Legal
Privacy, Data & Cookie Policy
We respect your privacy and are committed to protecting your personal data. This page covers our Privacy Policy, GDPR Art. 28 Data Processing Agreement, and Cookie Policy.
Last updated May 19, 2025
Jurisdiction Germany / EU GDPR / BDSG / ePrivacy
GDPR / BDSG Compliant Privacy-First Approach
This document is written in compliance with the EU General Data Protection Regulation (GDPR),
the German Federal Data Protection Act (BDSG), and the ePrivacy Directive. We do not use
advertising cookies, tracking pixels, or cross-site profiling. Analytics are anonymised and
privacy-respecting. If you require a signed DPA for your organisation, contact us at [email protected].
Part 1: Privacy Policy
What personal data we collect, why we collect it, and how long we keep it.
Contents
01
Who We Are
LinkPress™ is operated by Mithun A. Sridharan, based in Heidelberg, Germany. We publish editorial content, software resources, and tools at https://linkpress.app. For privacy-related questions, contact us at [email protected].
02
Data We Collect
Contact submissions — Name, email address, and message content when you use our contact form.
Newsletter subscriptions — First name, last name, organisation, country, and email address when you subscribe.
Usage analytics — Anonymised page views and browser metadata via privacy-respecting analytics; no cross-site tracking.
Cookies — Essential cookies for site functionality and your theme preference. See Part 3: Cookie Policy for details.
Server logs — IP addresses, timestamps, and request metadata retained for up to 30 days for security purposes.
03
Legal Basis for Processing
Consent (Art. 6(1)(a) GDPR) — Newsletter subscriptions and non-essential cookies, where you have given explicit opt-in consent.
Legitimate interests (Art. 6(1)(f) GDPR) — Server security logs, fraud prevention, and basic analytics to operate and improve the site.
Contractual necessity (Art. 6(1)(b) GDPR) — Processing contact and transactional data necessary to respond to your enquiries or fulfil requests.
04
How We Use Your Data
Delivering the service — Responding to contact form submissions and sending newsletter issues you subscribed to.
Site security — Detecting and preventing abuse, spam, and unauthorised access.
Analytics improvement — Understanding which content resonates so we can improve quality and coverage.
Legal compliance — Meeting our obligations under applicable data protection law.
06
Data Retention
Newsletter subscribers — Retained until you unsubscribe. Unsubscribed records are kept for compliance audit purposes for 12 months.
Contact submissions — Retained for 24 months to support any follow-up queries, then permanently deleted.
Server logs — Retained for 30 days for security analysis, then automatically purged.
Analytics — Aggregated and anonymised; no individual retention period applies.
07
International Transfers
Where personal data is transferred outside the European Economic Area (EEA), such transfers are subject to appropriate safeguards: EU Standard Contractual Clauses (SCCs) adopted under Commission Decision 2021/914, adequacy decisions, or participation in the EU-US Data Privacy Framework. Copies of relevant SCCs are available on request.
08
Your Rights
Access — Request a copy of the personal data we hold about you.
Rectification — Ask us to correct inaccurate or incomplete data.
Erasure — Request deletion of your personal data (right to be forgotten).
Restriction — Ask us to restrict processing in certain circumstances.
Portability — Receive your data in a structured, machine-readable format.
Objection — Object to processing based on legitimate interests.
Withdraw consent — Unsubscribe from emails at any time using the link in every message.
Lodge a complaint — Contact your national data protection authority. Our lead supervisory authority is the LfDI Baden-Württemberg; see Part 2: for details.
09
Children's Privacy
Our services are not directed at persons under 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.
10
Security
Encryption in transit — All data transmitted between your browser and our infrastructure uses TLS 1.2 or higher.
Encryption at rest — Sensitive data, including subscriber records, is encrypted at rest using AES-256.
Access controls — Access to personal data is restricted to personnel who require it to perform their role. Access is reviewed periodically.
Incident response — We maintain an incident response procedure. Personal data breaches are reported to the supervisory authority within 72 hours if required under Art. 33 GDPR.
Pseudonymisation — Where practical, analytics data is pseudonymised or aggregated to reduce re-identification risk.
11
Changes to This Policy
We may update this Privacy Policy from time to time. The Last updated date at the top of this page reflects when changes were last made. Significant changes will be communicated via a notice on our site or by email to newsletter subscribers.
Part 2: Data Processing Agreement
Technical and organisational measures for personal data protection under GDPR Article 28.
DPA Contents
01
Scope & Purpose
This Data Processing Agreement (DPA) forms part of the Terms of Use between ${siteConfig.name} (Processor or Controller, depending on context) and the data subject or contracting party (you). It documents the technical and organisational measures we apply to protect personal data processed on your behalf or concerning you, in accordance with Art. 28 GDPR.
02
Key Definitions
Personal Data — Any information relating to an identified or identifiable natural person, as defined in Art. 4(1) GDPR.
Processing — Any operation or set of operations performed on personal collection, recording, storage, use, disclosure, erasure, etc.
Controller — The entity that determines the purposes and means of processing. For your personal data submitted to this site, ${siteConfig.name} is the Controller.
Processor — An entity that processes data on behalf of the Controller. Our sub-processors Resend and Cloudflare act as Processors.
Sub-processor — A third party engaged by the Processor to carry out specific processing activities on behalf of the Controller.
03
Subject Matter of Processing
Categories of data — Email addresses, names, organisation names, country, IP addresses (truncated), and subscription preferences.
Categories of data subjects — Newsletter subscribers, contact form submitters, and site visitors.
Purpose of processing — Sending newsletter communications, responding to enquiries, delivering purchased content, and maintaining site security.
Duration — Processing continues for as long as you maintain an active subscription or account, plus any legally required retention period thereafter.
04
Controller Obligations
Lawfulness — We process personal data only on a valid legal basis: consent, contractual necessity, or legitimate interests as documented in Part 1: Privacy Policy.
Data minimisation — We collect only the minimum data necessary for each specified purpose. We do not collect data just in case.
Purpose limitation — Data collected for one purpose will not be repurposed for an incompatible use without your knowledge and, where required, consent.
Accuracy — We take reasonable steps to ensure data is accurate. You may request corrections at any time.
05
Processor Obligations
Instructions — Sub-processors act only on documented instructions from us and are contractually bound not to process data for their own purposes.
Confidentiality — All personnel with access to personal data are bound by confidentiality obligations, whether by employment contract or applicable law.
Security — Sub-processors implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+) and access controls.
Sub-processor changes — We will notify you of any intended changes to our list of sub-processors with reasonable notice, providing an opportunity to object.
06
Breach Notification
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, where feasible. Where the breach is likely to result in a high risk, we will also notify affected data subjects without undue delay.
07
Return / Deletion of Data
Upon termination of our relationship or upon your request, we will delete or return all personal data in our possession and delete existing copies, unless applicable law requires retention. You may request a machine-readable export of your data at any time.
Privacy, Data & Cookie Enquiries
To exercise any GDPR right, request a signed DPA, ask about our cookie practices, or raise any privacy concern, contact us at
[email protected]We will respond to all legitimate requests within 30 days in accordance with GDPR Article 12.