GDPR Compliance Center

Aevum News collects and processes personal data in strict accordance with GDPR principles. We only collect data that is necessary for the specified purposes and ensure transparency about every piece of information we gather.

Directly Provided Data

Data you voluntarily provide when interacting with our services:

Data Type	Purpose	Legal Basis
Full Name	Account creation & profile	Contractual Necessity
Email Address	Communication & newsletter delivery	Consent / Legitimate Interest
Password (hashed)	Account authentication	Contractual Necessity
Billing Information	Subscription processing	Contractual Necessity
Phone Number	Account verification	Consent
Newsletter Preferences	Content personalization	Consent
Demographic Data	Analytics & content improvement	Legitimate Interest

Automatically Collected Data

Information gathered when you interact with our websites, apps, or services:

• IP Address — Server logs, fraud detection, geographic localization
• Device Information — Browser type, OS, device identifiers, screen resolution
• Usage Data — Pages visited, click patterns, session duration, referral sources
• Cookie Data — See our detailed Cookie Policy (Section 04)
• Location Data — Approximate geographic location based on IP
• Log Data — Server access logs, error reports, performance metrics

Specially Protected Data

We do not collect special category data (GDPR Article 9) including:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic, biometric, or health data
• Sexual orientation or sex life data

If you voluntarily provide any such data (e.g., through a contact form), we will delete it immediately and not process it further.

Under GDPR Article 6, we process personal data based on the following lawful grounds. We assess each processing activity individually to ensure a valid legal basis exists.

1. Contractual Necessity (Article 6(1)(b))

Processing necessary to perform a contract or take steps at your request prior to entering a contract:

• Managing your Aevum News account
• Processing subscription payments
• Delivering premium content as agreed
• Providing customer support for paid services

2. Legitimate Interest (Article 6(1)(f))

Processing for our legitimate business interests, provided these do not override your fundamental rights:

• Improving our website and services through analytics
• Network and information security
• Preventing fraud and unauthorized access
• Internal business operations and reporting
• Sending related promotional communications (with opt-out)

3. Consent (Article 6(1)(a))

Processing based on your freely given, specific, informed, and unambiguous consent:

• Newsletter subscriptions
• Non-essential cookies and tracking technologies
• Marketing communications
• Third-party content sharing

Consent can be withdrawn at any time with the same ease as it was given. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

4. Legal Obligation (Article 6(1)(c))

Processing necessary for compliance with a legal obligation:

• Financial record keeping (tax requirements)
• Law enforcement disclosure when legally compelled
• Data retention for cybersecurity purposes

As an EU data subject, you have the following rights under GDPR. You can exercise any of these rights free of charge by contacting our Data Protection Officer at dpo@aevumnews.com.

Aevum News uses cookies and similar tracking technologies to provide, secure, and improve our services. We obtain your consent before placing non-essential cookies via our cookie consent management platform.

Cookie Categories

Managing Cookie Preferences

You can manage your cookie preferences at any time through:

1. Cookie Consent Banner: Click "Cookie Settings" in the banner to modify preferences
2. Account Settings: Navigate to Privacy Settings → Cookie Preferences
3. Browser Settings: Block or delete cookies through your browser's settings menu
4. Do Not Track: We respect DNT signals and will disable non-essential tracking

Cookie Retention Periods

Cookie Type	Duration	Purpose
Session ID	Session only	Authentication & navigation
Consent Preferences	12 months	Remember cookie choices
Analytics (anonymized)	24 months	Usage statistics
Marketing / Tracking	6 months	Ad personalization
CSRF Tokens	1 hour	Form security

We retain personal data only for as long as necessary for the purposes collected, in compliance with the GDPR storage limitation principle (Article 5(1)(e)).

Retention Schedule

Data Category	Retention Period	Basis
Active Account Data	Duration of account + 90 days post-deletion	Contractual Necessity
Subscription Records	7 years (tax compliance)	Legal Obligation
Newsletter Subscription	Until consent withdrawn	Consent
Comment Data	Duration + 24 months	Legitimate Interest
Server Access Logs	90 days	Security / Legitimate Interest
Analytics Data	26 months (anonymized after 12 months)	Legitimate Interest
Email Correspondence	3 years	Legitimate Interest
Support Ticket Data	24 months	Legitimate Interest
Marketing Preferences	Duration + 12 months	Consent
Account Deletion Logs	5 years	Legal / Compliance

Deletion Process

When data retention periods expire or you exercise your right to erasure:

1. Data is flagged for deletion in our primary systems
2. Backup data is marked for automatic purge in the next backup cycle (max 90 days)
3. Third-party sub-processors receive deletion notices within 30 days
4. Deletion is logged and confirmed in writing upon request

Aevum News implements appropriate technical and organizational measures (GDPR Article 32) to protect personal data against unauthorized access, loss, alteration, and disclosure.

Technical Safeguards

• Encryption in Transit: TLS 1.3 for all data transmission. HSTS enforcement across all domains.
• Encryption at Rest: AES-256 encryption for databases, backups, and file storage.
• Access Controls: Role-based access control (RBAC) with least-privilege principle. MFA required for all admin access.
• Penetration Testing: Quarterly penetration tests by independent security firms (last audit: Q4 2024)
• Vulnerability Scanning: Continuous automated scanning with SLA of 24 hours for critical findings
• Key Management: Hardware Security Modules (HSM) for cryptographic key management
• Network Security: Next-gen firewalls, DDoS protection, Web Application Firewall (WAF)
• Logging & Monitoring: Real-time SIEM with automated incident detection and response

Organizational Safeguards

• Data Protection Training: Mandatory GDPR training for all employees (annual refresh)
• NDAs: All staff sign confidentiality agreements covering data protection obligations
• Incident Response: Documented breach response plan with 72-hour reporting protocol
• Business Continuity: DR plans tested quarterly with RTO of 4 hours, RPO of 1 hour
• Vendor Management: Rigorous due diligence for all data processors
• Physical Security: Biometric access controls for all data center facilities

Data Breach Notification

In the event of a personal data breach, we will:

1. Detect and contain the breach within 1 hour
2. Assess the risk to data subjects within 4 hours
3. Notify our supervisory authority within 72 hours (Article 33)
4. Notify affected data subjects without undue delay where risk is high (Article 34)
5. Maintain a detailed breach register documenting facts, effects, and remedial actions

Where we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place in compliance with GDPR Chapter V (Articles 44–50).

Transfer Mechanisms Used

• EU Standard Contractual Clauses (SCCs): Adopted per the European Commission's Updated SCCs (2021/914). Applied to all third-country transfers.
• UK International Data Transfer Agreement (IDTA): For transfers from the UK.
• European Commission Adequacy Decisions: Transfers to countries deemed adequate (e.g., Canada, Japan, South Korea, Switzerland).
• Binding Corporate Rules (BCRs): Where applicable for intra-group transfers.

Transfer Destinations

Service	Destination	Safeguard
Cloud Infrastructure (AWS)	EU (Frankfurt, Ireland)	Adequacy Decision
CDN (Cloudflare)	Global (with EU data center)	SCCs + EU-US DPF
Analytics (Google Analytics 4)	US (with EU data processing)	SCCs + EU-US DPF
Email Service	EU (Netherlands)	Adequacy Decision
Payment Processing	EU (Switzerland)	Adequacy Decision
Backup Storage	EU (Germany)	Adequacy Decision

We engage sub-processors only after rigorous due diligence. All sub-processors are bound by GDPR-compliant Data Processing Agreements (DPAs) that mandate equivalent data protection standards.

Current Sub-Processors

Service Provider	Purpose	Location	Status
Amazon Web Services (AWS)	Cloud hosting, storage, compute	EU (Frankfurt)	EU Compliant
Cloudflare	CDN, DDoS protection, WAF	Global (EU ops)	Sch. Approved
Google Cloud Platform	Analytics, AI processing	EU (Netherlands)	EU Compliant
Stripe	Payment processing	EU (Ireland)	EU Compliant
SendGrid / Postmark	Email delivery	EU (Netherlands)	Sch. Approved
Auth0 / Okta	Identity & access management	EU (Ireland)	EU Compliant
Datadog	Monitoring & observability	EU (Ireland)	Sch. Approved
Sentry	Error tracking & debugging	EU (Netherlands)	Sch. Approved

A full, up-to-date list of sub-processors is available at aevumnews.com/subprocessors and is updated quarterly. We provide 30 days' notice before adding any new sub-processor.

Aevum News is committed to protecting the privacy of children. We comply with GDPR provisions regarding children's consent and the UK Age Appropriate Design Code (Children's Code).

Our Policy

• Aevum News is not directed at children under 16 (or lower where applicable per local law)
• We do not knowingly collect personal data from children under the age of consent
• If we discover we have inadvertently collected data from a child, we will delete it immediately
• Parents/guardians can contact us to request removal of any child's data

We may update this GDPR Compliance Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify users of material changes through:

• Email notification to registered users (minimum 30 days prior)
• Website banner prominently displayed on our homepage
• In-app notifications for premium subscribers
• Updated revision date at the top of this page

Current Version History

Version	Date	Changes
v3.2	Jan 15, 2025	Updated sub-processor list; Added EU-US DPF references
v3.1	Sep 1, 2024	Updated cookie policy; Added AI processing disclosures
v3.0	Mar 15, 2024	Major revision; Added SCCs update; Restructured sections
v2.0	Jan 1, 2024	Added UK DPA 2018 alignment; Updated retention periods
v1.0	May 25, 2018	Initial GDPR compliance publication

For any questions, requests, or concerns regarding data protection, privacy, or GDPR compliance, please contact our designated Data Protection Officer:

Supervisory Authority

If you wish to lodge a complaint with a regulatory authority, our lead supervisory authority is:

Additional Information

Data Controller: Aevum News B.V.
Registration Number: NLXXXXXXXX
VAT Number: NLXXXXXXXXXXB01
Registered Address: Aevum News B.V., Media Plaza 42, 1185 DB Amstelveen, Netherlands
GDPR Representative: EU Representative available upon request
UK GDPR Representative: UK Rep available upon request