Privacy Policy

1. Data Controller

The data controller for the Orfid platform is Nigel Jones. Orfid operates as an independent public-interest reporting and intelligence platform focused on the United Kingdom.

2. Scope of This Policy

This policy applies to all users of the Orfid website, including members of the public, registered users, journalists, investigators, legal professionals, and organisational account holders.

It covers information submitted through forms, accounts, uploads, communications, and automated interactions with the platform.

3. Categories of Personal Data

Depending on how you use the platform, Orfid may process the following categories of personal data:

• Contact details (such as email address, where voluntarily provided)
• Account identifiers and access credentials
• Submission metadata (timestamps, reference codes, technical identifiers)
• Information contained within reports or supporting material
• Device, browser, and security-related information

4. Special Category & Sensitive Data

Reports may contain sensitive information, including allegations of misconduct, corruption, discrimination, or other serious matters. Such information is handled with additional safeguards and access controls.

Orfid does not require users to provide special category data unless it is relevant to the matter being reported and provided voluntarily.

5. Lawful Bases for Processing

Orfid processes personal data under one or more of the following lawful bases under UK GDPR:

• Consent (where information is provided voluntarily)
• Legitimate interests in operating a public-interest reporting platform
• Compliance with legal obligations
• Public interest and journalistic purposes

6. How Information Is Used

Personal data may be used to:

• Receive, store, and manage reports and submissions
• Maintain platform security and integrity
• Enable lawful review, analysis, and risk assessment
• Facilitate contact where permission has been granted
• Support responsible journalistic or investigative consideration

7. Automated Processing

Orfid uses automated systems to assist with categorisation, security, risk detection, and workflow management. These systems do not make determinations of truth, liability, or guilt.

Where automated processing significantly affects access or visibility, human review mechanisms are available where appropriate.

8. Disclosure & Sharing

Orfid does not sell personal data. Information may be disclosed only:

• To verified journalists, investigators, or legal professionals, subject to controls
• Where required by law, court order, or lawful authority
• Where necessary to protect life, safety, or significant public interest

9. Data Security

Orfid applies technical and organisational security measures appropriate to the sensitivity of the data, including access controls, segregation of functions, audit trails, and secure storage.

10. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected, subject to legal, regulatory, or public-interest considerations.

11. Your Rights

Subject to applicable exemptions, individuals may have rights to:

• Access personal data
• Request correction of inaccurate data
• Request erasure or restriction
• Object to certain processing

Some rights may be limited where data is processed for journalistic, legal, or public-interest purposes.

12. International Transfers

Orfid primarily processes data within the United Kingdom. Where data is processed outside the UK, appropriate safeguards are applied.

13. Complaints

If you have concerns about how your data is handled, you may contact Orfid. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

14. Changes to This Policy

This Privacy Policy may be updated periodically. The current version will always be available on this page.