Privacy policy

Who is responsible

The data controller for Our Elected EU News is Craig Belluche. Data-protection enquiries go to eunews@ourelected.com.

Registered address: 10537 Pelican Dr, Wellington FL 33414.

What we collect

If you create an account

Your email address and authentication credentials, handled by our authentication provider — we never see your password. A profile record holds the display name and avatar you choose, membership and billing identifiers, onboarding status, saved articles, organizations and memberships, user-scoped feature flags, and sanitized API-key metadata. API-key secrets are never recoverable.

Security and abuse-prevention records

Requests to protected parts of the site generate security records containing the IP address, browser user-agent string, the resource requested and the outcome, plus rate-limiting counters. Cloudflare Turnstile also processes browser, device and network signals on credential and subscription forms to distinguish automated traffic; its token is validated by Cloudflare or our authentication provider. These controls exist to detect credential stuffing, scraping and abuse. We do not use their output to build an advertising profile, and our security records are not sold or shared for advertising.

If you subscribe

Subscription status and the identifiers our payment processor issues. Full card details go to the processor directly and are never received or stored by us.

If you save an article

We store your account identifier, the vote article you chose and the time you saved it. Your private reading list is visible only to your account while Reader membership is active. A canceled membership keeps the list inaccessible so it can be restored if you resubscribe; deleting your account deletes the list.

If you join the Nightly Brief

We store your email address, whether and when you requested and confirmed the newsletter, the consent wording in force at that time, and whether you later unsubscribed or delivery was suppressed. Our email provider processes the address and message-delivery events. The brief uses campaign links so we can measure aggregate visits on this site; the link does not contain your email address or subscriber ID.

If you upload a file

Files you upload are stored in a location scoped to your account and are not readable by other readers.

Public records about elected representatives

We obtain MEP names, roles, affiliations and recorded vote positions from the European Parliament Open Data Portal rather than from the MEP directly. These source categories may reveal political opinions. We publish the Parliament's recorded facts with source links, correction rights and the editorial limits in our standards; we do not infer absence, motive or unsupported personal characteristics.

Source: European Parliament Open Data Portal.

Public-page performance measurement

Browser performance telemetry is not currently enabled. Bounded manual HTTP samples and build-asset budgets do not identify readers.

Advertising and cookies

The anonymous reading surface does not set a cookie merely because you visit. A session cookie is used when you sign in, and a session-only language preference is written only when you explicitly choose a language or visit a released localized URL. Security controls validate request origins without adding a general tracking cookie.

Advertising is not currently served on this site. When it is, this section will describe the advertising partner, the identifiers it uses, and the consent controls — before the first ad renders, not after.

Why we are allowed to hold it

• Performance of a contract — running your account and any subscription.
• Legitimate interests — keeping the service secure, preventing abuse, and keeping a record of administrative actions. We hold the minimum that achieves this.
• Consent — advertising and analytics cookies that are not strictly necessary, and any newsletter. Withdrawable at any time.
• Legal obligation — tax and accounting records for payments.

How long we keep it

Security event records are kept for 90 days, rate-limiting records for 30 days, and administrative audit records for 365 days, after which they are permanently deleted by an automated job. Payment-event records are kept for 90 days beyond processing. Account and profile data is kept while the account exists.

Unconfirmed newsletter requests are deleted after 7 days. Completed newsletter delivery jobs and provider-event records are deleted after 90 days. We retain the minimum email and consent or suppression state needed to deliver the subscription, prove consent, and avoid sending after withdrawal or a hard bounce; you may ask us to delete that record.

Your rights

Under the GDPR you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. The paginated self-service export covers account-linked application, newsletter and file metadata. Contact us for a comprehensive request that may also require review of IP-based security records, processors or legal-retention exceptions. Account deletion removes account-linked application records, newsletter data and stored files before deleting the authentication identity; if you own an organization with another member, you must first transfer ownership or resolve its roster so your request cannot delete their shared data. Minimum security and financial records we are required or permitted to keep remain for the periods above.

You can complain to a supervisory authority, including the authority where you live, where you work, or where you believe an infringement occurred. Because the publisher has no EU establishment, we do not claim a lead authority or EU one-stop-shop.

Who else processes it

We use service providers to host the database and authentication, deliver the site, send email, and process payments — and, when advertising is live, serve it. Providers may process data outside the EEA. The applicable role, location, contract and transfer safeguard must be verified in our processor register; contact the privacy address for the current mechanism. An advertising partner may act as an independent controller for the advertising described above.

Changes

Material changes are announced on this page with a new date, and the page is dated at the top so you can tell whether it has moved. Related reading: our terms and security policy.