Home › Privacy policy
This policy explains which personal data the Freelance Journalists Association (FJA) processes when you visit presscard-application.com or order a press card, why we do so, with whom we share it and which rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for visitors from the EU, the EU GDPR.
Last updated: 17 October 2026.
The controller is the Freelance Journalists Association (FJA), International House, 776-778 Barking Road, London E13 9PJ, United Kingdom, email help@presseausweis-beantragen.com, phone +44 20 7963 7514. For all data protection questions and requests, please write to this email address with the subject “Data protection”.
Server log files. When you open our website, our hosting provider’s servers automatically record technical data: IP address, date and time, page requested, referring page, browser and operating system. We need this data to deliver the website securely and to detect attacks. Legal basis: our legitimate interests in a secure, functioning website (Article 6(1)(f) UK GDPR). Log data is deleted after a short period unless it is needed to investigate a security incident. Our hosting provider acts as our processor. Our website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, on servers in Germany. All data generated when you visit the website or use our forms, including your application and order data, is stored there, and the emails our website sends automatically are also sent via STRATO’s servers. STRATO acts as our processor under a data processing agreement (Article 28 UK GDPR); transfers to Germany are covered by the UK’s adequacy regulations for the European Economic Area.
Security. We use the security plugin Wordfence (Defiant, Inc., USA) to protect the website against attacks. It analyses requests, including IP addresses, and may compare them with threat information. Legal basis: legitimate interests in IT security.
Fonts. The fonts used on this website are hosted on our own server. No connection to Google Fonts is made when you visit our pages.
Caching. We use a caching plugin on our own server to make pages load faster; it does not set tracking cookies.
With your consent we use Google Analytics 4, a service of Google Ireland Limited / Google LLC, to understand how visitors use our website, for example which pages are read and how visitors arrive. Google processes usage data including a shortened or pseudonymised identifier, device and browser information and approximate location. Data may be transferred to the USA. Legal basis: consent. You can withdraw consent at any time in the cookie settings. Further information: Google’s privacy policy at policies.google.com.
What we process. When you apply for a press card we process your name, date of birth, nationality, photo, signature text, email address, postal and billing address, the validity you choose, your card number, order and payment status and, if you provide them, links to your work and messages to us.
Why. To review your application (including the minimum age of 18), produce and post your card, provide the verification page, handle payment, invoices, cancellations and refunds, and answer your questions. Legal basis: performance of the contract and steps prior to it (Article 6(1)(b)) and our legal obligations, for example tax records (Article 6(1)(c)).
Photo processing. Your photo is stored on our server, cropped and, if necessary, lightened automatically for printing. It is printed on your card and shown on the verification page.
Retention. We keep order and invoice data for as long as required by tax and company law (generally six years). Photos and card data are kept while the card is valid and deleted six months after it has expired (see section 6).
Customer area “My press card”. With your order you get access to our customer area “My press card”. If you order without a customer account, we create one with the email address of your order when you pay. You sign in without a password: on request, we email you a sign-in link that is valid for 15 minutes and can be used only once; after that you stay signed in for up to 14 days. In the customer area you can see your press cards and orders, change your details, photo and shipping address, report a loss and order a replacement or follow-up card. We have added press cards from earlier orders to the customer area, using the details from the respective order (name, card number, validity). Legal basis: performance of the contract (Article 6(1)(b) UK GDPR); for adding earlier cards, our legitimate interest in showing you all your cards in one place (Article 6(1)(f) UK GDPR). You can ask us to delete your customer account at any time by emailing help@presseausweis-beantragen.com.
Your acceptance when ordering. For each order we store the time at which you accepted the terms and conditions and acknowledged the cancellation policy and this privacy policy, together with the version of these texts valid at that time. This serves as evidence of the contract (Article 6(1)(b) and (f) UK GDPR).
Payment disputes. If you dispute a payment with your payment provider (chargeback), we record the status, date, response deadline, reason and the provider’s dispute reference with the order. To resolve the dispute, we send the payment provider the relevant information about your order: order details, the time of your order and of your acceptance of the terms, product and term, the IP address and browser identifier recorded with the order, the order history including production and shipping, the emails sent, the use of your digital press card and a preview of the card with a pixelated photo. While a dispute is open, follow-up cards, replacements and loyalty discounts for this order are blocked. Legal basis: our legitimate interest in enforcing our claims (Article 6(1)(f) UK GDPR).
Each card has a QR code linked to a verification page that we run ourselves on presscard-application.com (addresses beginning presscard-application.com/v/). No third-party verification service is involved. The page is activated once your order has been paid. It shows an image of the front of your card – with your photo, name, date of birth, nationality, card number and validity – together with the issuer and whether the card is currently valid. Anyone who scans the QR code or opens the address can see this information. This is an essential feature of the card and part of our contract with you (Article 6(1)(b) UK GDPR). Please do not order a card if you do not want this information to be visible to people who check your card.
Digital press card. The same page serves as your digital press card. In your customer account (My account → My press card) you can open it, save it to your phone’s home screen and download a PDF with the front and back of your card. For security reasons, the PDF link in our activation email expires after 30 days; a current link is always available in your account.
Status and protection against misuse. If an order is cancelled or refunded or a payment fails, the verification page shows the card as not valid; a replaced card is shown as replaced. To protect against mass requests, we limit requests to the verification page per IP address using only a short-lived hashed check value (a few minutes). We also log views of the verification page, downloads of the PDF and visits to your customer area with the time, a shortened browser identifier and a shortened, hashed check value of the IP address; we do not store the IP address itself for this purpose. This log serves as evidence that we have provided the agreed service, for example towards a payment provider in a payment dispute, and is deleted after 24 months, or earlier together with the card data. Legal basis: our legitimate interest in secure operation and in being able to prove our performance (Article 6(1)(f) UK GDPR).
Deletion. Six months after a card has expired we delete the name, nationality, photo, verification image and PDF of that card; the verification page then reports that no valid press card was found. The card number and its status are kept so that we can still answer queries about the card.
Cards issued before 8 October 2026. Press cards issued before 8 October 2026 link to the verification page of our former verification partner ScanToVerify Inc., Level 12, Tower Bank Building, 50th Street, Marbella, Panama City, Panama (scantoverify.org), which shows the issuer, your name and photo, the date of issue and the validity status. For these cards we transmitted the following data to ScanToVerify when the order was completed: issuer identifier, card ID, first and last name, date of birth, nationality, a link to your passport photo, validity and expiry date, signature (the name you entered) and card number. Legal basis: performance of the contract (Article 6(1)(b) UK GDPR). Panama is not covered by UK adequacy regulations, so the level of data protection there may be lower and your rights may be harder to enforce; the transfer takes place because it is necessary for the performance of the contract with you (Article 49(1)(b) UK GDPR). We no longer transmit any data to ScanToVerify for new cards.
Payments are processed by PayPal and its payment services (including card payments, Apple Pay, Google Pay and local payment methods). We transmit the data needed for payment, such as name, address, email and amount. PayPal processes your payment data as an independent controller under its own privacy statement and may carry out identity and fraud checks. We do not store full card details. Legal basis: performance of the contract.
We keep you informed about your order by email, for example about receipt of your order, completion of the check, production, shipping or a delay, and we send you your invoice. These emails are sent from our own server via STRATO by our press card plugin and, during a transition period, by the WooCommerce plugin AutomateWoo; invoices are created with the plugin PDF Invoices & Packing Slips. We use your name, email address and order details for this. Legal basis: performance of the contract (Article 6(1)(b) UK GDPR).
Reminder before your card expires. Because a press card cannot be renewed, we remind you by email that your card is about to expire (usually 60 days, 14 days and 1 day before and 7 days after expiry) and point out a follow-up card and, where applicable, a loyalty discount. Once your card has expired, we may send you a time-limited offer for a new card once. This is marketing for similar services of our own, for which we use the email address from your order (regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 and Article 6(1)(f) UK GDPR). You can object to this at any time free of charge, via the unsubscribe link in each of these emails or by emailing help@presseausweis-beantragen.com.
Information about new features. We inform holders of a valid press card once by email about significant new features of our service, such as the launch of the customer area (Article 6(1)(f) UK GDPR).
Suppression list. We keep addresses that have unsubscribed or cannot be reached on a suppression list so that they no longer receive such emails. You will still receive emails about your orders and press cards.
Newsletter. We only send newsletters if you have expressly consented beforehand (Article 6(1)(a) UK GDPR).
On our website you can open a support chat using the “Support” button. The chat is an AI assistant, not a person: its answers are generated automatically by a language model, and the chat itself tells you so. What we process: for general questions, the name you enter and your messages; for questions about an order, your order number and email address. Once these have been checked, the assistant receives details of that order in order to answer you: order number, date, payment method, amount, name, shipping address, email address and phone number, plus the press card details for that order (name, date of birth, nationality, validity, signature, card number and the file name of your photo as a link). Through the chat you can also update your shipping address or press card details; we store these changes with your order on our server.
Transfer to OpenAI. To generate answers, we send your chat messages, the conversation so far and the order details mentioned above to OpenAI via its programming interface (API). Our contract partner is OpenAI Ireland Ltd, Dublin, Ireland; data may also be transferred to OpenAI, L.L.C. in the USA on the basis of appropriate safeguards (standard contractual clauses with the UK International Data Transfer Addendum). According to OpenAI, data sent via the API is not used to train its models and is stored for no more than 30 days to detect abuse. Your passport photo itself is not sent to OpenAI. Please do not enter any data in the chat that is not needed for your request.
Cookie and chat logs. Only when you open the chat do we set the session cookie kisa_conv and store a random conversation ID in your browser’s session storage, so that your messages are assigned to the right conversation; both are deleted when you close your browser and are strictly necessary for the chat you have requested. We store each conversation as a log in our WordPress system (conversation, date, duration, type of request, name, email address, order number and your feedback on whether your issue was solved) so that we can follow up requests and check the quality of our support. We delete these logs after 90 days.
Legal basis: performance of the contract (Article 6(1)(b) UK GDPR) where your request concerns an order, and otherwise our legitimate interest in answering support requests quickly (Article 6(1)(f) UK GDPR). Using the chat is voluntary; you can also contact us by email or phone (see section 1).
We share personal data only where necessary: with our hosting provider STRATO GmbH (Germany) and IT service providers as processors, with PayPal and its payment services for payments, with ScanToVerify Inc. (Panama) for cards issued before 8 October 2026 (see section 6), with postal services for delivery, with OpenAI for the support chat and, with your consent, with Google for analytics. Some recipients are located outside the UK, in particular in the USA. Where this is the case, transfers rely on adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.
You have the right to access your personal data, to have it corrected, to have it erased, to restrict processing, to data portability and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw consent at any time with effect for the future. To exercise your rights, email us. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk/make-a-complaint. If you live in the EU, you may also complain to the supervisory authority in your country.
Our services are only for adults aged 18 or over; we do not knowingly process data of children and delete it if we find that an applicant is under 18. We protect data with technical and organisational measures, including encrypted transmission (HTTPS). We may update this policy when our services or the law change; the date at the top shows the current version.
Questions about your data? Email help@presseausweis-beantragen.com with the subject “Data protection”.