Commitment

At EU DataWatch, protecting your personal data and upholding your fundamental right to privacy is not merely a legal obligation; it is our primary institutional mission. As an independent digital publication dedicated to examining European data protection jurisprudence, digital rights, and algorithmic accountability, we hold our own operations to the highest standard of data ethics and statutory compliance under the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR) and the ePrivacy Directive (Directive 2002/58/EC).

This Privacy Policy explains with total transparency how we process personal data when you visit our website (https://www.eudatawatch.com/), subscribe to our publications, interact with our newsroom, or participate in our events. We practice strict data minimization, deploy zero invasive tracking technologies, and never sell or monetize your personal information.

Who Is Responsible

The data controller responsible for the processing of your personal data under GDPR Article 4(7) is the designated legal publishing entity of EU DataWatch, as identified on our Publisher and Legal Information page.

We have appointed an independent Data Protection Officer (DPO) to oversee our ongoing compliance with European data protection legislation. You may contact our DPO directly regarding any privacy inquiries or data subject rights requests via privacy@eudatawatch.com.

Scope

This Privacy Policy applies to all processing of personal data carried out through our website, mobile interfaces, email newsletters, reader surveys, event registrations, and administrative correspondence.

It also outlines the special statutory legal frameworks governing our processing of personal data for journalistic purposes in accordance with GDPR Article 85.

Personal Information

We process personal data only when strictly necessary to fulfill specific, documented purposes. Depending on your interactions with EU DataWatch, this may include: Technical access logs (IP address, browser user-agent, access timestamps); Contact details (name, email address, institutional role) when you subscribe to newsletters or submit inquiries; Billing information when purchasing subscriptions (processed securely by PCI-DSS certified payment processors); and Professional biographical details for contributing authors.

Sources of Information

We collect personal data primarily directly from you when you provide it via web forms or email correspondence. In limited circumstances, our journalists collect personal data from publicly accessible registries, regulatory filings, corporate registers, and official publications in the course of legitimate investigative reporting.

Purposes

We process your data exclusively for lawful purposes: Providing access to our journalistic content and website functionality; Delivering email newsletters and editorial alerts you requested; Processing digital subscription transactions; Responding to correspondence, correction requests, and formal complaints; Ensuring platform cybersecurity and preventing malicious cyberattacks; and Fulfilling statutory legal, tax, and regulatory compliance obligations.

Lawful Basis

Our processing is grounded strictly upon recognized legal bases under GDPR Article 6(1): Consent (Art. 6(1)(a)) for optional newsletter subscriptions and non-essential cookies; Contractual Necessity (Art. 6(1)(b)) for managing paid reader memberships and subscription fulfillment; Legal Obligation (Art. 6(1)(c)) for statutory accounting, tax, and regulatory compliance; and Legitimate Interests (Art. 6(1)(f)) for securing our IT infrastructure, preventing fraud, and defending legal claims, balanced against your fundamental rights.

Editorial and Journalistic Processing

Under GDPR Article 85 and applicable Member State media legislation, the processing of personal data carried out exclusively for journalistic purposes and freedom of expression is subject to specialized legal exemptions from certain GDPR provisions (such as the right to erasure or prior notice).

This exemption ensures that investigative journalism can hold powerful public and corporate figures accountable without facing prior restraint or censorship. However, our newsroom adheres strictly to our published Editorial Ethics and data minimization standards.

Sensitive Information

EU DataWatch does not solicit or process special categories of personal data (GDPR Article 9)—such as biometric data, health records, religious beliefs, or political opinions—from website readers. In our investigative journalism, sensitive data is processed only when strictly necessary and justified by an overwhelming public interest.

Children

Our digital platform is designed for professional and adult audiences and is not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If we discover that personal data of a minor has been collected without verified parental consent, it will be deleted immediately.

Website Technical Data

When you access https://www.eudatawatch.com/, our web servers temporarily record technical server telemetry (including IP addresses, requesting URL, HTTP status codes, and user-agent strings). This data is processed under our legitimate interest to deliver web pages, ensure server load balancing, and defend against denial-of-service (DDoS) attacks. Raw IP logs are automatically truncated or deleted within 14 days.

Cookies and Similar Technologies

We adhere to strict privacy-by-design principles: we deploy only essential session cookies required for core website functionality and security. We do not deploy third-party advertising cookies, cross-site tracking scripts, or device fingerprinting. Full details are set forth in our Cookie Policy.

Correspondence

When you contact our newsroom or administrative desks via email, we process your contact information and message content solely to evaluate, investigate, and respond to your inquiry. Correspondence is retained in our secure communications archive.

Corrections, Complaints and Rights of Reply

Personal data submitted in connection with formal correction requests, editorial complaints, or rights of reply is processed to investigate the claim, verify evidence, and maintain institutional records. Such records are retained for seven years to support legal compliance and accountability.

Authors and Contributors

Personal information, contracts, and banking details of contributing authors and freelance journalists are processed for contract execution, payment administration, tax reporting, and byline attribution.

Newsletters

If you opt in to our email newsletters, we process your email address to deliver our editorial roundups. You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link present in every newsletter.

Commercial Enquiries

Inquiries regarding commercial sponsorships, display advertising, or syndication are processed exclusively by our commercial division to negotiate and manage commercial agreements.

Security and Accessibility Reports

Communications received via security@eudatawatch.com or accessibility@eudatawatch.com are processed to remediate technical vulnerabilities and accessibility barriers, and are retained until resolution.

Public Sources and Social Media

Our journalists may consult publicly available professional profiles (such as LinkedIn or academic directories) to verify expert sources. We do not scrape social media profiles for automated profiling.

Sharing

EU DataWatch never sells, leases, or trades personal data to third parties. We share data only with trusted technical service providers (such as hosting infrastructure and secure email gateways) operating under strict GDPR Article 28 Data Processing Agreements, or when required by binding statutory court orders.

International Processing

Our primary hosting infrastructure is located within the European Economic Area (EEA). If technical service providers process data outside the EEA, we ensure that appropriate safeguards are implemented in compliance with GDPR Chapter V, including European Commission Standard Contractual Clauses (SCCs) and supplementary technical encryption.

Retention

Personal data is retained only for as long as necessary to fulfill the documented processing purpose or comply with statutory retention mandates (e.g., tax records retained for statutory periods). Server access logs are erased within 14 days.

Security and Incidents

We employ enterprise-grade technical and organizational security measures—including TLS 1.3 encryption, access controls, multi-factor authentication, and intrusion detection systems—to protect personal data against unauthorized access, loss, or alteration.

In the event of a personal data breach posing a risk to rights and freedoms, we will notify the competent supervisory authority and affected individuals in accordance with GDPR Articles 33 and 34.

Rights

Under GDPR Articles 15 through 22, you possess fundamental data subject rights, including: Right of Access (Art. 15); Right to Rectification (Art. 16); Right to Erasure / ‘Right to be Forgotten’ (Art. 17); Right to Restriction of Processing (Art. 18); Right to Data Portability (Art. 20); Right to Object (Art. 21); and the Right to Withdraw Consent at any time.

Exercising Rights

You may exercise your data protection rights free of charge by contacting our Data Protection Officer at privacy@eudatawatch.com. We respond to verified requests within one month, as required by law.

Deletion and Published Journalism

Please note that under European jurisprudence and GDPR Article 85, rights of erasure and objection do not apply to personal data legitimately published as part of lawful public-interest journalism, preserving historical archives and freedom of expression.

Direct Marketing and Automated Decisions

We do not engage in unsolicited direct marketing, telephone solicitation, or automated decision-making and profiling that produces legal effects concerning you under GDPR Article 22.

External Links and Policy Changes

Our website contains hyperlinks to external legal registries and news sources. We are not responsible for the privacy practices of external websites. We review and update this Privacy Policy periodically, publishing changes with a revised effective date.

Contact and Complaints

For all privacy inquiries, or if you believe your data protection rights have been infringed, please contact our DPO: Data Protection Officer: privacy@eudatawatch.com
Legal Department: legal@eudatawatch.com
General Inquiries: contact@eudatawatch.com
You also have the statutory right to lodge a formal complaint with the competent supervisory authority in your European Union Member State of residence, place of work, or place of the alleged infringement.