What I hold, and for how long

The short version

I hold your email address so I can send you the letter, plus a rough count of how many people opened it. That is the whole file. I do not sell it, rent it, trade it, or hand it to anybody who is not listed on this page, and one link at the bottom of every issue removes you for good.

What I collect

If you are on the list

• Your email address. You give it to me by writing in. I add addresses by hand.
• The name you sign with, if you happen to use one. It is optional and I only use it to answer you.
• The date you joined, so I can show you when you asked to be added if you ever query it.
• Whether an issue was opened, and which links in it were followed. This is counted per issue, and I look at the totals, not at individual readers. It tells me whether an issue landed at all.

If you only read the site

• No accounts, no analytics scripts, no advertising pixels and no tracking cookies. This site sets no cookies of its own.
• Standard server logs kept by the hosting provider: the requested address, the time, the browser string and a truncated IP address. They exist to keep the site up and to spot attacks.
• Fonts are requested from Google Fonts, which means your browser contacts Google’s servers when a page loads and Google sees that request. Nothing else on this site is loaded from a third party.

Why I am allowed to hold it

For the letter itself: your consent, given when you asked to be added, which you can withdraw at any moment. For the open and click counts, and for keeping the site online and secure: my legitimate interest in knowing whether the letter arrives and in not being knocked over by attacks. For anything a tax or records law requires me to keep: legal obligation.

How long I keep it

• Your address: until you leave. When you leave, it goes within seven days.
• A record that you unsubscribed: a one-way hash of your address, kept indefinitely, so a later import cannot accidentally add you back. It cannot be turned back into your address and it is used for nothing else.
• Open and click counts: twelve months, then deleted.
• Email you send me: twenty-four months, unless it is worth keeping longer as part of a pick, in which case I will ask you first.
• Server logs: whatever the host keeps, currently thirty days.

Who else touches it

Two kinds of company, both bound by a data-processing agreement and neither allowed to use your address for their own purposes:

• The service that sends the letter, which stores the list and posts the issues.
• The company that hosts this site, whose servers are in the European Union.

Where a processor operates outside the European Economic Area, the transfer runs on the European Commission’s standard contractual clauses. Beyond that, nobody. I will hand data to an authority only where a law in force actually compels me to, and I will tell you unless I am forbidden to.

Leaving, and your other rights

Every issue carries an unsubscribe link at the bottom. It works in one click, needs no reason and asks no questions. If it ever fails, write to me and I will remove you by hand.

Under the GDPR you can also ask me to show you what I hold, correct it, delete it, restrict what I do with it, hand it to you in a portable file, or object to the open and click counting. Write to contact@alopicks.com with the word privacy in the subject. I answer within thirty days and I do not charge for it.

If you think I have handled your data badly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, or to the supervisory authority where you live.

Children

The letter is written for adults and I do not knowingly hold data on anyone under sixteen. If you believe a child’s address is on the list, tell me and I will remove it.

Security, and when it fails

Access to the list is protected by a long unique passphrase and two-factor authentication, and the site is served over HTTPS only. No small operation can promise perfect security. If a breach ever puts you at risk, I will notify the Information Commissioner within seventy-two hours and email everyone affected with what happened and what to do.

Changes to this page

If I change anything that matters, the date at the top changes and the next issue says so in one line. I will not quietly widen what I collect.

Reaching me

There is one person to ask, and it is me. contact@alopicks.com, or Alo Picks, Trubarjeva cesta 47, 1000 Ljubljana, Slovenia.