Privacy Policy

Online Responsibility Network Limited (“ORN”, “we”, “us”, “our”) is a subsidiary of Trust Alliance Group Limited.    

ORN is a professional network designed to support organisations in improving online trust and safety through collaboration, knowledge sharing and assessment services.  

ORN is the data controller for the personal data described in this privacy policy and our registered address is 3300 Daresbury Park, Warrington, WA4 4HS.  

We have appointed a Data Protection Officer (“DPO”) who is responsible for overseeing any questions relating to this privacy policy. You can contact them at:   

• Address: 3300 Daresbury Park, Warrington, WA4 4HS  
• Email: privacy@onlineresponsibilitynetwork.com    

Please note that this website and the services provided by ORN are not intended for children. We do not knowingly collect personal data relating to children.  

We may collect and process the following personal data in connection with using the ORN platform:  

• Name  

• Job title  

• Business or organisation name  

• Email address  

• Account credentials (e.g. login details etc.)  

• Profile information you choose to provide  

• Content you post, upload or share on the platform  

• Technical and usage data (e.g. IP address, interactions with the website etc.)  

• Direct messages and network interactions  

• Support chat interactions (e.g. messages you send to our support chatbot) 

We may also collect, use and share aggregated data such as statistical data which is not personal data as it does not directly or indirectly reveal your identity. For example, we may aggregate individuals’ usage data to calculate the percentage of users accessing a specific website feature to help improve the website and our service offering. However, if we ever combine or connect aggregated data with your personal data, so that it could directly or indirectly identify you, we will treat the combined data as personal data which will be handled in line with this privacy notice.  

Users should not submit or share special category data (e.g. information relating to health, race, political opinions etc.), and we do not intentionally collect such data.  

Your Personal Data will be held and used in accordance with the relevant data protection laws including UK and EU General Data Protection Regulations, the Data Protection Act 2018, the Data (Use and Access) Act 2025 (as appropriate) and the Privacy and Electronic Communications Regulations.  

The law requires us to have a legal basis for collection and using your Personal Data.  

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.  
• Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to provide a secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).   
• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will, so far as reasonably possible, identify the relevant legal obligation when we rely on this legal basis.  
• Consent: We rely on consent only when we have obtained your active agreement or clear opt-in to use your personal data for a specific purpose, for example in your marketing preferences. You can withdraw your consent at any time by contacting us or through the relevant opt-out and consent control mechanisms.  

We use your personal data for the following purposes:  

1. Account creation and management  

• To create and manage your ORN account  

• To provide access to the platform  
• Lawful basis: performance of a contract  

2. Platform functionality  

• To enable you to post, comment and engage with other users  

• To host and manage user-generated content  

• To maintain the integrity and security of the platform  

• To provide support and respond to your questions via our support chatbot 

Lawful basis: performance of a contract  

3. Assessment services (Members only)  

• To provide assessment services against ORN’s Framework  

• To manage relationships with member organisations  

Assessments are conducted by PricewaterhouseCoopers (“PwC”) acting as a processor on ORN’s behalf. Assessment outputs are organisational assessments and are not intended to include personal data.  

Lawful basis: performance of a contract  

4. Communications and marketing    

• To send service-related communications  

• To send marketing communications where you have opted in  

Lawful basis:  

• Service communications – performance of a contract  
• Marketing communications – consent   

  You can withdraw your consent at any time by unsubscribing from the marketing emails: open any of the received marketing emails and press ‘unsubscribe’. 

 5. Platform safety and moderation  

• To enforce our content moderation policies  

• To detect, prevent and address misuse of the platform  

  Lawful basis: legitimate interests (ensuring a safe and compliant platform)  

Members can report content as either a safety concern or spam. Safety concerns are hidden immediately and automatically pending review. Spam reports require two independent reports before content is hidden. All reported content is reviewed by the ORN moderation team, who will determine whether it is reinstated or permanently removed. it is based solely on the content and the fact that it has been reported. 

If you believe your content was wrongly reported or hidden, please contact us and we will review the report and let you know what the outcome is. 

No account is ever suspended or terminated as a result of an automated decision alone. Any decision to suspend or restrict an account is made by a human.

We may share your personal data with:  

• TAG Support Services Limited, ORN is part of Trust Alliance Group and information is shared with the support subsidiary in the group for support services such as IT, Security and Data services. 

• PwC (PriceWaterhouseCoopers LLP), acting as a processor for assessment services  

• Google Analytics (Google LLC), to help us understand how visitors use the site, such as which pages are viewed and whether particular features work as intended. 

• Microsoft Clarity (Microsoft Corporation), used to generate data reports for internal use, so that we can analyse user engagement. 

• Supabase, providing the database used for data storage 

• HubSpot Inc, providing the Customer Relationship Management system used to store user data from initial contact to member conversion, track communication and progress or onboarding.  

We expect all third parties to respect the security of your personal data and treat it in accordance with the law. We have agreements with third parties to process your data in accordance with our instructions.  

Your personal data may be transferred to and processed in countries outside the United Kingdom.  

Where this occurs, we will ensure appropriate safeguards are in place, such as:  

• International Data Transfer Agreements (IDTAs)  

• Adequacy regulations  

• Standard contractual clauses 

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:  

• Account data: deleted within 30 days of account deletion request, with a short grace period (e.g. 7 days) in case the member changes their mind before it’s processed.  

• Forum content: anonymised upon account deletion and retained for 6 years as community content  

• Assessment-related data: 6 years  

• Direct messages: deleted upon account deletion  

• AI conversation history: deleted upon account deletion.  

• Assurance Framework progress data: deleted upon account deletion  

• Technical and usage data (e.g. IP addresses, access logs): retained for 12 months  

• Content reports: retained for 6 years  

• Prospective Member data (information held about individuals and members who have not yet registered for the service) : anonymized 12 months after the prospect’s last meaningful engagement or communication, if they have not converted to a member. 

We may retain data for longer where required to comply with legal or regulatory obligations.  

Under UK Data Protection Law, you have the right to:  

• Request a copy of your personal data  

• Request correction of inaccurate data  

• Request erasure of your data  

• Request your data is transferred to another third party  

• Object to or restrict processing  

• Withdraw consent (where applicable)  

To exercise any of these rights, please contact our DPO at: privacy@onlineresponsibilitynetwork.com  

Our website uses cookies and similar technologies to operate the site, understand how it is used, and improve it over time. 

When you first visit our website, you will be shown a cookie banner that lets you choose which categories of cookies to accept. You can change your preferences at any time by clicking on the banner, which lets you view what each category is used for and withdraw your consent as easily as you gave it. 

We use the following categories of cookies: 

Necessary cookies – required for the website to function (for example, keeping you logged in, remembering security settings, and load-balancing). These cannot be switched off, as the site cannot work without them, and do not require consent. 

Analytics cookies – help us understand how visitors use the site, such as which pages are viewed and whether particular features work as intended. We use Google Analytics for this purpose. These are only set if you accept them via the cookie banner or preference centre. 

Marketing cookies – help us improve the relevancy of suggested content and advertising campaigns. These are only set if you accept them via the cookie banner or preference centre. 

The specific cookies we use, including their name, purpose, and how long they last, are set out in the cookie banner which is kept up to date as our use of cookies changes.

We implement appropriate technical and organisation measures to protect personal data against unauthorised access, loss or misuse. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.  

All information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our website and or services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.   

You have the right to make a complaint about how we have handled your personal data. If you have a complaint, please contact privacy@onlineresponsibilitynetwork.com or ORN DPO, 3300 Daresbury Park, Daresbury, Warrington, WA4 4HS. The DPO team will usually acknowledge the complaint within 5 working days, this time period may be extended over periods where the business is closed. 

A third party can make a complaint on behalf of the data subject; however ORN will require written consent from the data subject authorising the third party to act on their behalf in relation to the complaint. 

The DPO team will investigate the complaint and provide a response in writing. The response will usually be sent via email within 30 days from receipt. 

If the data subject does not agree with the outcome, they can request a review. A request for an outcome review must be made within 1 month of the original outcome being sent. The outcome will be reviewed by the Data Protection Officer and a response will be sent within 30 days from receipt of the request for a review. The response will usually be sent via email. 

If the data subject remains in disagreement with the outcome and review outcome, they can escalate their complaint to the Information Commissioner’s Office (the ICO). For clarity, a data subject retains the right to escalate a complaint to the ICO at any point in time and does not need to be engaged in the complaint procedure to do so. 

Information about how to make a complaint to the ICO can be found here: Make a complaint | ICO 

We would always appreciate the chance to deal with your concerns before you approach the ICO.  

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.   

We do not accept any responsibility or liability for any data that may be collected via those third parties. When you leave our website, we encourage you to read the privacy policy of every website you visit

We may update this privacy policy from time to time. Any changes will be published on this page with an updated effective date. Where appropriate, changes will be notified to you.  

It is important that the personal data we hold about you is accurate and current. Please keep us informed if any of your information changes during your interaction with our service