Privacy Policy

Who we are

Prisons Online (prisonsonline.com) is an independent informational directory. This policy applies to visitors anywhere in the world. We are the controller of personal information we collect through the site, except where a named provider acts as an independent controller, which we identify below. Contact us through the contact form for privacy requests.

Information we collect

Information you give us on the contact form:

• Name, email address, and message
• Phone number, if you choose to provide one
• The page you submitted from, the referring page, and advertising click identifiers in the address bar when present (such as utm parameters, gclid, fbclid, or msclkid)

Information collected automatically when you use the site:

• IP address, approximate location derived from it, date and time, browser, device, operating system, language, and the pages and files requested
• Security and diagnostic logs kept by our host
• Cookie and similar-technology data described in the Cookie Policy, only for the categories you allow

We do not ask you to create an account. We do not knowingly collect government identity numbers, precise GPS location, or information about your criminal record. Directory pages describe facilities, not the people reading them.

Google Analytics 4

With measurement consent, we use Google Analytics 4, provided by Google LLC, measurement ID G-RCEGDLDF2C. The Google tag is not requested until that category is allowed. Until then, page-view and click events on this site are not sent to Google.

When allowed, Google Analytics 4 may process:

• Pages viewed, referring URLs, and on-site events such as searches and link clicks
• Browser, device, screen, language, and approximate location
• A client identifier stored in cookies such as _ga and _ga_RCEGDLDF2C
• Cookie-less technical signals Google uses to provide the service, such as truncated IP address. Google Analytics 4 does not store a full IP address in its reports

We use this to understand which pages are used, to measure the directory, and to improve content. We do not use Analytics to identify a named visitor. If Google signals or a similar Google setting is turned on for the property, Google may associate events with signed-in Google users under Google's own controls. You can limit that in your Google account and by rejecting measurement consent.

Google processes Analytics data as our service provider and also under its own terms where it determines the purposes. Event data is kept for the retention period set on the property, which is 2 months or 14 months. See Google's privacy policy and how Google Analytics uses data.

Google AdSense

With marketing consent, we use Google AdSense, publisher ID ca-pub-3865452541027172, to show ads. The AdSense script is not loaded until that category is allowed. Ads are not required to read the directory.

Google and other advertising vendors, working through Google, use cookies and similar technologies to serve and measure ads, including ads based on previous visits to this site and other sites. Those technologies can include cookies such as IDE, DSID, __gads, and __gpi, and local storage used by the Google tag. Vendors may receive your IP address, device and browser details, coarse location, ad interactions, and a cookie identifier.

We do not sell personal information for money. Allowing personalised advertising can be treated as "sharing" personal information or processing it for targeted advertising under US state laws, and as consent-based advertising under UK, EEA, and Swiss law. Rejecting marketing consent is how you opt out of that on this site. You can also control Google ads at Google Ads Settings. How Google uses information from sites that use its services is explained at policies.google.com/technologies/partner-sites.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on visits to this site and other sites on the Internet.

Other providers

• Vercel hosts the site and processes connection logs, including IP address, to deliver pages and protect the service. See Vercel's privacy policy.
• c15t, connected to our Inth project, stores your consent choice, a subject identifier, the time of the choice, and the coarse location used to select the consent rules that apply to you.
• Better Ranking Communications receives contact-form submissions so we can read and reply to them.
• The prison map requests map tiles from OpenStreetMap, or another tile host configured for the site. Your browser sends your IP address with those tile requests. See the OpenStreetMap Foundation privacy policy.

Fonts are served with the site. We do not load a separate Google Fonts request.

Why we use information

• To answer contact messages and keep a record of that correspondence. Legal basis, where UK or EU law applies: steps you asked us to take, and our legitimate interest in handling enquiries.
• To run, secure, and debug the site, including host logs and strictly necessary consent storage. Legal basis: legitimate interests, and, for consent storage, providing a service you request.
• To measure the site with Google Analytics 4. Legal basis: consent where consent is required. Where the law allows measurement until you object, you can still reject it in Privacy settings.
• To show and measure ads with Google AdSense. Legal basis: consent where consent is required. Rejecting marketing stops the AdSense script on later page loads.
• To meet legal duties, such as responding to a lawful request or keeping a record of a rights request.

We do not use personal information to make decisions that produce legal or similarly significant effects about you. We do not sell contact-form contents.

Where information is processed

We and our providers may process information in the United Kingdom, the European Economic Area, the United States, and other countries where those providers operate. Google and Vercel are established in the United States. Where UK or EEA law requires a transfer tool, we rely on an adequacy decision or on standard contractual clauses, together with the provider's supplementary measures. US providers may be required to disclose information to authorities under US law.

How long we keep it

• Contact messages: for as long as needed to handle the enquiry and for a reasonable period afterwards for records, disputes, and security, then deleted or de-identified.
• Host and security logs: for the period set by the host, typically days to a few months, unless we need a specific log to investigate abuse.
• Consent records: until you change or withdraw the choice, and for a limited period afterwards so we can show what was stored.
• Google Analytics 4 events: for the property retention period of 2 or 14 months. Google AdSense cookie lifetimes are set by Google and are described in the Cookie Policy.

Your choices

Use Privacy settings in the footer, or the controls in the Cookie Policy, to allow or reject measurement and marketing. Rejecting a category takes effect on the next load. Necessary cookies stay on because the site and the consent record need them.

You can also use:

• Google Ads Settings for Google advertising personalisation
• Google Analytics opt-out browser add-on
• Your Online Choices (EEA and UK)
• DAA WebChoices and NAI opt-out (United States)
• Digital Advertising Alliance of Canada

Industry opt-out pages are separate from this site's consent store. Use Privacy settings on this site as well.

Rights where you live

United Kingdom, EEA, and Switzerland

You can ask for access, correction, deletion, restriction, or a copy of personal information we hold, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing. You can complain to the UK Information Commissioner's Office, your EEA supervisory authority, or the Swiss Federal Data Protection and Information Commissioner. We respond within one month, or we tell you if we need longer.

United States

Residents of states with consumer privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others that grant similar rights, can ask to access, correct, or delete personal information, and to opt out of sale, sharing, and targeted advertising. We do not sell personal information for money. Personalised AdSense is the activity most likely to count as sharing or targeted advertising. Reject marketing cookies to opt out. We will not discriminate against you for exercising these rights. You may use an authorised agent. We may ask for information to verify the request. If we deny a request, you can appeal by replying through the contact form, and we will explain the outcome and, where the law provides it, how to contact your state attorney general.

California residents can also request the categories of personal information collected, the sources, the purposes, and the categories of recipients. In the last 12 months those categories are identifiers and internet activity from browsing and forms, and commercial information limited to the fact that an ad was eligible to be shown. We do not collect precise geolocation or use sensitive personal information to infer characteristics for advertising.

Canada, Brazil, Australia, and elsewhere

If the law where you live gives you access, correction, deletion, or a right to challenge our handling of personal information, including under Canada's PIPEDA and Quebec's Law 25, Brazil's LGPD, or the Australian Privacy Principles, contact us and we will honour the rights that apply. You may also complain to the privacy regulator in your country. Nothing in this policy limits rights that cannot legally be waived.

Children

The site is a general information resource. It is not directed at children under 16, and we do not knowingly collect personal information from children. Advertising on the site is not child-directed. If you believe a child has sent us personal information, contact us and we will delete it.

Security and changes

We use HTTPS and limit access to contact messages to the tools that receive them. No website can guarantee absolute security. We may update this policy when the site or the law changes. The date at the top is the latest version. Continued use after an update means the new policy applies to later visits. Consent-based processing still depends on the choice stored in Privacy settings.