7. Third-Party Processors & Data Sharing
Last Updated: December 15, 2025
7.1 Overview of Data Processors
To deliver our news platform, analytics, subscription services, and security infrastructure, Aevum News engages third-party service providers who act as Data Processors on our behalf. These processors are contractually bound to handle your personal data solely for the purposes specified below, in full compliance with GDPR, CCPA, and applicable international data protection laws.
No processor is permitted to use, sell, or share your data for independent purposes. All cross-border transfers are governed by Standard Contractual Clauses (SCCs) or equivalent adequacy decisions.
7.2 Registered Processors & Data Flow
| Processor / Vendor | Category & Purpose | Data Shared | Retention | Location |
|---|---|---|---|---|
| Google Analytics | Analytics Usage tracking & performance | IP address, device ID, browsing behavior, cookies | 14 months | EU / US |
| AWS (Amazon Web Services) | Cloud Hosting Platform infrastructure | Account credentials, subscription status, metadata | Duration of service + 30 days | EU (Frankfurt) |
| Stripe | Payments Subscription & donation processing | Billing address, payment tokens, transaction logs | 7 years (tax compliance) | EU / US |
| SendGrid / Mailchimp | Communication Newsletter & alerts delivery | Email address, preferences, open/click data | Until unsubscribe + 90 days archive | US |
| Cloudflare | Security & CDN DDoS protection & content delivery | IP address, request headers, cache logs | 7 days | Global |
| Complianz / Cookiebot | Consent Management Cookie preference tracking | Consent choices, anonymized analytics ID | Duration of session + 12 months | EU (Netherlands) |
Note on Sub-processors: Certain processors may engage secondary vendors for specialized tasks (e.g., AWS may use regional data centers). We maintain visibility and approval rights over all sub-processor changes. A full sub-processor registry is available upon request.
7.3 Data Protection Safeguards
Every third-party engagement is governed by a Data Processing Agreement (DPA) that enforces:
- Strict purpose limitation and data minimization
- Encryption in transit (TLS 1.3+) and at rest (AES-256)
- Regular security audits & penetration testing
- Breach notification within 24 hours of discovery
- Right to audit and require data deletion upon termination
We conduct annual vendor risk assessments and retain the right to terminate processor contracts if compliance standards are not met.
7.4 Your Rights & Opt-Out Options
You maintain full control over your data, including how it is processed by our partners. You may:
Withdraw Consent
Opt out of non-essential analytics, marketing, or personalized content at any time via your account settings or cookie banner.
Manage PreferencesRequest Deletion
Submit a data erasure request that will be propagated to all active processors within 30 days, except where legal retention applies.
Submit RequestAccess & Portability
Download a structured export of all data shared with third-party processors, including logs and processing records.
Export Data7.5 Contact & Oversight
For questions regarding this section, processor disclosures, or data protection inquiries, please contact our Data Protection Officer:
Privacy Team: privacy@aevumnews.com
Postal Address: Aevum News Legal Dept., 42 Meridian Way, London EC2A 4PX, United Kingdom
Response Time: We commit to responding to all lawful requests within 30 calendar days.
This document is reviewed quarterly. The full privacy framework, including cookie policies and data retention schedules, is available at /privacy-policy.