Catfish Privacy Policy

Your trust is very important to us. This means the BBC is committed to protecting the privacy and security of your personal information.

It is important that you read this notice so that you are aware of how and why we are using such information. This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with data protection law.

Additional information can be found in the BBC’s Privacy and Cookies Policy. Where there is inconsistency between those documents and this notice, this notice shall prevail. Find out more about information and privacy.

Catfish sits on a platform owned by To Play For Limited, a BBC contractor who will process the information together with their suppliers Heroku, AWS and Digital Ocean. They all work together to enable the Catfish chatbot to function.

The BBC will collect and process the personal information that you provide to us in your conversation with the Catfish chatbot.

During your conversation with the Catfish chatbot you will not be asked any questions that require you to respond with personal information. As such, we would advise that you do not disclose any personal information in your conversation with the chatbot. However, if you do wish to disclose personal information, you do this voluntarily. The BBC will be the ‘data controller’ of any personal data you choose to provide. The BBC will process any personal information you provide on the basis of the BBC’s legitimate interests in providing this chatbot to you. In such a situation the BBC will consider and balance its legitimate interests against your rights and freedoms and will not continue to process any personal data if it considers the processing will have a disproportionate impact on your rights and freedoms.

The BBC asks that you do not disclose any of the special categories of more sensitive personal data about yourself or others. Examples of this type of data includes information about race and ethnicity; political opinions; religious or philosophical beliefs; trade union membership; health, sex life or sexual orientation; genetics or biometrics, and criminal convictions.

If you do provide any of these kinds of data, we will process it on the legal basis of this information having been manifestly made public by you.

We would repeat our request that you do not disclose any of these types of data about yourself or others.

Chat logs of your conversation will be stored by Heroku in the US for analytic purposes – these details will then be used to build up ‘memory’ for the chatbot and to improve the story, in order to give you the best experience. The BBC will be able to read chat logs as part of improving the experience over time. The BBC will also collect certain information about the choices you make on the platform in order to understand how our users interact with the platform.

The BBC, To Play For and their subcontractors will retain your personal information for the duration of the [Project name] project. Your information will be removed by the BBC, To Play For and their subcontractors on 31st May 2020 once the project has concluded.

As explained above, information you enter into the chatbot will be processed by To Play For Limited, and their suppliers Heroku, Digital Ocean, and AWS.

Chat logs of your conversation will be stored by Heroku in the US for the purposes of improving the story, [with appropriate safeguards in place.]

We will also transfer your personal information to the following countries outside the European Economic Area with appropriate safeguards in place:

    United States of America

If you have any questions about how the BBC handles your personal information, or you wish to find out about your rights, please visit the BBC’s Privacy and Cookies Policy. You will also be able to find out more information about how the BBC processes your information and how you can contact the BBC’s Data Protection Officer.

If you raise a concern with the BBC about the way it has handled your personal information, you are entitled to lodge a concern with a supervisory authority. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO).