***Caution***: Paypal Users - Page 11

**Paul** · 11-02-2005, 16:31

Quote:

Originally Posted by Bifta

Can I just repeat my earlier question re: the DPA and NTHW Ltd?

Well you would need to check with Frank - but I believe cableforum.co.uk and the forum database (and software) are owned by him, not nthw ltd. As I recall, nthw was set-up to deal with advertising revenue, but I'm not sure if this was ever actually implemented, as the amounts are quite small.

Bifta · 11-02-2005, 16:35

Quote:

Originally Posted by Paul M

Well you would need to check with Frank - but I believe cableforum.co.uk and the forum database (and software) are owned by him, not nthw ltd. As I recall, nthw was set-up to deal with advertising revenue, but I'm not sure if this was ever actually implemented, as the amounts are quite small.

Oh right, it's just that your company homepage mentions this as one of the "Official" site's it owns.

Quote:

NTHW own and maintain many websites, ranging from self-help information to blogs written by nthellworld.co.uk and Cable Forum members.
Below is the full list of NTHW websites:

Cable Forum
This is the main website run by the organisation and includes the following areas:
News from within the UK cable industry.
Problem solving and lively discussion in the bulletin board area.
Reviews and technical articles aimed at NTL, Telewest and other UK cable operators.

And your privacy policy mentions disputes to be first raised to CF, then to the Information Commissioner, so I was curious as to where our personal data stands with regards to coverage.

**Paul** · 11-02-2005, 17:17

Well the main page confirms what I thought ;

Quote:

NTHW Limited (registered as a company, number 5029862) was set up to handle the advertising revenue from the network of websites, primarily affiliate banner adverts on Nthellworld.co.uk and Cable Forum.

and I checked the domain, it is definitely still owned by Frank ;

Quote:

Domain Name:
cableforum.co.uk

Registrant:
Frank Whitestone

It looks like those other pages are just wrong, or out of date, and should really be updated. (the site still mentions the blogs as well as pem & Tezcatlipoca - and they changed over six months ago). I'm sure the relevant person will update or remove them as soon as they are able.

Bifta · 11-02-2005, 17:31

Quote:

Originally Posted by Paul M

Well the main page confirms what I thought ;

and I checked the domain, it is definitely still owned by Frank ;

It looks like those other pages are just wrong, or out of date, and should really be updated. (the site still mentions the blogs as well as pem & Tezcatlipoca - and they changed over six months ago). I'm sure the relevant person will update or remove them as soon as they are able.

It seems like a bit of a loophole, and I'm more than a little confused. Frank's in Canada, Frank owns the domain, does that mean that the personal data stored on members isn't covered by the DPA? A few members I'm sure can be personally identified through their email addresses and a whois, if that is the case, I'm confused about the privacy policy and why it mentions referring to the Information Commissioner or was that put in place in light of recent regulations surrounding terms & privacy details for web sites? Who is your companies data controller?

**Paul** · 11-02-2005, 17:42

Quote:

Originally Posted by Bifta

It seems like a bit of a loophole, and I'm more than a little confused. Frank's in Canada, Frank owns the domain, does that mean that the personal data stored on members isn't covered by the DPA? A few members I'm sure can be personally identified through their email addresses and a whois, if that is the case, I'm confused about the privacy policy and why it mentions referring to the Information Commissioner or was that put in place in light of recent regulations surrounding terms & privacy details for web sites? Who is your companies data controller?

Sorry, but I'm not able to answer those questions. I've told you as much as I know (as I understood it).

Bifta · 11-02-2005, 17:46

Quote:

Originally Posted by Paul M

Sorry, but I'm not able to answer those questions. I've told you as much as I know (as I understood it).

Do any of the other admins/mods know? Is there anyway you could pass on the question to Frank or do i need to email him directly?

**Paul** · 11-02-2005, 17:49

Quote:

Originally Posted by Bifta

Do any of the other admins/mods know? Is there anyway you could pass on the question to Frank or do i need to email him directly?

I'm sure Frank will see this when he next logs in.

Bifta · 11-02-2005, 17:50

Quote:

Originally Posted by Paul M

I'm sure Frank will see this when he next logs in.

Great!

HD462 · 11-02-2005, 17:54

Just found this thread, I got the email too, and haven't been registered on here that long (about 4 weeks). I did click the link at first, but got suspicious when the site was on an IP address rather than a normal url, so closed the window.

I've just been to my Paypal account and deleted my financial details. I've only ever used it twice anyway.

TheBlueRaja · 11-02-2005, 18:25

It cant be the old forum at NTHell then can it?

Given that there is more than 1 person who registered only recently and still got the mail.

I say that because their details wouldnt be in that old forum would they?

11-02-2005, 18:36

I think what Paul is saying is that there was an old (vulnerable) copy of the VB software on the nthellworld.co.uk domain (which still exists, but only as an entrypoint to cableforum), and this still had access to the CURRENT MySQL database.

Richard M · 11-02-2005, 18:36

Quote:

Originally Posted by TheBlueRaja

It cant be the old forum at NTHell then can it?

Given that there is more than 1 person who registered only recently and still got the mail.

I say that because their details wouldnt be in that old forum would they?

Yes, it used the same DB but old (and vulnerable) software.
Google have cleaned up their index now so not much is still there, but you could still browse to www.nthellworld.co.uk/forum/ until a few days ago.

TheBlueRaja · 11-02-2005, 18:41

Quote:

Originally Posted by JohnHorb

I think what Paul is saying is that there was an old (vulnerable) copy of the VB software on the nthellworld.co.uk domain (which still exists, but only as an entrypoint to cableforum), and this still had access to the CURRENT MySQL database.

Frank · 11-02-2005, 20:57

Quote:

Originally Posted by Bifta

It seems like a bit of a loophole, and I'm more than a little confused. Frank's in Canada, Frank owns the domain, does that mean that the personal data stored on members isn't covered by the DPA? A few members I'm sure can be personally identified through their email addresses and a whois, if that is the case, I'm confused about the privacy policy and why it mentions referring to the Information Commissioner or was that put in place in light of recent regulations surrounding terms & privacy details for web sites? Who is your companies data controller?

Sorry for the delay in replying. I had just typed out a long reply to your question and then Java decided to crash Firefox dammit!

Anyway, I will try and type out a similar response later tonight, but this is the quick version for now. Yeah, I live in Canada now, and yes the domain name is registered to me. Nobody really "owns" the website itself, I guess it kinda belongs to the community, in particular those that put a lot of work into the site. I don't consider that I "own" it as such, just because the rest of the team have put so much work into it. The stuff about the IC has been there in the Privacy policy from the day the site was launched. No we aren't registered with the IC, but as I'm a reasonably law-abiding citizen I am quite happy to direct people to the IC if they think we are abusing their data.

The stuff about the IC was put their voluntarily by me as a service to people.

There are hundreds, if not thousands, or websites in the UK that are not registered and that collect personal data - every single UK forum for that matter. It's arguable whether we should be registered or not, but like I said, I don't plan on screwing with anyone's personal information so was happy to have such a privacy policy.

As Paul said earlier, NTHW Ltd was set up to take care of ad revenues and so that members could see the financial status of the site, but I never really pushed this as I ended up moving. We didn't make any money as you know, and the site now runs on the generosity of the admin team and the members that donate. I'm currently in the process of dissolving the company as I'm still listed as a director and it's just not needed.

You are right in that it does seem like a bit of a loophole, but I'm not sure where we stand in relation to this loophole. I guess you could say that technically I was the data controller of the database, but I'm not sure where we stand technically now as I have moved to Canada and the database resides in New York. Regardless of where I or the site live, I'm still happy to voluntarily abide by any UK (or Canadian for that matter) data protection laws.

I hope this helps with your questions. If you have any more, then please post them back here and I will try and answer over the weekend.

sonygeezer · 12-02-2005, 03:46

I too received the said email on the email address I use for this site.