Draft skeleton, not legal advice. This must be completed with the exact services you have installed and then reviewed by someone qualified in your jurisdiction. You have readers in the EU and UK, so GDPR applies regardless of where you are based, and a US business with New York contacts should also consider state privacy law.
What we collect, why, and what you can do about it.
Who we are
[ FILL IN ] Legal entity name, registered address, and the contact point for privacy questions. If you are required to appoint an EU or UK representative, name them here.
What we collect
- Newsletter subscribers. Email address, sign-up date, and open and click activity.
- Contact. Whatever you put in an email to us, kept as long as needed to deal with it.
- Analytics. [ FILL IN ] Name the tool and exactly what it records. If it is cookieless and does not store personal data, say so, because it materially changes your obligations.
- Server logs. IP address, browser and requested page, retained by our host for security and diagnostics.
- Affiliate clicks. [ FILL IN ] Networks may set identifiers when you click a link. Name them.
Why we collect it, and our legal basis
[ FILL IN ] State a lawful basis for each category. Newsletter is normally consent. Server logs and security are normally legitimate interests. Analytics depends on the tool. Under GDPR this has to be specific rather than general.
Who we share it with
[ FILL IN ] Name your host, CDN, email provider, analytics provider and affiliate networks, and link to each one’s privacy policy. Say whether any of them transfer data outside the EU or UK, and on what safeguard.
How long we keep it
[ FILL IN ] Give a period for each category. Newsletter data until you unsubscribe plus a stated period. Logs for a stated number of days. Emails for a stated period.
Your rights
Depending on where you live, you may have the right to see the data we hold about you, correct it, delete it, take it elsewhere, object to how we use it, or withdraw consent. To use any of these, write to us at the address below. We will respond within one month. If you are unhappy with our response you may complain to your data protection regulator.
Cookies
Set out separately in our cookie policy.
Children
This site is not directed at children and we do not knowingly collect data from anyone under 16.
Changes
We will update this page when our tooling changes, and note the date of the last revision below.
Contact
Last updated 6 September 2026.