Privacy Policy — The Media Source

These terms apply during the private alpha testing of The Media Source and may be updated as the service develops.

Who we are

The Media Source (https://themediasource.co.uk) is operated by Barcadia Media Limited (the "controller"). To contact us about privacy, use our contact form.

Registered in England and Wales, company number 06970806. Registered office: 14 Edward Street, Blackpool, FY1 1BA.

Alpha status

During the private alpha the platform contains only invited testers and sample content generated for evaluation. Real user data collected during the alpha is treated in line with this policy and may be deleted alongside sample data at the end of the alpha, subject to any legal obligation to retain it.

What personal data we collect

Registration and account data — first and last name, work email, password (stored only as a hash by our authentication provider), the professional role(s) you select, and your acceptance of these policies.
Profile data — display name, job title, employer, location, biography, expertise, LinkedIn URL, website, optional phone number, optional avatar image, and the visibility flags you choose for each field.
Company and press-room data — companies you create or are a member of, the role you hold in them and invitations you send or receive.
Journalist media requests — publication name, journalist job title, brief and questions, contact method, deadline, urgency, sectors and topics.
Source and expert responses — response text, attachments and any contact details you choose to include, plus status changes (submitted, viewed, shortlisted, accepted, declined).
Content submissions — press releases, expert commentary, market reactions, images and press-release attachments.
Uploaded files — headshots, company logos, press-release assets, response attachments and profile assets, stored in our managed object storage.
Communications — contact-form messages, complaint and correction correspondence, "contact this source" enquiries proxied through the platform, and support emails.
Preferences — followed sectors, topics and companies, saved items, email preferences (transactional and optional digests) and cookie choices.
Consent records — a record for each policy you accept, including your user ID, the policy type (Terms, Privacy, Cookies or Marketing), the policy version, and the date and time of acceptance. Where required and lawful we may also record the IP address and browser user agent used to give consent; we do not currently capture either during registration.
Usage data — internal analytics events (page views, searches, content interactions) recorded to a private table for platform operators. We do not use third-party analytics tools during the alpha.
Technical logs and error reports — automatically collected diagnostic information used to keep the service running and to investigate incidents.

We do not knowingly collect information from anyone under 18. There is no private direct-message feature on the platform: journalist–source communications happen through structured responses to a specific media request, and "contact this source" enquiries are relayed by email via a server-side proxy rather than a chat inbox.

How we use it

To operate your account and deliver the alpha service.
To distribute press material and connect journalists with sources.
To send transactional emails such as account confirmations, password resets and moderation decisions.
To send optional digests, alerts and marketing emails you have separately opted into.
To moderate content, investigate complaints, and enforce our terms.
To measure how the platform is used, using our own internal analytics, in order to improve it.
To keep the service secure and to meet legal obligations.

Lawful bases for processing

Contract — operating your account, delivering the alpha service, and handling the content you submit through it.
Legitimate interests — running and improving the platform, security and abuse prevention, moderating content, defending against legal claims, and supporting journalism (balanced against your interests).
Consent — non-essential cookies, optional marketing emails, and any optional analytics beyond what is strictly necessary. You can withdraw consent at any time from your account privacy centre or the cookie banner.
Legal obligation — where we must retain records, respond to lawful requests, or comply with financial-services or advertising rules.

Who your data is shared with

Personal data may be shared with:

Other platform users, in the ways the product visibly enables: your profile fields you have chosen to make public are visible to any visitor; content you publish (press releases, commentary, expert profiles, company press rooms) is public once approved; a response you send to a media request is visible to the journalist who posted it and to platform staff involved in moderation, and is not shared with other responders; press-room members can see draft content in their own press room.
Our managed hosting, database, storage, authentication and email-delivery providers, who process personal data on our instructions to run the platform. During the alpha these services are provided through our managed platform provider; the current provider details are shown in the "Contact" page and will be listed by name once finalised.
Professional advisers, regulators and law enforcement where we are legally required to disclose data, or where disclosure is necessary to protect our rights or the safety of others.

We do not sell personal data and we do not share it with advertisers.

International transfers

Our managed hosting and database services may process personal data outside the UK. Where this happens, we rely on lawful transfer mechanisms recognised under UK GDPR, such as UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses. Specific transfer locations will be listed here once the alpha infrastructure is finalised.

How long we keep your data

Account data — for the life of your account, plus a short period after closure for security and audit.
Published content — kept as part of the platform archive unless corrected or removed under our Corrections Policy or Complaints and Takedown Policy.
Media request responses — kept for the life of the request and for a reasonable period thereafter for audit and dispute resolution.
Support, complaint and takedown correspondence — up to six years.
Consent records — kept for as long as you have an account and for a reasonable period after closure, so we can evidence what you consented to and when.
Technical logs — short-lived, typically a few weeks.

Account and data deletion

You can request an export of your personal data or the deletion of your account from the Privacy centre in your dashboard. Deletion removes your account and personal profile; content you have already published may be kept in the archive with your name removed where practicable, in line with our Corrections and Complaints policies.

Cookies, analytics and error monitoring

We use strictly necessary cookies and local storage for sign-in and preferences, and we may use internal analytics events to understand platform usage. We do not currently use third-party analytics tools such as Google Analytics. Errors are captured by our platform's built-in error-reporting mechanism to help us fix problems. See the Cookie Policy for details.

Your rights

Under UK GDPR you can ask us for access to, correction, deletion, restriction or portability of your personal data, and you can object to certain processing. You can withdraw consent for marketing emails or non-essential cookies at any time without affecting the lawfulness of earlier processing. To exercise a right, use our contact form or the Privacy centre in your dashboard. You can complain to the Information Commissioner's Office at ico.org.uk.

Security

We use encryption in transit, row-level database security, storage access controls and least-privilege administration. No system is perfectly secure. Report suspected security issues to our contact form.

Changes to this policy

We will notify registered users of material changes to this policy by email and by a notice on the site. Where a change is significant we will ask you to accept the updated version.

Contact and complaints

Privacy questions or complaints: our contact form. General enquiries: our contact form.