Privacy Policy

PressPug is a UK-based subscription platform that helps public relations professionals find and manage journalist and media contact information for legitimate PR outreach. This policy covers the personal data we process as data controller across the whole service, including our marketing website.

Because of what PressPug does, we handle personal data belonging to three quite different groups of people, and we've tried to keep this policy organised around that distinction rather than mixing them together:

• Customers - people who hold or use a PressPug account on behalf of their organisation (see section 3).
• Journalists and media contacts - people whose professional contact details appear as records in our database, who are not our customers and do not have an account with us (see section 4).
• Website visitors - people browsing our public marketing pages without an account (see section 5).

What we collect. When you or your organisation sign up for PressPug, we collect account information (name, work email, organisation name, password), billing information (billing address and payment details, processed on our behalf by a payment processor, we do not store full card numbers ourselves), and usage data (searches you run, contacts you save to lists, credits spent, support requests, and general product usage such as pages visited and features used within the app).

Why we process it. We use this data to provide the service you've subscribed to and to administer your account (performance of a contract), to take payment and keep accounting records (legal obligation and contract), to keep the service secure and prevent misuse (legitimate interests), and, if you've opted in, to send you product updates beyond standard account notifications (consent). Unless you opt in to more, we only send transactional email, account and product notifications strictly needed to run the service.

Retention. We keep customer account and billing data for as long as your account is active, plus a period afterwards to meet our accounting and legal obligations, after which it is deleted or anonymised.

What we collect and where it comes from. Our database contains professional contact records, such as name, job title, outlet or publication, beat or subject area, and a professional email address, for people who publish journalism, commentary or other media content. This information is built from publicly available sources: published bylines, publicly accessible staff or "about" pages on outlet websites, and public content feeds. We do not collect this data directly from the individuals concerned, and we do not include private, home or non-professional contact details.

Our lawful basis. We process this data on the basis of legitimate interests, both our own and those of our customers, in maintaining an accurate, professional media-relations directory that supports legitimate public relations outreach in the public interest of a functioning press and media landscape. Because this data is limited to professional contact details drawn from material the individual has already published, and because we offer a straightforward way to object or be removed at any time, we consider this a proportionate and fair basis for processing. We do not use this data for any purpose beyond enabling our customers' own PR outreach and our own verification of the record's accuracy.

Your rights and how to exercise them. If you are a journalist or other media professional and you'd like to see what information we hold about you, correct it, or have it permanently removed from our database, you can do so at any time using our removal request form. Requests are confirmed by email before we act on them, and once confirmed we process removals promptly. A removed record is permanently suppressed and will not be re-added by our ongoing data collection, even if the underlying published material remains online.

Retention and refresh. Because roles and outlets in the media industry change frequently, we periodically re-check records against publicly available sources to keep them current, and we remove records that appear to be stale or that we can no longer verify. Records are retained only for as long as they remain accurate and in active use for the purpose described above, subject always to a removal request under this section taking priority.

Our public marketing pages use minimal analytics to understand overall traffic and improve the site, and only the cookies or similar technologies strictly necessary to operate the site and, where used, essential analytics. We do not use advertising or cross-site tracking cookies. Where any non-essential cookie is used, we will ask for your consent before setting it, in line with PECR.

We do not sell personal data, of any of the three categories described above, to third parties. We share personal data only with service providers who process it on our behalf and under our instructions, described here by category rather than by name: a cloud hosting and infrastructure provider, a payment processor for handling billing, an email delivery provider for sending account and product notifications, and, where relevant, professional advisers such as our accountants or lawyers. We may also disclose data where required by law or to protect our rights, our customers, or the public.

Some of our service providers may process data outside the UK and European Economic Area. Where that happens, we put appropriate safeguards in place, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or we rely on a provider's own adequacy or certification arrangements, to make sure your data continues to receive an equivalent level of protection.

We use technical and organisational measures appropriate to the sensitivity of the data involved, including encryption of data in transit, access controls that limit who within our team can view personal data, and regular review of our security practices. No system is completely secure, but we work to keep these measures up to date as the service grows.

Depending on which category above applies to you and subject to applicable law, you may have the right to: access the personal data we hold about you, have inaccurate data corrected, have data erased, restrict or object to our processing, and receive a copy of your data in a portable format. Customers can exercise most of these rights directly from their account settings or by contacting us; journalists and media contacts should use the removal request form described in section 4, which covers access, correction and erasure in one flow.

If you have a question about this policy or how we handle personal data, contact us by email at [email protected] for privacy matters, or [email protected] for general enquiries. Data controller: Robb Dewey, trading as PressPug.

If you're not satisfied with how we've handled your data or a request about it, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We'd appreciate the chance to address your concern directly first, but you're not required to contact us before you complain to the ICO.

See also our Terms of Service.