Privacy notice

Version 1 · what we do with personal data, and what you can do about it

This notice explains what Newsworthy does with personal data, and what you can do about it. It is written to Articles 13 and 14 of the UK/EU General Data Protection Regulation; the Kenya Data Protection Act 2019 gives substantially the same rights, and this notice serves both.

Version 1. We record which version you agreed to, so that a later edit cannot quietly change what you signed up for.

Who is responsible

Controller	Newsworthy
Data Protection Officer	None appointed. Data protection questions go to the contact address above.

The one thing worth reading first

This platform handles footage of people who never signed up for it. Eyewitness video and audio contains bystanders, passers-by and people caught in the worst moment of their lives. If you appear in something here, you have rights over that material even though you did not upload it and hold no account with us — and you can exercise them without creating one. See If you appear in footage below.

What we do with personal data

Each row below is a processing activity: what it is for, whose data it uses, on what lawful basis, who else sees it, and how long it is kept. This table is generated from the application's own data map, so it describes what the software actually does rather than what a document once said it did.

Activity	Whose data	What we hold	Lawful basis	Shared with	Kept for
Account administration	Contributors, journalists, newsroom staff, administrators	Name, email address, organisation, seat role, password hash, sign-in times	Contract Art. 6(1)(b) - necessary to provide the account the person asked for.	Nobody outside the controller	For the life of the account, then anonymised on request or on closure
Demonstrating consent	Everyone who has agreed to the notice or the contributor terms	Email address, purpose, document version, timestamp, IP address	Legal obligation Art. 7(1) - the controller must be able to demonstrate consent.	Supervisory authority on request	Three years after the consent ends
Media ingestion and enrichment higher risk — see below	Contributors, and ANY IDENTIFIABLE PERSON APPEARING OR HEARD IN THE FOOTAGE	Video, audio and images of people; speech transcripts; capture location; capture time; device make and model	Legitimate interests Art. 6(1)(f), and Art. 85 where the journalistic exemption applies in your jurisdiction. Transcripts can contain special category data under Art. 9 - political opinions, health, religious belief - without anyone intending them to. This activity is the one that needs a DPIA and a documented balancing test.	Licensed buyers; AI processors (see the sub-processor list)	While the item is listed; unsold failed uploads are purged automatically
Licensing	Journalists and newsrooms	Buyer identity, organisation, licence tier, amount, reference	Contract Art. 6(1)(b) - the licence IS the contract.	The contributor, as part of their sales record	Indefinitely: a licence is evidence of a right that does not expire
Taking payment	Journalists and newsrooms	Buyer identity, amount, currency, gateway reference, channel, IP address	Contract and legal obligation Art. 6(1)(b) and 6(1)(c) - tax and anti-money-laundering record keeping.	Paystack (payment processor). Card details are entered on Paystack's own page and never reach this application.	Seven years, as financial records; abandoned attempts purged after 180 days
Contributor earnings and payouts	Contributors	Contributor identity, gross, commission, tax withheld, net, period	Contract and legal obligation Art. 6(1)(b) and 6(1)(c).	Tax authority, where withholding applies	Seven years, as financial records
Contributor earnings and payouts	Contributors	Contributor identity, amount, method, payment reference	Contract and legal obligation Art. 6(1)(b) and 6(1)(c).	Banks and mobile money operators used to send the money	Seven years, as financial records
Access logging for licensed media	Journalists and newsroom staff	Identity, item, licence, timestamp, bytes, IP address, user agent	Legitimate interests Art. 6(1)(f) - accountability for material that is licensed, not sold outright. Refused attempts are logged for the same reason.	The licence-holding organisation's managers	2 years
Chain of custody	Everyone using the application	Identity, event, detail, IP address, timestamp	Legitimate interests Art. 6(1)(f) - integrity and accountability of an evidential archive.	Administrators	3 years
Corporate spending approval	Journalists and newsroom managers	Requester and approver identity, item, amount, justification text	Legitimate interests Art. 6(1)(f) - the newsroom's interest in controlling its own budget.	Managers of the requester's own organisation	While the organisation exists
Exclusive access agreements	Contributors and newsroom managers	Both parties' identities, price, window, terms and response text	Contract Art. 6(1)(b).	The other party to the agreement	Indefinitely: an agreement is evidence of rights granted
Newsroom seat invitations	Invited journalists	Email address, seat role, who invited them	Legitimate interests Art. 6(1)(f) - the newsroom's interest in staffing its own account.	Managers of the inviting organisation	90 days after being used or withdrawn
Handling data subject requests	Anyone exercising a data protection right, including people who appear in footage and hold no account	Name, email address, the request itself, IP address, the outcome	Legal obligation Art. 6(1)(c) - complying with Chapter III.	Supervisory authority on request	3 years after closure

Footage, and the people in it

Uploaded media is the part of this platform that carries the most personal data and the least consent. Three things we do about it:

The provenance record is taken before the file is altered, and then the file is scrubbed. Capture metadata — device, timestamp, GPS — is read at ingest and stored against the item; the copy that leaves us has that metadata stripped out of the file itself.
Unlicensed viewers see a watermarked, downscaled preview. The original is served only to someone holding a licence, and every delivery of an original is logged.
Transcripts are generated automatically and can contain anything that was said. That includes information about health, beliefs or political opinions that nobody set out to record. We treat this activity as higher risk and it is the one we assess before it runs.

Who else processes it

We use the following processors and recipients. Which AI providers appear here depends on how this installation is configured; the list is read from the live configuration rather than written down separately.

Recipient	What for	What reaches them
Groq	Transcribing speech in uploaded media	The audio track of uploaded media, which contains the voices and words of everyone recorded.
DeepSeek	Summarising, categorising and tagging; extracting named people, organisations and places	The transcript text and basic item metadata. Not the media file itself.
Paystack	Taking payment	Buyer email address and the amount. Card details are entered on Paystack's own page and never reach this application.
OpenStreetMap Nominatim	Turning capture coordinates into a place name	Latitude and longitude only. No identity and no media.
Licensed buyers	The purpose of the platform: supplying footage to newsrooms	The licensed media and its metadata, including anyone appearing in it.

Several of these are outside Kenya and outside the EEA. Where that is so, transfers rely on the provider's standard contractual clauses and on our processor agreement with them.

Your rights

You can exercise any of these free of charge, and we answer within one month. If a request is complex we may take up to two months more, and we will tell you why inside the first month.

Right	What it means here
Access a copy of my data Art. 15	Download everything we hold about you, as a structured file, from your privacy centre. No waiting and no form.
Export my data to take elsewhere Art. 20	The same file. It is JSON, so another service can read it.
Correct something inaccurate Art. 16	Correct your name, email or organisation yourself. Anything you cannot edit, ask us and we will.
Erase my data Art. 17	We delete what we can and anonymise what the law makes us keep, and we tell you which was which.
Pause processing while we dispute it Art. 18	We pause processing while a dispute is worked out. For footage this takes the item off the market immediately.
Object to how my data is used Art. 21	Where we rely on legitimate interests - the archive, the logs, the audit trail - you can object and we have to weigh it.

Erasure has limits, and we would rather say so up front. Where you have bought or sold through this platform, the licence, the payment and the earnings records are kept: tax law requires them, and a licence is a buyer's evidence of a right they paid for. When we erase an account we delete what we can, anonymise what must stay, and send you a list of exactly which is which.

If you appear in footage

You do not need an account, and you do not need to know who filmed it. Submit a request at our privacy request form describing the material. We will confirm the email address you give us, then look at it.

Typically that means one of:

Restriction while we assess it. The item comes off the market immediately — not searchable, not previewable, not licensable — while we weigh your objection against the public interest in the material.
Erasure. If the objection is upheld and nobody has licensed the item, it is deleted along with every derived file.
A reasoned refusal. Journalism has a statutory exemption in most jurisdictions, and it sometimes applies. If we rely on it we will tell you so in writing, and tell you how to complain about that decision.

Where the item has already been licensed we will tell you that too, and tell you what we can and cannot undo. We would rather give you an uncomfortable answer than a vague one.

Cookies

One cookie, newsworthy_session. It keeps you signed in and carries the token that protects our forms from cross-site request forgery. It is marked HttpOnly and SameSite, sets no identifier used for anything else, and is deleted when you close your browser.

It is not set until it is needed. Reading this page, the home page or any printable document stores nothing at all. The cookie appears the first time you open a page with a form on it — signing in, registering, or making a request — because a form cannot be protected without one.

There is no analytics, no advertising, no third-party tracking and nothing loaded from another company's servers. That is why you are shown a short notice rather than a consent banner: there is nothing here to accept or decline, and a dialogue that asked for permission it does not need — then carried on regardless of the answer — would be theatre.

Dismissing that notice stores one flag, nw.cookie-notice.seen, in your browser's local storage so it does not come back. It is written only when you click, it holds nothing but the fact that you clicked, and it never reaches our servers.

Paying is the one time your browser talks to somebody else: checkout happens on the payment provider's own pages, under their cookies and their privacy notice, and nothing we set applies there.

Security

Passwords are stored only as a one-way hash. Uploaded files sit outside the web root and are served only through an access check. Card details are entered on the payment provider's own page and never reach this application. Every IP address we log is truncated before it is stored.

Complaints

Come to us first if you can — the contact address above — but you do not have to. You can complain to the data protection authority where you live or work. You also have a right to go to court under Article 79, independently of any complaint.