Privacy Policy
✅ Plain English summary: We collect only the data we need to run the platform — your account details, usage logs, and any information you voluntarily submit. We don't sell your data to anyone. Ever. You can request deletion at any time.
Data Controller
The data controller responsible for your personal data collected through NewsletterExample is:
NewsletterExample
Via Example 1, 00100 Rome, Italy
📧 privacy@newsletterexample.com
🌐 newsletterexample.com
Data We Collect
We collect the following categories of personal data:
| Category | Data points | Source | Required? |
|---|---|---|---|
| Account data | Full name, email address, hashed password, registration date, last login | You provide directly on registration | Required |
| Usage data | Emails read, favourites saved, searches performed, filters used, session timestamps | Automatically collected when you use the Platform | Required |
| Technical data | IP address, browser type, device type, operating system, session token | Automatically collected by our servers | Required |
| Suggestion data | Company name, website URL, your name, your email, IP address | You provide when submitting a newsletter suggestion | Optional |
| Communication data | Content of messages sent to us via email or contact forms | You provide when contacting us | Optional |
We do not collect sensitive personal data (special categories under GDPR Art. 9) such as health data, racial or ethnic origin, political opinions, or biometric data.
How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing and operating the Platform | Account data, usage data, technical data | Contract |
| Authentication and security | Account data, technical data | Contract |
| Personalising your experience (favourites, read status) | Usage data, account data | Contract |
| Processing newsletter suggestions | Suggestion data | Contract / Consent |
| Sending notification emails (suggestion approved, etc.) | Account data, suggestion data | Consent |
| Preventing abuse and rate-limiting | Technical data (IP address) | Legitimate interest |
| Improving the Platform and fixing bugs | Usage data, technical data (anonymised) | Legitimate interest |
| Complying with legal obligations | Any relevant data | Legal obligation |
We do not use your data for advertising, profiling for marketing purposes, or sale to third parties.
Legal Basis under GDPR
For users in the European Economic Area (EEA), we process your personal data on the following legal bases under the GDPR (Regulation EU 2016/679):
- Contract (Art. 6(1)(b)): Processing necessary to provide the service you signed up for
- Consent (Art. 6(1)(a)): When you voluntarily provide optional information such as your email for suggestion notifications
- Legitimate interests (Art. 6(1)(f)): For security, abuse prevention, and platform improvement — where our interests do not override your rights
- Legal obligation (Art. 6(1)(c)): When required by applicable law
Data Retention
| Data type | Retention period | Reason |
|---|---|---|
| Account data | Until account deletion + 30 days | Account management |
| Usage logs (favourites, reads) | Duration of account | Service functionality |
| Technical / server logs | 90 days | Security & abuse prevention |
| Newsletter suggestion data | 2 years from submission | Reference and duplicate detection |
| Approved suggestion (name credited) | Indefinitely (public record) | Attribution |
| Legal correspondence | 5 years | Legal compliance |
After retention periods expire, data is permanently deleted or anonymised. You may request earlier deletion as described in Section 8.
Sharing and International Transfers
We do not sell, trade, or rent your personal data. We may share data with:
- Hosting providers: Our server and database infrastructure (currently hosted within the EU/EEA)
- Email service providers: To send transactional notifications (e.g. suggestion approval emails)
- Law enforcement: When required by valid legal process, court order, or applicable law
Any third-party processors are bound by data processing agreements compliant with GDPR Art. 28. We do not transfer personal data to countries outside the EEA without appropriate safeguards (adequacy decision or Standard Contractual Clauses).
Cookies and Session Data
We use strictly necessary cookies to operate the Platform:
| Cookie name | Purpose | Duration | Type |
|---|---|---|---|
nlex_session |
Maintains your authenticated session | 7 days (or until logout) | Strictly necessary |
We do not use tracking cookies, advertising cookies, or third-party analytics cookies. We do not use Google Analytics or any similar tracking services. No consent banner is required for strictly necessary cookies.
Your Rights
Under GDPR and applicable data protection law, you have the following rights regarding your personal data:
Request a copy of all personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your personal data ("right to be forgotten")
Request that we limit how we use your data in certain circumstances
Receive your data in a structured, machine-readable format
Object to processing based on legitimate interests
To exercise any of these rights, contact us at privacy@newsletterexample.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Italy: Garante per la protezione dei dati personali).
Children's Privacy
The Platform is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly.
Security Measures
We implement appropriate technical and organisational measures to protect your personal data:
- Passwords are hashed using bcrypt with a cost factor of 12 — plain-text passwords are never stored
- Session cookies are set with
HttpOnly,Secure, andSameSite=Laxflags - All database queries use PDO prepared statements to prevent SQL injection
- HTTPS/TLS encryption for all data in transit
- Rate limiting on form submissions to prevent abuse
- Access to production data is restricted to authorised administrators only
Despite these measures, no system is 100% secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR Art. 33–34.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify registered users of significant changes by email and update the "Last updated" date at the top of this page.
Your continued use of the Platform after changes are posted constitutes your acceptance of the revised policy.
Contact and Data Protection Officer
For all privacy-related enquiries, requests, or complaints, please contact us:
Privacy & Data Protection
📧 Email: privacy@newsletterexample.com
📬 Postal: Attn: Data Protection, Via Example 1, 00100 Rome, Italy
We aim to respond to all privacy requests within 30 days. For urgent matters, please indicate "URGENT" in your email subject line.
If you are not satisfied with our response, you have the right to lodge a complaint with the Italian supervisory authority: Garante per la protezione dei dati personali, or with the supervisory authority in your country of residence.