OWH Privacy Notice 

1. Who we are: 

Orphan Works Hub (“OWH”, “we”, “us”, “our”)  

We are registered with the Information Commissioner’s Office (ICO) as a data controller: Registration number [ZC074486].  

This privacy notice explains how we collect, use, and protect personal data, and the rights of individuals whose data we process. 

We are committed to handling personal data lawfully, fairly and transparently, in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and corresponding international data protection legislation, where applicable. 

2. Why we collect and process data: 

We process personal data in order to: 

• identify authors, creators, estates, or other rights-holders; 

• verify ownership or interest in works; 

• contact rights-holders or their representatives; 

• support lawful licensing, permissions, and due‑diligence processes; and 

• prevent copyright infringement and enable lawful use of works. 

In many cases, personal data is obtained from clients, publicly available sources, or third‑party sources, rather than directly from the individual. We may also obtain personal data from trusted partners where this is relevant to the delivery of our services. 

3. What personal data do we collect? 

The personal data we collect and process depends on the context in which we are providing our services and the category of individual concerned. 

Customers and Clients 

We may collect personal data relating to customers and clients, including: 

• name, job title, organisation, and contact details; 

• contractual and billing information; and 

• records of services provided and professional correspondence. 

Rights Holders and Representatives 

We may collect and process personal data relating to identified or potential rights-holders, or their representatives, including: 

• names and professional or representative details; 

• contact information; and 

• information linking an individual to a particular work. 

This information is typically obtained from clients, publicly available sources, or third‑party sources. 

Personal data within works 

We may process works (including images) supplied by clients or identified during rights‑holder searches. 

Where works include identifiable individuals, the information may constitute personal data under applicable data protection legislation. Where no individual can be identified, the information does not constitute personal data and data protection legislation does not apply. 

Any personal data within works is processed solely for the purpose of identifying rights-holders and supporting rights clearance. We do not deliberately seek to identify individuals depicted within works. 

Special category data 

We do not intentionally collect or process special category personal data. 

Any special category data that may arise incidentally (for example, within works) is not used to infer, analyse, or record information about individuals and is processed only insofar as strictly necessary, with appropriate safeguards in place. 

4. Legal basis for processing personal data 

Customers and Clients 

We process personal data relating to customers and clients where processing is: 

• necessary for the performance of a contract (Article 6(1)(b) UK GDPR), including the delivery and administration of rights‑holder search, clearance, and related services; and 

• necessary for our legitimate interests (Article 6(1)(f) UK GDPR), such as managing professional relationships, communicating about services, and maintaining business and financial records, provided those interests are not overridden by the rights and freedoms of individuals. 

Personal Data of Rights Holders 

We process personal data relating to identified or potential rights-holders (or their representatives) on the basis of legitimate interests (Article 6(1)(f) UK GDPR). 

Our legitimate interests are in: 

• identifying authors, creators, estates, or other rights-holders; 

• verifying ownership or interest in works; and 

• contacting rights-holders or their representatives in connection with rights clearance, licensing, or permissions. 

This processing is necessary to support lawful use of works, prevent copyright infringement, and meet due diligence requirements, and is carried out with appropriate safeguards. 

Personal data within works 

Where works (including images) contain identifiable individuals, we process any personal data on the basis of legitimate interests (Article 6(1)(f) UK GDPR). 

Our legitimate interests are in identifying the rights-holder of the work and supporting lawful licensing or permissions. The processing of personal data within works is incidental to this purpose and does not involve the deliberate identification, analysis, or profiling of individuals depicted. 

Where no individual can be identified from a work, the information does not constitute personal data and data protection legislation does not apply. 

5. How long do we keep data? 

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including the delivery of rights‑holder search and clearance services, and to meet legal, contractual, or regulatory obligations. 

As a general rule: 

• personal data collected during rights‑holder searches or clearance projects is retained for no longer than six months after completion, unless a longer retention period is required; and 

• records required for legal, financial, or audit purposes are retained in accordance with applicable statutory requirements. 

Further details are set out in our Data Retention Policy. 

6. How we keep data secure 

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure. These measures include access controls, secure storage, encryption where appropriate, and regular staff training. 

7. International transfers 

Where personal data is transferred outside the UK or the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as adequacy decisions or contractual protections, to ensure an appropriate level of data protection. 

8. Who we share data with 

We may share personal data with: 

• clients who have commissioned rights‑holder search or clearance services; 

• professional advisers or representatives acting on behalf of rights-holders; 

• service providers who process data on our behalf under contract (such as IT or hosting providers); and 

• public authorities or regulators, where we are legally required to do so. 

All third‑party processing is governed by appropriate contractual safeguards to ensure personal data is handled securely and lawfully. 

9. Your rights 

Under the UK GDPR and the Data Protection Act 2018, you have the following rights: 

• Right to be informed. This Privacy Notice provides you with information in relation to how your data is processed.  This ensures that we are transparent about what we will do with the information you supply to us. 

• Right of Access: You can ask us to provide you with the personal data about you we hold. This right always applies. There are some exemptions, which means you may not always receive all the information we process. 

• Right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. 

• Right to erasure: You have the right to ask us to erase your personal information in certain circumstances. 

• Right to object. You have the right to object to processing if we are able to process your information because it is in our legitimate interests. You can also unsubscribe from our mailings and remove your details at any time. If you wish to stop receiving communications from us, you will be able to do so by contacting us [naomi@orphanworkshub.com] 

• Right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. 

• Rights related to automated decision making.  We use automated tools, including artificial intelligence, to support rights‑holder searches and analysis of works. These tools are used to assist with identifying relevant information and do not make decisions about individuals. We do not carry out solely automated decision‑making that produces legal or similarly significant effects on individuals within the meaning of Article 22 of the UK GDPR. Human oversight is applied to the interpretation and use of outputs generated by automated tools. 

You can make a request at any point by email [naomi@orphanworkshub.com]. We will respond to a request within one month of receipt. However, where a request is received to erase data, we may not be able to delete all data (for example where data is linked to financial transactions that must be kept for a set period of time under financial regulations). 

10. Links to other websites: 

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. 

11. How we use cookies: 

We use cookies to ensure you get the best experience on our website. We also use them for analytics such as Google Analytics and other web tracking technologies. Cookies allow web applications to respond to you as an individual.  

The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences such as identifying your computer’s previous visits to a website, ascertaining the most popular features of a website or enabling an organisation to present specific information to you.  

We use standard WordPress statistics which record visitor numbers and their country of origin. 

12. Complaints: 

If you would like to find out more about how we process data, or if you wish to make a complaint, please contact us at [naomi@orphanworkshub.com]  

If we are unable to resolve your complaint, you also have the right to complain to the Information Commissioner’s Office if you feel that your data had been processed in a way that is not compliant with this policy or in line with the UK GDPR and the Data Protection Act 2018. You can contact the ICO by visiting their website, http://www.ico.org.uk or by calling 0303 123 1113. 

13. Notification of Changes: 

We keep this Policy under regular review and will update this page. You should check this page from time to time to ensure that you are aware of any changes. 

Created: March 2026