Policies and statements

Privacy policy

Learn how Conviction collects, uses, shares and protects personal information when you use Criminal Justice Hub. It explains accounts, cookies, optional analytics, public comments, volunteering, retention, your rights and how to raise a concern.

From:
Criminal Justice Hub
Published
Last updated
Applies to
England and Wales
On this page

This privacy notice explains how Criminal Justice Hub collects, uses, shares and protects personal information when people use our website and related services.

Would you prefer simpler information?

Read our easy-read privacy information. You can also ask us for this notice in another accessible format.

Last updated: 21 June 2026

Who we are

Conviction operates Criminal Justice Hub and is the controller for the personal information described in this notice. Conviction decides why and how it is used.

This notice applies to website visitors, registered members, staff and volunteers, newsletter subscribers, people who contact us, and people whose professional role is described in published content.

The information we collect

Personal information collected through the website
Activity Information
Browsing Aggregate page-view counts. We do not store an IP address, user-agent string or tracking cookie for the Popular on CJH count. Our hosting and security services may separately record IP address, browser, date, time, requested URL and security events.
Optional analytics Cookie identifiers, device and browser information, approximate location, pages visited and interactions, but only where the relevant consent is in place. The currently enabled services are listed in the cookie information and consent controls.
Public member accounts Name or display name, username, email address, encrypted password, approval status, account role, profile preferences and sign-in records.
Staff sign-in Name, work email address, Microsoft Entra account identifier and role information supplied through the Criminal Justice Hub Microsoft 365 tenant.
Participation Comments, prison reviews, ratings, likes, favourites, page subscriptions, newsletter topics and moderation records. Published comments and reviews may be visible to everyone.
Contact and rights requests Name, contact details, the content of the request or complaint, identity evidence where necessary, correspondence and outcome.
Recruitment and volunteering Application details, experience, references, right-to-work evidence, vetting outcomes, accessibility requirements and emergency contacts where relevant.
Published professional information Names, job titles and work-related information about public office holders and criminal justice professionals obtained from official reports, public bodies or the person concerned.

Please do not include unnecessary personal information about yourself or anybody else in a public comment or prison review. Do not publish allegations, confidential case information, addresses, contact details or information that could identify a child, victim, witness or individual prisoner.

Where information comes from

We receive information directly from you, from your device, from Microsoft when staff sign in, and from public or official sources used to maintain criminal justice content. A person may also contact us on somebody else’s behalf. Where Article 14 of the UK GDPR applies, we provide privacy information within the required period unless a lawful exception applies.

Why we use information and our lawful bases

Purposes and lawful bases
Purpose UK GDPR lawful basis
Operate accounts, comments, reviews, favourites and subscriptions Performance of our terms with you and our legitimate interests in providing a safe, useful publishing service.
Approve members and moderate contributions Our legitimate interests in preventing abuse, protecting users and maintaining accurate, lawful content.
Send newsletters and optional page updates Your consent. You can withdraw it at any time through newsletter preferences or an unsubscribe link.
Use non-essential analytics or tracking technologies Your consent under data protection law and the Privacy and Electronic Communications Regulations. You can change your cookie choice.
Security, fraud prevention, backups and service administration Our legitimate interests in protecting the website, its users and our information. A legal obligation applies where the law requires action.
Respond to enquiries, rights requests and complaints Our legitimate interests in responding and improving services, and compliance with legal obligations.
Publish accurate information about public professional roles Our legitimate interests in providing reliable criminal justice information, balanced against the person’s rights.
Protect life, prevent serious harm or meet safeguarding duties Vital interests, legal obligation or substantial public interest where the applicable legal conditions are met.

Where we rely on legitimate interests, we assess the need, benefit and likely effect on people. You can ask for information about a relevant assessment.

Special category and criminal offence information

We do not ask public users to place sensitive information in comments or reviews. If you choose to give us health, disability or other special category information to request an adjustment, we normally rely on explicit consent or another condition provided by Article 9 of the UK GDPR and Schedule 1 to the Data Protection Act 2018. We process criminal offence information only where Article 10 and the Data Protection Act 2018 permit it, with appropriate safeguards. We document the condition used where required.

Who we share information with

We do not sell personal information. We may share it only where necessary with:

  • Conviction personnel, authorised Criminal Justice Hub staff and volunteers who need it for their role
  • website hosting, security, backup, email, Microsoft 365, identity, newsletter, analytics and cookie-consent suppliers acting under contract
  • professional advisers, insurers and auditors
  • public authorities, emergency services, courts, regulators or law-enforcement bodies where disclosure is necessary and lawful
  • a new controller if responsibility for the service lawfully transfers, with appropriate notice and safeguards

Public comments and approved reviews are shared publicly. Your display name and contribution will be visible, but we do not intentionally publish your account email address.

International transfers

Some technology suppliers may process information outside the United Kingdom. Before a restricted transfer, we use a lawful safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved contractual clauses. Where required, we assess the destination, supplier and practical protections. You may ask us for information about the relevant safeguard.

How long we keep information

Typical retention periods
Record Typical period
Aggregate Popular on CJH counts Kept as non-identifying totals while the content remains published.
Security and access logs Normally up to 12 months, unless an incident or legal requirement justifies longer.
Cookie-consent evidence Normally 3 years from the choice or withdrawal.
Analytics According to the configured service, normally no longer than 26 months.
Member account While active and normally up to 2 years after closure or inactivity. Necessary moderation and legal records may be retained separately.
Comments and reviews While published or needed for moderation. We may anonymise a contribution rather than delete it where that protects the integrity of a discussion.
Newsletter subscription Until you unsubscribe. A minimal suppression record is normally kept for up to 3 years to respect and demonstrate your choice.
General correspondence Normally 3 years after the last meaningful contact.
Rights requests and data-protection complaints Normally 6 years after closure to demonstrate how the matter was handled.
Recruitment and volunteering Unsuccessful applications normally 12 months; necessary role records normally 6 years after the role ends.

We may keep a record longer where a legal hold, safeguarding concern, complaint, investigation or legal obligation requires it. Backups expire through a controlled rolling cycle.

Security

We use role-based access, staff authentication, encryption in transit, system updates, backups, logging and moderation controls. No internet service is completely secure. Please use a unique password and tell us promptly if you believe an account or contribution has been compromised.

Your rights

Depending on the circumstances, you may have the right to:

  • be informed about processing
  • request access to your personal information
  • ask us to correct inaccurate or incomplete information
  • ask for erasure or restriction
  • object to processing based on legitimate interests or to direct marketing
  • receive information you provided in a portable format where the right applies
  • withdraw consent without affecting earlier lawful processing
  • ask for safeguards relating to automated decisions
  • complain to us and to the Information Commissioner’s Office

Email [email protected]. We may ask for proportionate information to confirm identity or clarify a request. We respond without undue delay and normally within one month from the applicable starting point. The law permits an extension in some complex cases; we will explain if that applies.

How to make a data-protection complaint

You can complain electronically by emailing [email protected] or by post. Put Data protection complaint in the subject line or heading and explain what happened, the personal information involved and the outcome you want.

In line with section 164A of the Data Protection Act 2018, as inserted by the Data (Use and Access) Act 2025, we will:

  • acknowledge the complaint within 30 days beginning when it is received
  • make appropriate enquiries
  • keep you informed about progress where appropriate
  • respond and tell you the outcome without undue delay

You can also complain to the Information Commissioner’s Office, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would welcome the opportunity to address the concern first, but you do not have to contact us before contacting the ICO.

Children

The information pages may be used by children and young people. Public accounts and user contributions are not designed for children under 13. We use clear language and take additional care where we know information relates to a child. A child or responsible adult can contact us about information or request an accessible explanation.

Automated decisions

We do not make decisions about people that produce legal or similarly significant effects solely by automated means. Automated spam and security checks may flag activity for human review.

Changes to this notice

We review this notice at least annually and before using personal information for a materially different purpose. We will publish the new date and draw attention to significant changes where appropriate.

This notice is intended to meet the transparency requirements of the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, together with applicable Privacy and Electronic Communications Regulations requirements. It must be read alongside just-in-time information shown on forms and the website’s cookie controls.

YouTube videos on sentencing pages

Sentencing pages use a local text placeholder. We load a YouTube player only after you select Load video from YouTube for that page visit. This applies even if you have accepted optional cookies elsewhere. Loading the video does not enable CJH analytics or campaign cookies.

Loading connects your browser to YouTube/Google, which receives information such as your IP address, browser and device details and interactions with the player. It may use cookies or similar technologies. The player uses youtube-nocookie.com, but this does not prevent all personal-data processing. Your affirmative choice permits this third-party feature for the current visit. You can use the CJH summary and official written remarks without loading it.

Select Remove video and withdraw permission, reject optional cookies in the site’s cookie settings or leave the page to remove the player. This cannot undo data already transmitted or erase information held by Google. Google controls its processing, retention and any international transfers. Read Google’s Privacy Policy and Google’s cookie information.

To document consent, CJH records permission and withdrawal events with a random identifier, time, choice and notice version. These audit records contain no IP address, browser user-agent, case title or case URL and are retained for up to 24 months. They document the requested video feature and are not used to enable analytics or campaign tracking. Hosting and security logs are separate, as explained elsewhere in this notice.

Read the Sentencing Videos Policy and cookie register. For privacy concerns or rights requests, use the contact details in this privacy notice.

Previous privacy notices

Read previous privacy notices.

About this information

Last updated:

Updates to this page

  1. Policy reviewed and updated to include transactional email supplier details.

  2. Updated layout of the policy and updated contact email addresses.

  3. We have clarified that Conviction is the controller, updated the services and cookies we use, strengthened information about accounts, public comment moderation, volunteering checks, retention and daily backups, and made it easier to understand your privacy rights and how to contact us.

Cookies

Manage optional cookies and read the cookie register.

Terms of use

Rules for using the website and public features.