My-Thesis.org | Operated by My-Thesis CIC
Last updated: [20th July 2026] • Effective: [20th July 2026]
1. About Us
My-Thesis.org ('the Site') is operated by My-Thesis CIC ('we'), a community interest company limited by guarantee registered in England and Wales (company no. 17112609), The Tythe Barn, Foxcote, Bath BA3 5YE, UK, operating the Site under licence.
We are the data controller for personal data processed through the Site.
Data protection contact: admin@my-thesis.org
2. Scope
This Privacy Policy applies to:
• registered users of the Site;
• scholars and researchers whose details and video presentations are catalogued on the Site, including those who have not registered with us (see Section 8 — Article 14 Notice); and
• all visitors to the Site.
Our primary compliance framework is the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU GDPR. We also have regard to data protection frameworks in other jurisdictions where data subjects may be located (see Section 14).
3. Personal Data We Process
3.1 Registered Users
• Name, email address, and hashed password
• Institutional affiliation and academic role
• Biography, profile photograph, and other voluntarily provided profile content
• Content uploaded or submitted to the Site
• Technical and usage data (IP address, browser type, session data, pages visited, referring URLs)
• Communications with us
3.2 Scholars Featured in Catalogue Entries (Non-User Data Subjects)
The Site catalogues academic research presentations produced by universities or institutions and published on YouTube. For scholars featured in those presentations, we process:
• Full name and professional title
• Institutional affiliation at the time of the presentation
• Research subject area and topic
• Still image (thumbnail) from the video recording
• Voice and moving image as embedded from the original platform
• Any biographical or publication data sourced from publicly available information
Our obligations to these individuals are addressed in Section 8.
3.3 Institutional Data
Publicly available information about universities and institutions that produce videos we catalogue: name, logo (where used with permission), and contact details of institutional representatives.
4. How We Collect Personal Data
• Directly provided: when you register, complete your profile, upload content, or communicate with us
• Automatically collected: technical data when you use the Site (see Cookie Policy at https://my-thesis.org/cookies/documentation)
• From third-party sources: YouTube API/oEmbed metadata and thumbnails; publicly available institutional and academic sources; information provided by universities about their researchers; information provided by scholars themselves following notification from us
5. Purposes and Lawful Basis
5.1 Operating and Providing the Site
Lawful basis: Art 6(1)(b) UK GDPR (contract) for registered users; Art 6(1)(f) (legitimate interests) for analytics and security.
5.2 Cataloguing and Promoting Academic Presentations
Lawful basis: Art 6(1)(f) UK GDPR — legitimate interests. Our interest is the promotion of genuine academic research dissemination, which is in the public interest. We have carried out a Legitimate Interests Assessment (available on request). The LIA concludes that our interests are not overridden by scholars' rights and freedoms, given: (i) presentations were made in a public academic context; (ii) they have been voluntarily published by institutions; (iii) processing is limited to professional academic identity; and (iv) we afford scholars meaningful opt-out rights (Section 8.5).
5.3 Seeking Consent / Notifying Scholars and Universities
Lawful basis: Art 6(1)(f) for initial contact; Art 6(1)(a) (consent) for any enhanced profile features beyond basic cataloguing.
5.4 Legal Compliance
Lawful basis: Art 6(1)(c) UK GDPR.
6. Disclosure and Sharing
We do not sell personal data. We may share data with:
• Hosting and infrastructure providers — necessary to operate the Site
• Analytics providers — to understand Site usage (privacy-configured)
• YouTube / Google LLC — video content is embedded from YouTube; Google's own privacy practices apply when a video is played
• Universities and academic institutions — to facilitate consent and partnership processes
• Professional advisers and regulators — where required by law
7. Cookies and Third-Party Technologies
We use cookies and similar technologies. When you play an embedded YouTube video, Google may set additional cookies. See our Cookie Policy for details and to manage your preferences.
8. Third-Party Featured Scholars — Article 14 Transparency Notice
This section constitutes our transparency notice under UK GDPR Article 14 (and equivalent provisions under applicable international law) for scholars whose personal data we process without having received it directly from them.
8.1 Who This Section Applies To
Any individual whose name, image, voice, institutional affiliation, or research details appear on this Site in connection with a video recording that was produced by a university or institution and published on YouTube or a similar public platform, and who has not themselves registered with us.
8.2 Why We Feature Your Data
Your university or institution produced and publicly published a video of your research presentation on YouTube. My-Thesis.org catalogues such presentations to help authentic academic research reach a wider audience. To promote your work, we must identify you as its author. We process limited personal data about you — your name, institutional role, research topic, thumbnail image, and embedded video — because this is inseparable from promoting the work itself.
We have carried out a Legitimate Interests Assessment. The key factors supporting our conclusion that this processing is justified are: the public interest in academic dissemination; the voluntary public nature of the original presentation; the professional (not personal) character of the data; and the opt-out rights we provide.
8.3 Categories of Data and Source
• Name and title; institutional affiliation; research subject area — sourced from YouTube metadata and public institutional sources
• Thumbnail image — sourced from YouTube's authorised API
• Voice and moving image — embedded from YouTube; played only when you or a visitor initiates playback
• Any additional data provided by you or your institution voluntarily
8.4 Recipients of Your Data
Visitors to the Site; search engines that index the Site; analytics providers; and (in the context of consent processes) your institution.
8.5 Your Rights
• Right to object (Art 21): You may object to our processing at any time. We will remove your catalogue entry unless we have compelling legitimate grounds.
• Right to erasure (Art 17): You may request removal of your entry and associated personal data. We will act within 30 days.
• Right of access (Art 15): You may request a copy of the data we hold about you.
• Right to rectification (Art 16): You may request correction of inaccurate information.
• Right to restrict (Art 18): You may ask us to limit processing while a concern is resolved.
admin@my-thesis.org with the subject 'DATA REQUEST — [Your Name]' or 'REMOVAL REQUEST — [Your Name]'. We will respond within one month.
Requesting removal from My-Thesis.org does not affect your institution's separate publication on YouTube. If you wish to remove the video from YouTube, you must contact your institution and/or YouTube directly.
8.6 Retention
Catalogue entries are retained for as long as the underlying video is publicly available and no removal request has been received. Following a removal request, personal data is deleted within 30 days (save where retention is required to demonstrate legal compliance).
9. Universities and Institutional IP
My-Thesis.org displays Embedded Content via YouTube's authorised embedding mechanism, within the scope of YouTube's Terms of Service. We do not host or download video files. We may separately seek written confirmation from institutions of this arrangement. Further details are in our Terms of Use and Third-Party Content Addendum.
10. Data Subject Rights — All Categories
All individuals whose data we process have the following rights (where applicable to the lawful basis used):
• Access (Art 15)
• Rectification (Art 16)
• Erasure (Art 17)
• Restriction (Art 18)
• Portability (Art 20) — where processing is based on consent or contract
• Objection (Art 21)
• Rights regarding automated decision-making (Art 22) — we do not carry out automated decisions with legal or similarly significant effects
• Withdrawal of consent at any time, without affecting prior lawful processing
Submit requests to admin@my-thesis.org. Response within one month (extendable by two further months in complex cases, with notice). Requests are free unless manifestly unfounded or excessive.
You may also complain to the UK Information Commissioner's Office (ICO): ico.org.uk | 0303 123 1113. If you are in the EU, contact your local supervisory authority.
11. International Transfers
Personal data may be transferred to or processed by service providers outside the UK/EEA (including in the US via Google/YouTube). We rely on UK International Data Transfer Agreements (IDTAs), EU Standard Contractual Clauses, UK adequacy regulations, or other Art 46 safeguards as appropriate. Google's transfer mechanisms are described at policies.google.com.
12. Security
We implement appropriate technical and organisational measures including encryption, access controls, and secure hosting. No internet transmission is completely secure.
13. Retention Periods
• Registered user account data: duration of account plus 3 years post-closure (or longer if required by law)
• Scholar catalogue entries: while the underlying video is publicly available and no removal request received
• Correspondence: 3 years from last communication
• Technical/log data: up to 12 months
• Consent records: duration of consent plus 6 years
14. Global Data Protection Framework
The Site is accessible worldwide. Our primary framework is UK GDPR. We also have regard to the following:
United States
We do not 'sell' or 'share' personal information under CCPA/CPRA. We rely on the publicly available information and research/academic exemptions where applicable. Individuals may contact us to exercise rights under applicable US state privacy laws.
Canada
Under PIPEDA Schedule 1 (Principle 4.3.6), consent is not required for publicly available information. Processing of professional academic information about scholars who have made their presentations publicly available is consistent with this principle. We will comply with Canada's Consumer Privacy Protection Act (C-27) as enacted.
Australia
Under the Privacy Act 1988 (Cth) and Australian Privacy Principles, collection from publicly available sources is permissible where an individual would reasonably expect such use. Scholarly research presented at academic events falls within that expectation. Australian residents may contact us to exercise Privacy Act rights.
Brazil
Processing is based on legitimate interests (Art 7(IX) LGPD) for catalogue operations, and consent where obtained. Research, academic, and journalistic purposes benefit from additional protection under Art 4(II) LGPD. Brazilian data subjects have equivalent rights to those in Section 10.
India
Section 17(2)(d) of the Digital Personal Data Protection Act 2023 provides that Data Fiduciary obligations do not apply to processing necessary for research, archiving, or statistical purposes. Our cataloguing of publicly available academic presentations is consistent with this provision. We will comply with applicable DPDP Act obligations and rules as they come into force.
Other Jurisdictions
We apply UK GDPR standards as a global baseline and respond in good faith to privacy enquiries from individuals in any jurisdiction.
15. Children
The Site is intended for adults. We do not knowingly process personal data of individuals under 16 without appropriate consent. Contact us if you believe a child's data has been incorrectly processed.
16. Changes to This Policy
We may update this Policy periodically. Material changes will be notified on the Site and, where practicable, to registered users. The 'Last updated' date reflects the most recent revision. Continued use of the Site following any update constitutes acceptance.
17. Complaints
• UK: Information Commissioner's Office — ico.org.uk — 0303 123 1113
• EU: Your local supervisory authority
• Other jurisdictions: The relevant national data protection authority