Legal Basis & Data Processing Policy

1. Scope & Applicability

This policy applies to all personal data processed by Aevum News ("we", "us", or "our") across our digital platforms, including but not limited to aevumnews.com, associated mobile applications, newsletter systems, and partner integrations. It governs our role as both a data controller and, where specified, a data processor.

2. Legal Grounds for Processing

We process personal data only when a lawful basis exists under applicable data protection legislation. Our primary grounds include:

• Consent: For newsletter subscriptions, personalized content recommendations, and non-essential analytics/cookies.
• Contractual Necessity: Processing required to deliver subscription services, manage accounts, and process payments.
• Legitimate Interests: Fraud prevention, platform security, service improvement, and direct marketing where permitted by law.
• Legal Obligation: Compliance with tax, financial, and regulatory reporting requirements.
• Vital Interests & Public Task: Applied in exceptional circumstances involving press freedom, journalistic privilege, and public interest reporting.

For journalistic and editorial activities, we rely on recognized exemptions that balance data subject rights with freedom of expression and information, as permitted under GDPR Article 85 and equivalent national laws.

3. Data Categories Collected

We collect and process data strictly necessary for our journalistic, editorial, and service delivery functions:

Special category data (e.g., health, political opinions, biometrics) is never collected unless explicitly volunteered by the user in contexts such as reader submissions or public records, and only when legally permissible.

4. Retention & Minimization

Data is retained only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, or resolve disputes. Retention periods are determined by:

• Active Accounts: Data retained for the duration of the subscription plus 24 months post-cancellation for support and re-engagement.
• Transactional Records: Retained for 7 years to comply with financial and tax regulations.
• Analytics & Logs: Aggregated and anonymized after 12 months; raw logs purged after 90 days.
• Marketing Communications: Retained until consent is withdrawn or after 12 months of inactivity (soft opt-out).

We conduct biannual data audits to ensure minimization principles are upheld and outdated records are securely deleted.

5. User Rights & Exercising Them

Depending on your jurisdiction, you may have the following rights regarding your personal data:

1. Right to Access: Request a copy of the data we hold about you.
2. Right to Rectification: Correct inaccurate or incomplete information.
3. Right to Erasure: Request deletion where no legal or contractual basis requires retention.
4. Right to Restriction: Limit processing during verification or dispute periods.
5. Right to Data Portability: Receive your data in a structured, machine-readable format.
6. Right to Object: Opt out of direct marketing or legitimate interest processing at any time.

To exercise these rights, submit a verified request through our secure portal or contact our Data Protection Officer. We respond to all valid requests within 30 days, extendable by 60 days for complex queries.

6. Security & Breach Protocol

Aevum News implements industry-standard technical and organizational measures to safeguard personal data, including:

• End-to-end TLS 1.3 encryption for data in transit
• AES-256 encryption for data at rest
• Regular penetration testing and third-party security audits
• Role-based access controls and multi-factor authentication for internal systems
• Strict non-disclosure agreements for all employees and contractors

In the event of a confirmed data breach posing risk to individuals, we will notify affected users and relevant supervisory authorities within the statutory timeframe (typically 72 hours under GDPR). Incident reports will detail the nature of the breach, data involved, mitigation steps, and remediation measures.

7. Third-Party Processors

We engage trusted service providers to assist with platform hosting, payment processing, email delivery, and analytics. All processors are bound by Data Processing Agreements (DPAs) that mandate compliance with this policy and applicable law. Current processors include:

• Cloud Infrastructure: Secure, ISO 27001 certified hosting providers
• Payment Gateways: PCI-DSS Level 1 certified processors (Stripe, PayPal)
• Communication Platforms: GDPR/CCPA compliant email delivery services
• Analytics: Privacy-first, cookieless tracking frameworks where possible

We do not sell, trade, or rent personal data to third parties. Data sharing occurs solely for service fulfillment, legal compliance, or with explicit consent.

8. International Transfers

As a globally operating news organization, data may be transferred across borders. All international transfers are governed by:

• EU Standard Contractual Clauses (SCCs) 2021
• UK International Data Transfer Addendum
• Supplementary technical safeguards (encryption, pseudonymization)
• Regular transfer impact assessments (TIAs)

Server locations are primarily within the EU, UK, and North America. Users can request localization of their data upon request, subject to technical feasibility.

9. Policy Amendments

This legal framework is reviewed periodically to reflect changes in legislation, technology, and business operations. Material updates will be communicated via:

• Email notification to active subscribers
• Platform banner and in-app alerts
• Updated "Last Updated" timestamp on this page

Continued use of Aevum News services following policy updates constitutes acknowledgment of the revised terms. Users may withdraw consent or terminate accounts at any time if they do not agree with the changes.

10. Contact & Supervisory Authority

For questions regarding this policy, data processing activities, or to exercise your rights, please contact our Data Protection Office:

You also have the right to lodge a complaint with a relevant supervisory authority in your jurisdiction, such as the Information Commissioner's Office (ICO) in the UK or the relevant Data Protection Authority in the EU/EEA.