Privacy Policy

Last updated: 9 November 2026

1. Who is responsible for your information?

BeScamAware is a trading name of Not Another Idea Ltd, registered in England and Wales under company number 17426437. Not Another Idea Ltd is the data controller for personal information handled through BeScamAware.

Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For privacy questions, requests or complaints, email privacy@notanotheridea.com. For general enquiries, use our contact page or hello@bescamaware.org.

This policy covers the website, newsletter, contact messages and scam experiences submitted to us. It also covers direct correspondence about these services.

2. Reading, searching and using activities

You can read our guides, search the site and use the children’s quizzes and activities without creating an account. The website has no visitor accounts, advertising trackers or analytics scripts. Fonts, editorial images and the search index are served with the site.

Site-wide search runs in your browser using a downloaded index. Search terms are not sent to an external search service. They appear in the page URL, so may be kept in browser history and included in ordinary hosting logs when that URL is requested. Avoid putting personal information into a search.

Quiz answers, scores and word-search selections are handled on the page. These features do not send your answers to us or save them in browser storage.

Our hosting and email infrastructure processes technical information needed to deliver and protect the service, such as IP addresses, requested URLs, request times, browser details and delivery or error records. This is separate from visitor analytics. See our Cookie Policy for browser storage and cookies.

3. Contact messages

The contact form asks for your email address, enquiry topic and message. Your name is optional. We use these details to receive, review and respond to your enquiry. Without a reply address, we cannot provide an email response through this form.

Messages are sent through Amazon Web Services Simple Email Service (AWS SES) to the BeScamAware inbox. The sending service is configured in AWS’s Ireland region (eu-west-1). Your email address is included as the reply address so we can respond. The website does not automatically subscribe you to the newsletter or send an acknowledgement email.

We rely on legitimate interests to handle correspondence and provide our scam-awareness service, taking account of your rights and reasonable expectations. Information relevant to a legal obligation may also be processed where the law requires it.

4. Sharing a scam experience

The sharing form collects your account of what happened and your permission for it to be considered for educational use. Scam type, general setting, approximate date, outcome, lessons and additional comments are optional. Your name and email address are also optional.

You must actively give publication permission to submit a story. Permission to contact you about it is a separate, optional choice. We rely on your consent to consider and publish the submitted experience and, separately, to contact you about it. Leaving an email address alone does not give follow-up permission.

The story and your permission choices are emailed through AWS SES to BeScamAware for manual editorial and privacy review. Your email is used as a reply address only if you give follow-up permission. Nothing is automatically published. We aim to remove identifying details before publication and do not publish the name supplied in the form. You can submit without a name or email, but the story itself, technical records or its circumstances may still identify you. We cannot guarantee complete anonymity.

You can withdraw publication or follow-up consent by emailing privacy@notanotheridea.com. Include enough information to identify the submission, such as its title, approximate submission date or a short distinctive passage. Withdrawal does not affect processing already carried out lawfully. If a story has been published, we will remove it from our website when you withdraw publication permission, but cannot recall copies already shared, cached or held independently by others.

Sharing here is not an official fraud report. We do not investigate crimes, recover money or automatically forward submissions to the police. Our help page explains immediate protective steps and official reporting routes.

Please do not include passwords, PINs, authentication codes, bank or card details, identity documents, exact addresses, health information or someone else’s private information. There is no file-upload facility. If unnecessary sensitive information is received, we will remove or minimise it rather than use it in an educational story. We may retain or disclose information where necessary to meet a legal obligation or address a serious safety concern.

5. Newsletter subscriptions

We use Brevo to send occasional scam alerts, new guides and Scam of the Month updates. The signup form sends your email address to Brevo to request a confirmation email. Brevo adds you to the newsletter list after you follow its confirmation link. Contacting us or sharing a story does not subscribe you.

We rely on your consent for the newsletter. Brevo processes your email address, subscription and confirmation status, unsubscribe choices, and operational email records such as delivery failures or complaints. Our signup requests no individual open or click tracking for the confirmation email. Confirmation and unsubscribe links still record your choices, and Brevo may maintain aggregate email statistics.

You can withdraw newsletter consent through the unsubscribe link in any newsletter or by contacting us. We do not sell your details or pass them to other organisations for their own marketing. We may keep the minimum unsubscribe or suppression record needed to avoid emailing you again.

Brevo describes its processing in its Privacy Policy.

6. Security and preventing misuse

The forms validate submissions and use a hidden spam-trap field, rate limits and duplicate checks. These controls support our legitimate interests in protecting the website and preventing unwanted messages.

Our form service uses keyed hashes derived from IP addresses, email addresses and submission data to enforce short limits and identify duplicates. The rate records contain hashes, counters, expiry information and delivery state, rather than raw addresses or message text. Hashing does not make these records completely anonymous.

Form content is sent for email delivery, not stored in a public website database. It remains in the receiving mailbox and any applicable mail-provider records or backups. We restrict access to people who need it to handle correspondence or review stories. The website does not use your messages for automated decision-making or profiling.

7. Who processes information for us?

Information is shared only as needed to operate the service:

• AWS S3 and Amazon CloudFront store and deliver the public static website and process the requests needed to serve and protect it. Our separate scripts hosting provider processes form requests and security records.
• AWS SES delivers Contact and Story emails to our configured inboxes.
• Our mailbox provider receives and stores correspondence and story submissions so we can review and respond.
• Brevo manages newsletter confirmation, subscriptions, sending and unsubscribe records.

We may also disclose relevant information where legally required, to respond to a lawful request or to establish, exercise or defend a legal claim. Submitted stories are published only following the consent and review process described above.

If you follow a link to another website or interact with us through social media, that organisation’s own privacy terms apply to its services. We do not embed social feeds or third-party advertising on this site.

8. Where information is processed

The static website files are stored in S3 in Ireland and delivered through CloudFront’s global network. AWS SES sending is also configured in Ireland. Public website files may be cached outside the UK and Ireland; CloudFront also processes technical requests needed to deliver them. Contact messages and story submissions go to the separate email-submission service rather than the static S3 bucket.

Brevo states that its contact databases are hosted in the European Union; see its data storage information. These locations do not mean that every email, support record or subprocessor operation stays in one country. Email delivery, receiving mailboxes and providers’ support or subprocessors may involve other locations.

Where a service involves a restricted transfer from the UK, the applicable transfer arrangements must provide the required protection, for example through an adequacy decision or appropriate contractual safeguards. Contact privacy@notanotheridea.com for details of the arrangements relevant to your information.

9. How long we keep information

Our retention periods are:

• Contact enquiries: up to 12 months after the enquiry is resolved.
• Unpublished scam stories: up to 24 months after submission.
• Published scam stories: kept while publication permission continues, until you withdraw it or we remove the story. We keep the minimum associated permission record while needed to demonstrate that permission.
• Newsletter details: while you remain subscribed. After withdrawal, we keep only information needed to honour your unsubscribe choice, deal with a complaint or demonstrate consent where necessary.
• Form rate and duplicate records: used in ten-minute windows. The scheduled cleanup removes files untouched for a day; hourly cleanup normally removes these within about 25 hours.

Hosting, mail-delivery and backup records follow the relevant service settings. Retention is determined by the time needed to deliver the service, investigate faults or abuse, and restore the service following a failure. Backups may retain deleted information until their normal replacement cycle and are not used to restore deleted information for ordinary processing.

We delete or anonymise information when it is no longer needed. If a live complaint, legal obligation or claim requires longer retention, we keep only the relevant records for that purpose. Email and story retention requires review of our inboxes and records; the form’s rate-record cleanup does not delete emails.

10. Children and Digital Heroes

Children can read the Scam Busters HQ guides and use activities without providing a name, email, account or quiz results. We do not ask children to submit personal experiences or join the newsletter. A parent, carer or teacher can contact us on their behalf without including unnecessary identifying details.

If you believe a child has supplied personal information unnecessarily, contact us so we can review and remove it as appropriate.

11. Your choices and rights

Depending on the circumstances, you may ask to access, correct or delete personal information, restrict processing, object to processing based on legitimate interests, or receive a portable copy where that right applies. You can withdraw consent to newsletter emails, story publication or follow-up contact as described above. These rights have legal conditions and exceptions.

Send requests to privacy@notanotheridea.com. We may ask for information needed to identify the record and verify your identity. We will respond within the time required by data protection law.

You can complain to us through the same address. You also have the right to complain to the Information Commissioner’s Office (ICO).

12. Changes to this policy

We will update this page when our services or handling of personal information change. The date above identifies the current version. Our Cookie Policy explains the website’s use of cookies and similar technologies.