and data protection complaints are distinguished.
Complaining to the Information Commissioner's Office
You also have the right to complain to the Information Commissioner's Office, which is the UK's independent data protection regulator.
You may wish to contact me first so that I have an opportunity to resolve the issue, but your right to approach the ICO is not removed.
My registration is:
Ryan Jarvis
Changes to this notice
I will review this privacy notice regularly and update it when the way I use personal information changes.
The date at the top of the page shows when it was last updated.
If I make a significant change that affects people whose contact details I already hold, I will take reasonable steps to bring the change to their attention where this is appropriate and required.