Privacy notice

At the moment, "OHTL" is the name used for this initiative. OHTL is not incorporated. At the moment, the controller for the processing described in this notice is David Sant. This means he decides how and why personal information is used, and is responsible for looking after it.

In the future, this may change to add more individuals, or OHTL may incorporate. If either of those happens, we will update the information here.

To contact us about this notice or your personal information, email contact@ohtl.org with the subject line "Privacy".

We collect:

• Technical information when you visit the website. Like any website, ohtl.org receives your IP address and details of your browser and device, such as its type and settings, when it sends you a page.
• What you send us by email. If you email us, we receive your email address, your name if you include it, and anything you put in your message.
• Personal information in published documents and web pages. OHTL works with taxonomies, guidance, standards, research and other documents that have already been published. These can include personal information, usually the names of authors, editors and contributors, and sometimes their job titles, organisations or work contact details. We collect this from the publishers' websites and other public sources when we download, store and process the documents and pages for the OHTL project.

Because this information comes from published documents, we do not contact each person named in them. This notice explains how we use it.

We do not ask for, and would rather not receive, sensitive information such as details of your health, religion or political opinions. Please do not include it in emails unless it is needed.

We use personal information to:

• deliver the website to you, and keep it secure and working properly
• read and reply to your emails, and follow up on what you asked about
• collect, store, analyse, archive and share published documents for the OHTL project, and publish details of each source, such as its title, edition and authors, so that every taxonomy can be traced to the exact document it came from
• comply with our legal obligations, and establish, exercise or defend legal claims

We do not sell personal information, use it for marketing or build profiles of people. We do not use personal information in published documents to find out about, or make decisions about, the people named in them.

Under the UK General Data Protection Regulation (UK GDPR), we rely on:

• Legitimate interests for running a secure website that people can use; answering the people who contact us; and processing, storing, archiving and sharing published documents and web pages, and the personal information in them, for the OHTL project. The project's aim is to make published taxonomies of online harm easier to find, compare, cite and trace to their sources.
• Legal obligation where we need to use or share personal information to comply with the law, for example to respond to a request from a regulator or a court order, or to deal with a request to exercise your rights.

We also rely on legitimate interests where we need to use personal information to establish, exercise or defend legal claims.

We share personal information with:

• IT and system administration service providers who help us run OHTL, such as providers of website hosting, email, file storage and software development tools. They process personal information on our behalf to provide those services.
• Open repositories and web archives. Where the licensing terms allow, we upload an unaltered copy of a source document to an open repository, such as Zenodo, which is run by CERN, so that it has a permanent, citable address. If the document contains personal information, such as the names of its authors, we share that information with the repository when we upload the file, and the repository makes the file and its record, which usually names the authors, publicly available. Where we cannot upload a document, we ask a web archive, such as the Internet Archive's Wayback Machine, to capture the publisher's page, which copies any personal information on it. These repositories and archives decide how they keep and publish the copies, under their own terms.
• Anyone who uses the website or our published data. We publish details of each source, including the names of its authors or publishers, on ohtl.org and in our open data.
• Professional advisers, such as lawyers, accountants and insurers, where we need their advice or services.
• Regulators, law enforcement agencies, courts and other authorities, where the law requires us to, or where we need to in order to establish, exercise or defend legal claims.
• Third parties in connection with a restructure. If OHTL incorporates, reorganises, merges with or transfers its work to another organisation, or is considering doing so, we may share personal information with that organisation and its advisers. If the change goes ahead, the new organisation may use the personal information in the same way as set out in this notice. We will update this notice to say who is responsible for it.

We do not share personal information with anyone else unless the law requires us to.

Some of the organisations we share personal information with are based outside the UK, or process personal information outside the UK.

• IT service providers. Our IT service providers are mainly based in the US. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), we rely on that. For any provider that is not certified, we rely on approved safeguards in its terms, such as standard data protection clauses.
• Open repositories. Zenodo is run by CERN, an intergovernmental organisation based in Switzerland. When we upload a document to Zenodo, any personal information in it goes to CERN, so that information that has already been published stays publicly available.
• Web archives. The Wayback Machine is run by the Internet Archive in the US. When we ask it to capture a page, we send it only the page's web address, and it copies the page from the publisher's site.
• People who use the website or our published data may be anywhere in the world, because ohtl.org and our data are publicly available.

We keep emails for as long as we need them to deal with what you asked about, and then delete them.

We keep published documents, and the personal information in them, for as long as the OHTL project needs them, so that each taxonomy can be traced to the exact edition it came from. Copies uploaded to open repositories or captured by web archives are kept by those organisations under their own terms.

We do not keep our own logs of visits to the website.

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to limit how we use your information
• object to how we use your information

Some of these rights only apply in certain circumstances.

To use any of these rights, email contact@ohtl.org with the subject line "Privacy". We will reply within one month.

If you are unhappy with how we have used your personal information, please tell us, so that we can try to put it right. Email contact@ohtl.org with the subject line "Data protection complaint", or raise it with us in any other way.

We will acknowledge your complaint within 30 days of receiving it. We will look into it without undue delay, keep you informed of our progress, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK regulator for data protection. The ICO usually expects you to raise your complaint with us first. Visit the ICO complaints page or call the ICO helpline on 0303 123 1113.

We will update this notice if we change how we use personal information. It was last updated on 2 October 2026.

The structure and tone of this notice are modelled on the GOV.UK privacy notice, and any reused content is licensed under the Open Government Licence v3.0.