— Legal · Privacy
Privacy Policy
How UK Scam handles personal information across its research, evidence checks, public-interest reporting, source protection, Research Membership and the Tracer research system — what we may collect, why, who may see it, and the rights you may have where you live.
Effective 5 November 2026Last updated 5 November 2026v1.0
1. Scope
This Policy applies to personal information processed through UK Scam websites, evidence-submission systems, investigations, published records, membership services, Tracer, communications and related operations.
UK Scam is based in the United Kingdom and processes personal information under the UK GDPR and the Data Protection Act 2018. Where a matter crosses borders, other privacy, journalistic and public-record rules may also apply.
2. Information We May Collect
UK Scam may process information including names, professional information, corporate affiliations, contact details, public-record information, litigation and regulatory records, corporate ownership information, correspondence, documentary evidence and information submitted by sources or users.
For Research Members and authorised Tracer users, we may additionally process account details, professional credentials, organisation information, access records, security logs and information necessary to determine eligibility for restricted access.
We do not collect information merely because it may be interesting. Investigative collection should have a legitimate connection to our research, evidentiary, editorial, security or operational purposes.
3. Investigative and Public-Interest Information
UK Scam may process personal information when researching matters of legitimate public interest.
Depending upon the matter, information may originate from courts, government authorities, regulators, corporate registries, sanctions authorities, public databases, lawful open-source research, documentary evidence, interviews, subjects of investigations and confidential sources.
The existence of information in our investigative systems does not necessarily mean that it is verified or suitable for publication.
4. Public Records
Information contained in a public record is not automatically reproduced simply because it is publicly accessible.
UK Scam considers relevance, evidentiary value, context, accuracy and legitimate public-interest considerations when deciding whether information should form part of a published record.
Where appropriate, publications distinguish allegations from findings and pending proceedings from final determinations.
5. Evidence Submitted to UK Scam
When you submit evidence, we may collect your contact information, documents, communications and information concerning the person, organisation or matter identified in your submission.
Submissions may be retained where reasonably necessary for verification, investigation, legal review, source protection, correction handling or preservation of the evidentiary record.
Submission does not guarantee publication.
6. Confidential Sources
UK Scam takes source confidentiality seriously.
Where confidentiality has been agreed, access to identifying information may be restricted internally according to operational need and applicable law.
However, UK Scam cannot promise absolute confidentiality in circumstances where disclosure is legally compelled or otherwise required under applicable law.
7. Tracer
Tracer may contain investigative information, research material, source references and other data that is not publicly available on UK Scam.
Restricted information is not automatically suitable for public disclosure.
Access to Tracer may be limited to approved lawyers, investigators, government or law-enforcement personnel, compliance professionals, researchers or other authorised users, depending upon the applicable access criteria.
Tracer access may be logged and monitored for security, accountability and misuse prevention.
8. Research Membership
When an individual applies for Research Membership, UK Scam may process information necessary to evaluate the application, administer membership, provide research services, maintain account security and enforce access restrictions.
Where professional verification is required, we may request evidence reasonably necessary to verify identity, organisation or professional purpose.
Membership does not provide unrestricted access to all information held by UK Scam.
9. How We Use Information
Personal information may be used to conduct and verify investigations, authenticate evidence, resolve identities, maintain dossiers and reports, contact subjects for comment, administer rights of reply, process correction requests, protect sources, operate Tracer, manage memberships, secure our systems and comply with legal obligations.
Where required by applicable law, processing will be based upon an appropriate lawful basis.
10. Publication of Personal Information
UK Scam may publish personal information where publication is lawful, appropriately sourced and justified by the editorial and public-interest context.
Publication decisions are separate from data collection decisions.
The fact that UK Scam lawfully possesses information does not necessarily mean that the information should be published.
Particularly sensitive, irrelevant or disproportionately intrusive information may be withheld even where it forms part of the underlying investigative file.
11. Information We Do Not Sell
UK Scam does not sell personal information in exchange for payment.
We do not operate a paid removal model.
No person may purchase deletion, suppression or favourable alteration of accurate evidence-based reporting.
Research Membership and other paid services remain separate from editorial decision-making.
13. International Processing
UK Scam works across borders. Our work is centred on the United Kingdom, but matters often reach other jurisdictions connected to a subject, a company, a court case or a flow of money.
Information may therefore be accessed, reviewed or processed outside the jurisdiction in which it was originally obtained.
Where personal information is transferred outside the United Kingdom, UK Scam relies on the transfer mechanisms in the UK GDPR: UK adequacy regulations where they exist, and otherwise appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
14. Data Security
UK Scam uses organisational and technical safeguards intended to protect information against unauthorised access, disclosure, alteration or loss.
Access to sensitive investigative information should be restricted according to role and operational necessity.
No electronic system can guarantee absolute security.
15. Retention
Information is retained according to its purpose, evidentiary significance, legal requirements, security considerations and continuing relevance.
Investigative records may require longer retention than ordinary account information because UK Scam may need to preserve the evidentiary basis for a publication, correction, legal challenge or subsequent development.
Retention does not necessarily mean continued public publication.
16. Your Rights
Under the UK GDPR you may have the right to access your personal information, to have it corrected, erased or restricted, to object to its processing and, in some cases, to data portability. We respond within one month of receiving a valid request, extendable by up to two further months for complex or numerous requests, in which case we will tell you why.
These rights are not necessarily absolute.
Applicable law may provide exemptions or limitations relating to journalism, freedom of expression, public records, legal claims, regulatory obligations, investigations, source protection or matters of public interest.
UK Scam evaluates requests according to the law applicable to the particular information and processing activity, principally the UK GDPR and the Data Protection Act 2018. Where processing is carried out for the purposes of journalism with a view to publication in the public interest, the special purposes exemption in Schedule 2, Part 5, paragraph 26 of the Data Protection Act 2018 may limit some rights. We apply it case by case, not as a blanket answer.
17. Correction Is Different From Removal
A request concerning inaccurate information will be assessed against the underlying evidence.
Where information is materially inaccurate, UK Scam may correct it in accordance with its Corrections Policy.
Where information is accurate and its continued publication remains lawful and justified, a request for deletion does not automatically require removal.
No fee is charged to submit a legitimate privacy or correction request.
18. Children
UK Scam is not intended as a service for children.
Information concerning minors should receive heightened scrutiny and should not be published merely because it is available in a source. Any processing involving minors should be assessed according to applicable law and the legitimate public-interest circumstances of the matter.
19. Cookies, Security and Technical Data
UK Scam may process IP addresses, device information, browser information, timestamps, authentication events and similar technical data for security, system administration, fraud prevention and service operation.
Where legally required, non-essential cookies or comparable technologies will be subject to applicable consent requirements.
20. Privacy Requests
Privacy requests should identify the individual concerned, the specific information or publication at issue and the nature of the request.
UK Scam may request reasonable information to verify identity before disclosing personal information or acting upon certain requests.
Requests should be submitted through the Contact page and marked: PRIVACY / DATA PROTECTION REQUEST. On the Contact page, choose “Privacy / Data Protection Request” as the nature of enquiry.
21. Changes to This Policy
This Privacy Policy may be revised as UK Scam's operations, technologies and legal obligations develop.
Material revisions will be reflected by the Last Updated date appearing at the beginning of this Policy.
22. Editorial Independence and Privacy
Privacy rights are taken seriously, but privacy requests are not treated as a mechanism for purchasing, pressuring or negotiating the removal of accurate reporting.
UK Scam evaluates privacy, correction and removal requests on their legal and evidentiary merits.
No payment, membership, commercial relationship or threat of withdrawal of business affects that determination.
23. Who Is Responsible for Your Information
The controller of personal information processed through this website is UK Scam (ukscam.com). You can reach the controller at legal@ukscam.com.
Privacy questions and requests can be sent to legal@ukscam.com, or through the Contact page marked PRIVACY / DATA PROTECTION REQUEST.
24. Your Right to Complain
If you are unhappy with how we have handled your personal information, please tell us first so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK's supervisory authority for data protection, or, if you live elsewhere, to the data-protection authority where you live. Doing so does not affect any other legal remedy you may have.