Privacy
Policy
BCN.media is committed to the responsible stewardship of your personal data. This policy explains what information we collect, why we collect it, how we use it, and what rights you hold over your data — in plain language.
1 January 2025
4.1
India · United States · United Kingdom · EU/EEA
1 January 2025
Data Protection Officer
For privacy-related queries:
privacy@bcn.media
dpo@bcn.media
Response within 30 days of verified request.
Last Updated
1 January 2025
Version 4.1 — Supersedes v4.0 (July 2024)
This Privacy Policy applies to BCN.media (Bharat Chronicle Network), its mobile applications, newsletters, podcasts, video platforms, and all digital services operated by or affiliated with BCN.media (collectively, “BCN Services”). By accessing BCN Services, you acknowledge that you have read and understood this policy. This document complies with the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023 (India), the General Data Protection Regulation 2016/679 (EU/EEA), the UK GDPR, and applicable US state privacy laws including the California Consumer Privacy Act (CCPA).
1
Who We Are
Bharat Chronicle Network (operating as BCN.media) is an independent digital journalism organisation headquartered in India, with editorial bureaus and technical infrastructure across the United States, United Kingdom, and the United Arab Emirates. BCN.media is the data controller for all personal data collected through our platforms and services.
Registered Entity
Bharat Chronicle Network Pvt. Ltd.
New Delhi, India
CIN: [Registration Pending]
Data Controller Contact
privacy@bcn.media
BCN.media, Bharat Chronicle Network
New Delhi — 110001, India
Where BCN.media engages third-party processors (technology vendors, analytics providers, payment processors), those parties act as data processors under binding contractual agreements that mandate compliance with applicable data protection law.
2
Information We Collect
We collect personal information only to the extent necessary to provide our journalism services, improve user experience, and fulfil legal obligations. We do not sell your personal data.
2.1 Information You Provide Directly
- Registration Data: Full name, email address, password (encrypted), country of residence, and optional profile photograph when you create a BCN account.
- Newsletter Subscriptions: Email address, language preference, topic interests, and frequency preferences.
- Comments & Letters: Your name, email, and the content of submissions to BCN’s comments section or letters-to-the-editor programme.
- Subscription & Payment: Billing name, address, email, and masked payment card details processed via PCI-DSS compliant payment processors. BCN.media does not store full card numbers.
- Journalist Applications: CV/résumé, portfolio links, references, and professional history submitted through our careers or freelance portals.
- Survey & Event Responses: Answers to reader surveys, event registrations, and feedback forms.
- Source Submissions: Documents, communications, and identifying details submitted through our secure tip line. These are handled under our source protection protocol (see Editorial Standards).
2.2 Information Collected Automatically
- Device & Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution, and connection type.
- Usage Data: Pages viewed, articles read, time spent, scroll depth, links clicked, search queries entered, and referral source (the URL that directed you to BCN.media).
- Cookies & Tracking: First-party and third-party cookies, pixel tags, and local storage identifiers. See our Cookie Policy for full details.
- Location Data: Country and city-level location inferred from IP address for geo-targeted content delivery. We do not collect precise GPS coordinates without explicit consent.
- Video & Audio Interactions: Play events, completion rates, and engagement metrics for BCN video and podcast content.
2.3 Information from Third Parties
- Social Login: If you sign in with Google, Apple, or Facebook, we receive your name, email address, and profile picture as permitted by your settings on those platforms.
- Advertising Partners: Aggregated and pseudonymous audience segment data from advertising technology partners to enable contextual advertising. We do not receive data that individually identifies you from ad partners.
- Analytics Providers: Aggregated behavioural data from analytics partners to understand readership trends.
3
How We Use Your Data
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Delivering news articles, newsletters, and media content | Email, preferences, location | Contract / Legitimate Interest |
| Account creation and authentication | Registration data | Contract |
| Processing subscription payments | Billing and payment data | Contract |
| Personalising content recommendations | Reading history, preferences | Legitimate Interest / Consent |
| Sending editorial newsletters and updates | Email, topic preferences | Consent |
| Displaying contextual and targeted advertising | Cookie IDs, device data | Consent |
| Analysing readership and improving editorial quality | Usage data (anonymised) | Legitimate Interest |
| Moderation of comments and user contributions | Name, email, submission content | Legitimate Interest / Legal Obligation |
| Complying with legal and regulatory obligations | Relevant personal data | Legal Obligation |
| Fraud prevention and security | IP address, device data | Legitimate Interest / Legal Obligation |
| Responding to reader enquiries and complaints | Contact data, correspondence | Legitimate Interest / Contract |
4
Legal Bases for Processing
Under the GDPR and UK GDPR, we rely on the following legal bases. Under the DPDP Act 2023, we rely on consent and legitimate use as defined in Section 7 of the Act.
- Contract (Article 6(1)(b) GDPR): Processing is necessary to perform our contract with you — for example, to deliver your subscription or newsletter.
- Legitimate Interests (Article 6(1)(f) GDPR): Processing is necessary for our legitimate interests as a news organisation, including editorial analytics, fraud prevention, and direct marketing to existing subscribers, provided those interests are not overridden by your fundamental rights.
- Legal Obligation (Article 6(1)(c) GDPR): Processing required to comply with applicable law, including tax, regulatory, and court-ordered disclosures.
- Consent (Article 6(1)(a) GDPR): Where we rely on consent — including for targeted advertising, non-essential cookies, and marketing to new subscribers — you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
- Vital Interests (Article 6(1)(d) GDPR): In exceptional circumstances involving a serious threat to the safety or health of an individual.
5
Data Sharing & Disclosure
BCN.media does not sell, rent, or trade your personal data to third parties for their own marketing purposes. We share data only in the following limited circumstances:
- Technology & Service Providers: Hosting, content delivery, email delivery, payment processing, analytics, and subscriber management platforms. These parties are bound by data processing agreements and may only use your data to provide services to BCN.media.
- Advertising Technology Partners: Pseudonymised identifiers and aggregated audience segments shared with advertising partners for the purpose of delivering contextual advertising. This sharing is governed by your cookie consent choices.
- Syndication & Distribution Partners: Article metadata and headlines may be shared with news aggregation and syndication partners under licence. No personally identifying reader data is included.
- Legal & Regulatory Compliance: We will disclose personal data when required to do so by a court order, warrant, regulatory demand, or other legally binding obligation. We will notify affected users where legally permissible before disclosure.
- Business Transfers: In the event of a merger, acquisition, reorganisation, or asset sale, your data may be transferred to the successor entity subject to the same privacy protections. We will notify users of any material change in data controller identity.
- Investigative Journalism — Source Data: Source identities and submitted documents are never shared with any party outside BCN’s investigative editorial team without the explicit, informed consent of the source, except under a direct, non-appealable legal order.
- With Your Consent: Any sharing beyond the above will occur only with your clear, affirmative consent.
6
International Data Transfers
BCN.media is a global news organisation. Your data may be processed in jurisdictions outside your country of residence, including India, the United States, the United Kingdom, Singapore, and European Union member states.
For EEA & UK residents: Where personal data is transferred outside the UK or EEA, BCN.media ensures adequate protection through European Commission-approved Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), or reliance on adequacy decisions where applicable. A record of transfer mechanisms is available upon request.
For Indian residents: Cross-border data transfers comply with the Digital Personal Data Protection Act 2023 and applicable rules issued by the Government of India. We transfer data only to jurisdictions notified by the Central Government as providing adequate protection, or under Standard Contractual Obligations approved by the Data Protection Board of India.
7
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.
| Data Category | Retention Period | Basis |
|---|---|---|
| Active subscriber account data | Duration of subscription + 2 years | Contract / Legitimate Interest |
| Billing and financial records | 7 years from transaction date | Legal Obligation (tax law) |
| Newsletter subscriber data | Until unsubscribe + 6 months | Consent |
| Published article comments | Duration of article + 3 years | Legitimate Interest |
| Deleted account data | 30 days (recovery), then permanently deleted | Contract |
| Web analytics data | 26 months (aggregated thereafter) | Legitimate Interest |
| Security and fraud logs | 12 months | Legitimate Interest / Legal Obligation |
| Correspondence and complaints | 3 years from resolution | Legitimate Interest |
| Source-submitted documents | Pursuant to source agreement and editorial policy | Legitimate Interest (press freedom) |
8
Your Rights
Depending on your jurisdiction, you hold the following rights with respect to your personal data held by BCN.media. We respond to verified requests within 30 days (extendable by an additional 30 days for complex requests with notice).
👁
Access
Receive a copy of the personal data we hold about you and information about how it is used.
✏️
Rectification
Request correction of inaccurate or incomplete personal data without undue delay.
🗑
Erasure
Request deletion of your data where there is no overriding legal ground for continued processing.
⏸
Restriction
Request that we limit processing of your data in certain circumstances while a dispute is resolved.
📦
Portability
Receive your data in a structured, machine-readable format for transfer to another controller.
🚫
Objection
Object to processing based on legitimate interests or direct marketing at any time.
🔄
Withdraw Consent
Withdraw consent for consent-based processing without penalty and without affecting prior processing.
🤖
Automated Decisions
Not be subject to solely automated decisions that produce significant legal or similar effects.
📋
Grievance (India)
File a grievance with our Data Protection Officer under the DPDP Act 2023 with a response guaranteed within 30 days.
How to Exercise Your Rights: Submit a request to privacy@bcn.media with your full name, registered email address, and a description of your request. We may require identity verification before processing requests affecting sensitive data. Requests are free of charge; manifestly unfounded or excessive requests may incur a reasonable administrative fee.
If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority: the Data Protection Board of India (India), the Information Commissioner’s Office (UK), your national Data Protection Authority (EU/EEA), or the Federal Trade Commission (USA) as applicable.
9
Children’s Privacy
BCN.media’s services are not directed at children under the age of 13 (or 18 in jurisdictions where that is the applicable threshold under applicable data protection law). We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided personal data to BCN.media, please contact privacy@bcn.media immediately. We will take prompt steps to delete such information.
Under the Digital Personal Data Protection Act 2023 (India), BCN.media shall not process the personal data of a child without verifiable parental consent, and shall not undertake processing likely to cause harm to a child’s well-being, including behavioural profiling or targeted advertising directed at children.
10
Security Measures
BCN.media employs technical and organisational security measures proportionate to the sensitivity of the data we hold and the risks of processing. Our measures include, but are not limited to:
- Encryption in Transit: All data transmitted between your device and BCN.media servers is encrypted using TLS 1.3 or higher. Our websites enforce HTTPS.
- Encryption at Rest: Sensitive personal data (including passwords, payment references, and source submissions) is encrypted at rest using AES-256.
- Access Controls: Strict role-based access controls limit employee access to personal data on a need-to-know basis. All access is logged and audited.
- Intrusion Detection & Monitoring: 24/7 security monitoring, automated anomaly detection, and periodic penetration testing by independent security firms.
- Secure Source Channel: BCN.media maintains a SecureDrop-equivalent encrypted whistleblower submission system. Source data is air-gapped from production infrastructure.
- Incident Response: A documented Data Breach Response Plan ensures notification to relevant supervisory authorities within 72 hours (GDPR) or the applicable statutory period, and to affected data subjects without undue delay where a breach poses high risk to individual rights.
- Staff Training: All BCN.media staff with access to personal data receive annual data protection and cybersecurity training.
Important: No method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.
11
Third-Party Links
BCN.media articles and pages may contain hyperlinks to external websites, social media platforms, embedded video players, and third-party services not operated by BCN.media. This Privacy Policy applies solely to BCN.media and its owned platforms.
BCN.media has no control over, and accepts no responsibility for, the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any external sites you visit. The inclusion of a link does not constitute endorsement of, or affiliation with, the linked site or organisation.
12
Policy Changes
BCN.media reviews and updates this Privacy Policy at minimum annually, or when material changes occur to our data practices, applicable law, or the services we provide. When we make material changes, we will:
- Update the “Effective Date” and version number at the top of this document;
- Publish a prominent notice on BCN.media’s homepage for a minimum of 30 days;
- Send an email notification to all registered subscribers;
- Where required by law, seek fresh consent before processing under the revised policy.
Your continued use of BCN Services after the effective date of a revised policy constitutes your acknowledgement of and agreement to the updated terms, to the extent permitted by law. If you do not agree with any changes, you may close your account and cease use of BCN Services.
All prior versions of this Privacy Policy are retained in our document archive and available upon request from privacy@bcn.media.
13
Contact & Data Protection Officer
BCN.media has appointed a Data Protection Officer responsible for overseeing compliance with applicable data protection laws and acting as the primary point of contact for data subjects and supervisory authorities.
Data Protection Officer
DPO, Bharat Chronicle Network Pvt. Ltd.
New Delhi — 110001, India
dpo@bcn.media
privacy@bcn.media
Response guaranteed within 30 days of verified request.
EU Representative (Art. 27 GDPR)
BCN.media EU Representative
[EU Registered Address]
For EU data subjects exercising rights under GDPR.
Supervisory Authorities
Data Protection Board of India
Information Commissioner’s Office (UK)
Your national DPA (EU/EEA)
Federal Trade Commission (US)
You have the right to lodge a complaint with the relevant authority at any time.
Grievance Officer (India — DPDP Act)
Grievance Officer, BCN.media
New Delhi, India
Mandatory response within 30 days per Section 13, DPDP Act 2023.
