Who is responsible
HansaStack is published by Timo Oiva, an individual in Finland, as a personal learning project. For the purposes of the GDPR that makes him the data controller for the subscriber list.
Contact: editor@hansastack.eu
At the time of writing this list has fewer than ten subscribers, all of whom asked to be on it. The obligations below apply regardless of size, and are written out in full because a subscriber is entitled to know them, not because the operation is large.
What is stored
| Data | Why |
|---|---|
| Email address | To send you the newsletter. Without it there is no service. |
| Name, if you give one | Optional. Used only to address the email. |
| Date, time and IP address of your subscription | Evidence that consent was actually given, which the controller must be able to demonstrate. |
| Subscription status and its history | To honour unsubscribes, and to avoid re-adding someone who has left. |
| Delivery events — sent, delivered, bounced, complained | To keep the list clean and to notice when mail stops arriving. |
Whether you open an email, and whether you click a link. There is no tracking pixel and links are not rewritten — they point directly at the publisher, so following one tells this newsletter nothing.
Both were on by default and have been switched off, in the delivery provider and in the newsletter software separately. The practical consequence is that there is no way to know whether anyone reads this, which is a fair price for a claim that is actually true.
Nothing is shared with advertisers, and there are no third-party analytics or social scripts in the emails.
The legal basis
Consent, under Article 6(1)(a) of the GDPR. You are added only after submitting your address and confirming it by clicking a link sent to that address. That two-step confirmation exists both so consent can be demonstrated and so that nobody can subscribe someone else.
You may withdraw consent at any time, and doing so is as easy as giving it: one click on the unsubscribe link in any email.
Who else processes it
| Processor | Purpose | Where |
|---|---|---|
| OVHcloud | Server hosting and DNS | Poland / France |
| MailerSend | Email delivery | Lithuania |
Both are established in the European Union, so your data is not transferred outside the EU and no transfer mechanism is required. That is a deliberate choice rather than a coincidence: choosing a non-EU provider would have introduced a transfer assessment this project did not want to make.
Language models are used to read and translate news articles. They never receive subscriber data of any kind.
How long it is kept
- While you are subscribed, and for 24 months after you unsubscribe.
- The reason for keeping an address after unsubscribing is to make sure you are not added again by mistake. If you would rather it were deleted outright, say so and it will be.
- Delivery events — sent, delivered, bounced — are kept for 12 months.
Your rights
You may ask, at any time, to:
- see what is held about you;
- correct anything that is wrong;
- have it deleted;
- receive it in a portable format;
- restrict or object to its processing;
- withdraw consent, which ends the processing entirely.
Write to editor@hansastack.eu. Requests are answered within one month, and usually within a day, because the list is small.
If you are unhappy with how a request is handled you may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi), or to the supervisory authority in your own country.
Security
The subscriber database runs on a server in the EU and is not reachable from the internet. Administrative access requires a key and a second factor, and the administrative interface is not routable from the public internet at all. Mail is authenticated with SPF, DKIM and DMARC so the domain cannot easily be impersonated.
This website
These pages set no cookies, run no analytics, and load nothing from another domain. Your web server keeps ordinary access logs; nothing else is recorded.
Changes
If this notice changes in a way that affects you, subscribers will be told by email rather than by a silent edit. The date at the top always reflects the current version.