UK Online Safety Act Notice

This Notice describes how ChefSphere OÜ ("ChefSphere") complies with the UK Online Safety Act 2023 ("OSA") for users accessing the Service from the United Kingdom. It supplements the Terms of Service, the Acceptable Use Policy, the Community Guidelines, the EU Digital Services Act Notice, the Children & Age Policy, and the Privacy Policy. OSA duties apply in addition to — not instead of — the DSA duties described in the EU DSA Notice.

1. Why we are in scope

OSA sections 4–6 apply to "user-to-user services" and "search services" with a significant number of UK users or targeted at UK users. ChefSphere is a user-to-user service: users post recipes, community prices, comments, reviews, live streams (Chef Lives), direct messages, and marketplace listings. We do not operate a regulated search service.

We classify the Service as a Part 3 user-to-user service, below the category-1 / category-2A / category-2B thresholds published by Ofcom. We are not designated in the current Ofcom register of categorised services. If we are designated, the additional duties for categorised services will be reflected in an updated version of this Notice.

2. Single point of contact

• For Ofcom and UK authorities: [email protected] — subject prefix "Ofcom / OSA".
• For UK users (in-app and out-of-app reporting): the in-app Report action on every post, profile, comment, listing, review, message, and live stream; and [email protected] as an out-of-app channel.
• For DSA authorities: [email protected] — unchanged by OSA.

3. Illegal content duties (s.9–s.10)

3.1 Risk assessment

We maintain an illegal-content risk assessment that evaluates the risk of each priority illegal content category from Schedule 7 OSA, having regard to the nature of the Service, the user base, the features (UGC posts, messaging, live streaming, marketplace), user-interaction patterns, UK audience size and demographics, functionalities that present or could present a risk, and past incident data. The assessment covers each category listed by Ofcom in its Illegal Harms Codes of Practice:

• Terrorism content and content promoting violence inspired by proscribed organisations.
• Child sexual exploitation and abuse (CSEA), including CSAM, grooming, and CSEA-related livestream.
• Encouraging or assisting suicide, self-harm, or eating disorders.
• Hate offences targeting protected characteristics.
• Harassment, stalking, threats, and abuse.
• Controlled drugs and psychoactive substances offences.
• Firearms and knives offences.
• Sexual image abuse — non-consensual intimate imagery and "deepfake pornography".
• Fraud and financial-services offences — fraudulent listings, romance scams, phishing.
• Proceeds-of-crime and unlawful immigration offences.
• Extreme pornography and obscene publications.
• Foreign interference offences.

The risk assessment is reviewed at least annually and on any material change to the Service. Outputs inform the safety measures in §3.2. The assessment is an internal document; we disclose its existence and scope here and cooperate with Ofcom in good faith if requested.

3.2 Safety measures

Measures are proportionate to the risk profile and tuned to the UK user context.

• Pre-publication classifiers for text, image, and video screen uploads for CSAM, terrorism, sexual image abuse, and extreme pornography signals. A classifier hit restricts or blocks publication and is always reviewable by a human on request.
• Report everywhere — every surface where a UK user can encounter content from another user exposes a Report control with category and free-text evidence. Reports are prioritised by severity (imminent threat, CSAM, self-harm, fraud).
• Trust-and-safety triage with a defined SLA, documented in the EU DSA Notice §5 and applied identically for UK reports.
• Strict response to CSAM, terrorism, and imminent threat-to-life. Removal without undue delay; notification to the Internet Watch Foundation (CSAM), Counter Terrorism Internet Referral Unit (terrorism), and to police (threat-to-life). Evidence is preserved as required by law.
• Repeat-offender policy under the Acceptable Use Policy and DSA Art. 23 — escalating consequences from content removal to feature suspension to account termination.
• User controls — block, mute, restrict DMs from non-followers, hide reactions, live-stream moderation tools, message-request filtering.
• Account-level filtering on high-risk patterns — automated detection of bulk fraudulent listings and coordinated inauthentic behaviour.
• Transparent moderation decisions — every substantive moderation action on a UK user's content comes with a Statement of Reasons and an appeal path via our internal complaint-handling system (DSA Art. 20) and, where applicable, out-of-court dispute-settlement (DSA Art. 21).

3.3 Records and transparency

We retain internal records of risk assessments, safety measures, and moderation actions. Aggregate statistics are included in the annual transparency report at https://chefsphere.app/legal/transparency-report. Where Ofcom imposes a transparency-report duty under ss.77–78 OSA for the Service, we will produce it on the published schedule.

4. Children's access assessment (s.11)

We have performed a children's access assessment. Because the minimum age to open a free ChefSphere account is 13 — and UK children aged 13 and above may register subject to the EEA/UK GDPR-K parental-consent rule for users below 16 — the Service is a Part 3 service likely to be accessed by children. The s.12 children's safety duties therefore apply.

5. Children's safety duties (s.12)

5.1 Age assurance

ChefSphere applies age-assurance techniques proportionate to the risk surface:

• Self-declared date of birth or age band at sign-up, with refusal below the global minimum.
• Re-confirmation or additional verification where a user updates their age in a way inconsistent with prior signals.
• EEA/UK parental-consent flow for users aged 13 to 16 minus one, per Children & Age Policy §2.
• Marketplace gates that require 16 for online purchases and 18 for in-person handovers.
• No behavioural advertising — we do not run third-party advertising on the Service, which removes a category of profiling risk for minors.

We keep our age-assurance choices under review against Ofcom's evolving expectations and the UK Age-Appropriate Design Code. Where Ofcom prescribes a specific age-assurance standard (for example for higher-risk surfaces such as live-chat between strangers), we will adopt the prescribed standard and update this Notice.

5.2 Protection of children from priority content

We protect children from primary priority content (pornography, content encouraging suicide, self-harm, or eating disorders) and from priority content (bullying, abusive, hateful, violent content; dangerous-stunt promotion; content that promotes harmful substances) by a combination of:

• Strict prohibitions in the Acceptable Use Policy and the Community Guidelines.
• Pre-publication classifiers and reactive review on reports.
• Teen-safe defaults — restricted audience on posts, restricted stranger DMs, stricter AI-safety mode, Chef Lives hosting restricted to users aged 18 and over, Chef Lives viewing for teens with additional safety filters on by default.
• No profiling-based suggestions for users identified as minors outside the core cooking purpose.

The full list of feature restrictions is in the Children & Age Policy §4.

5.3 Content design and default settings

• Default-safe privacy settings for teen profiles and followers, adjustable by the user and by a parent where applicable.
• "Safety by design" review for any new feature that can be used by a minor — completed before launch, documented internally.

6. Adult-user empowerment

For adult UK users of the Service, we provide:

• Block / mute / restrict controls on every UGC surface.
• Content filters — user-configurable filters to hide categories of lawful but potentially unwanted content (for example user-controlled hiding of raw-meat or offal content).
• Recommender-system transparency — the main parameters used to rank swipe discovery, the community feed, and marketplace listings are documented in the EU DSA Notice §14, which is equally visible to UK users. Under the UK Online Safety Act, the user-empowerment duties in s.14 apply to Category 1 services; ChefSphere is not a Category 1 service, so the duty to offer a non-personalised alternative is not engaged today. If Ofcom designates ChefSphere as Category 1, we will implement the s.14 features within the statutory deadline.
• Report controls that accept user-facing categories (bullying, harassment, hate, scam, sexual image abuse, etc.) so adult users can influence how a report is triaged.

7. Reporting pathways for UK users

UK users can report at any of the following:

1. In-app Report action on any post, profile, comment, listing, review, message, or live stream — recommended because it ties the report to the content identifier and accelerates triage.
2. Email: [email protected] — also accepts anonymous reports for CSAM.
3. Postal: ChefSphere OÜ, c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia, Attn: Trust & Safety.
4. Emergency (risk to life): local police on 999, then notify us at [email protected] with subject [EMERGENCY].

Reports accepted for review produce an acknowledgement and a reasoned outcome where contact details are provided. Users who disagree with a moderation decision may escalate through the internal complaint-handling system described in the EU DSA Notice §7.

8. Fraud and scam duties (s.10(5) OSA — priority offences)

Because the Tools Marketplace and Ebook Marketplace carry an inherent scam-risk surface, we apply additional controls:

• Trader traceability (DSA Art. 30) before a worldwide listing can go live — identity verified through Stripe Express KYC.
• Cash-path safeguards for in-person and rental flows — the In-Person Safety addendum covers counterfeit-note checks, prohibited payment methods, ID-check prompt for high-value orders, and safe-location recommendations.
• Listing moderation — prohibited items and prohibited payment requests (wire transfer, cryptocurrency, gift cards) are flagged pre-publication and reactively.
• Seller trust tiers that limit exposure for new sellers and for sellers with an elevated dispute rate.

9. Communications offences

Content that falls under the s.179 OSA "false communications" or s.181 OSA "threatening communications" offence is prohibited by the Acceptable Use Policy and subject to immediate removal on report. ChefSphere cooperates with UK police on lawful requests, per the Law Enforcement Guidelines.

10. Transparency and ongoing compliance

• Ofcom engagement. We will respond to Ofcom information notices and cooperate with statutory investigations through the single point of contact in §2.
• Changes to the Codes of Practice. When Ofcom publishes a new or revised Code of Practice that applies to our service tier, we review our posture and update this Notice and the internal risk assessment within the period Ofcom specifies.
• Categorisation. If the Service is ever added to the Ofcom register of categorised services, the additional category-1 / 2A / 2B duties will apply and this Notice will reflect them at the effective date.

11. Relationship to the EU Digital Services Act

OSA duties are cumulative with DSA duties. Where a measure satisfies both regimes, we implement it once and document the dual basis. Where OSA imposes an incremental duty (for example a specific reporting path to Ofcom for a category-1 service, if we are ever designated), the incremental duty is implemented on top of the DSA equivalent.

12. Changes

We update this Notice when our Service, our processes, or UK law change materially. Material changes are announced in-app or by email at least 15 days before they take effect, unless law or an imminent safety concern requires a shorter period. The effective date and version in the header control.

13. Contact summary

• Ofcom / UK authorities: [email protected]
• UK users / trust & safety: [email protected]
• DSA single point of contact: [email protected]
• DPO / data protection: [email protected]
• Postal: ChefSphere OÜ, c/o E-Residency Hub OÜ, Ahtri tn 12, 10151 Tallinn, Harju maakond, Estonia