The Thursday SheetPrivacy notice
1. Who is responsible for your data
The controller of personal data collected through arfirst.org is:
- Controller
- OÜ ET Consult
Trummi tn 30j, 12617 Tallinn
Harju maakond, Estonia
Registry code 11545607 / VAT EE101502902 - Privacy contact
- privacy@arfirst.org
Because the publisher is established in the European Union, personal data is processed under the General Data Protection Regulation (GDPR) and Estonian data protection law. Readers in Canada also have rights under Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA); where those give you a stronger right, we honour it.
2. What we collect, and why
a. The Thursday Sheet (newsletter)
If you subscribe we collect your email address and nothing else: no name, no postal address, no date of birth, no financial information. We also record when you subscribed and when you confirmed, which is the evidence of consent the law requires us to keep. If you arrived from an advertisement, the campaign identifiers described in section 2d may be stored with the subscription so that it can be attributed to the campaign.
- Purpose: sending you the weekly newsletter you asked for.
- Legal basis: your consent (GDPR Article 6(1)(a)).
- Double opt-in: after you submit the form we send one email asking you to confirm. If you do not confirm, nothing further is sent and the address is deleted.
- Withdrawal: every issue contains an unsubscribe link, and you can also write to the privacy address above. Withdrawal is free and takes effect immediately.
b. Server logs
Our web server records technical information with each request: IP address, date and time, the page requested, the referring page, and browser and operating-system identifiers.
- Purpose: delivering the site, diagnosing faults and protecting it against abuse.
- Legal basis: our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)).
- Retention: a short period for security and diagnostics, after which logs are deleted or aggregated.
c. Advertising measurement
This site is promoted through paid advertising, and advertising platforms commonly offer a measurement tag that records that a visitor arrived from an advertisement.
How this site is configured: the site is built so that any such tag would load only after you choose “Accept all” on the cookie banner. If you choose “Essential only”, or ignore the banner, no advertising or measurement script is loaded and no advertising cookie is set. The site works identically either way and no content is withheld.
At the time of this update, no advertising measurement tag is active on arfirst.org. If one is added later it will operate on the consent-gated basis described above, and this section will be updated beforehand to name the provider, the data it receives and any international transfer safeguards.
- Legal basis, if you accept: your consent (GDPR Article 6(1)(a)), which you can withdraw at any time by clearing this site’s stored data in your browser; the banner then reappears.
d. Campaign parameters in links
A link from an advertisement may carry campaign parameters in the address, such as a click or campaign identifier. We keep these in your browser’s session storage for the duration of the visit, and copy them into hidden fields of the newsletter form, so that a subscription can be attributed to the campaign that brought you. They are discarded when the browser is closed. We never place your email address or other personal data in a URL.
3. Cookies and similar storage
We use as little as possible.
| What | Purpose | Set when | Kept |
|---|---|---|---|
| Consent record (local storage) | Remembers your cookie choice | When you choose an option | Until you clear site data |
| Campaign parameters (session storage) | Attributing a subscription to a campaign | If you arrive from an advertisement | Until the browser closes |
| Advertising measurement | Measuring advertising performance (none active at present) | Only after “Accept all” | As stated by the provider |
You can delete all of it through your browser’s settings for this site, which also brings back the cookie banner.
4. Fonts, images and external content
All fonts, icons and images are served from our own server. We do not load fonts, analytics, social widgets, video players or advertising creative from third-party networks, so reading a page does not disclose your IP address to any third party. Links to official sources are ordinary links: nothing is requested from those sites unless you click.
5. Who we share data with
We do not sell personal data or share it for anyone else’s marketing. Data is disclosed only to:
- our email delivery provider, as a processor under a data processing agreement, solely to send the newsletter;
- our hosting provider, as a processor for server logs;
- a public authority, where we are legally required to disclose it.
Where a processor is outside the European Economic Area, transfers rely on an adequacy decision or the European Commission’s standard contractual clauses.
6. How long we keep data
- Newsletter address: until you unsubscribe, then deleted, apart from a minimal suppression record so we do not email you again by mistake.
- Unconfirmed subscriptions: deleted shortly after the confirmation window closes.
- Server logs: a short period for security and diagnostics.
- Correspondence: as long as needed to deal with the matter.
7. Your rights
You have the right to access your data and receive a copy, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without giving a reason. Write to privacy@arfirst.org. We reply within one month, free of charge.
8. Complaints
- Estonia (lead authority): Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), Tatari 39, 10134 Tallinn, www.aki.ee.
- European Economic Area: the supervisory authority in your country of residence.
- Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca.
9. Children
This site is intended for adults. We do not knowingly collect personal data from children.
10. A note on security
We will never ask you, by email, telephone or on this website, for a Social Insurance Number, bank account or card details, or a My Service Canada Account or CRA password. No part of this site needs them, and anyone asking for them in our name is not acting for us. Please report such requests to privacy@arfirst.org.
11. Changes to this notice
If we change how we handle personal data, including activating a measurement tag or changing when it loads, we will update this notice and its date before the change takes effect.