Where your data came from

Your email address — and, where they were shown, your name, academic title and department — was taken from the publicly available academic-staff or department page published on your own institution's website.

It was obtained only because it is published there for anyone to read. You did not give it to us, it was not bought from a data broker, and it was not taken over from any other source.

We process these details for one purpose only: to introduce our personal academic website service to you, and to correspond with you about it if you are interested.

They are not used for automated decision-making or profiling, they are not sold, and they are not shared with third parties for marketing. Only the suppliers whose email-sending and hosting services we use may process them on our behalf, on our written instructions.

The legal basis for the introductory message is legitimate interest under Article 6(1)(f) GDPR, namely direct marketing. The balancing test took into account that the address was published by your institution for professional contact, that the message concerns your professional work directly, and that every message carries a one-click way out.

Under Article 21(2) GDPR you may object to this processing at any time, without giving a reason. Once you object the processing stops immediately and unconditionally — we do not get to weigh anything up first.

If you signed up on this site yourself, the basis is your consent (Article 6(1)(a)). You may withdraw it at any time, and withdrawing it does not affect the lawfulness of the processing carried out before then. Any additional permission your country requires for commercial electronic messages — for example the ETK consent in Turkey, or the prior consent under Article 398 of the Polish PKE — is collected separately from that.

We keep your contact details only for as long as the purpose above requires: unless you object or withdraw your consent, at most 12 months after our last correspondence with you. At the end of that period the record is deleted.

If you object or unsubscribe, your email address is deleted from our records and only an irreversible cryptographic hash of it stays on our suppression list. That hash is the minimum we need in order never to write to you again, and your address cannot be recovered from it.

If you signed up, the evidence of when the consent was given and which wording it was given to is kept for a reasonable period after the consent is withdrawn, because Articles 5(2) and 7(1) GDPR require us to be able to demonstrate it.

Under the GDPR you have the right to obtain access to the data we hold about you (Article 15), to have inaccurate or incomplete data corrected (Article 16), to have your data erased (Article 17), to have the processing restricted (Article 18), to receive your data in a portable form (Article 20), to object to processing based on legitimate interest and, in any case, to direct marketing (Article 21), and — where the processing is based on consent — to withdraw that consent at any time (Article 7(3)).

To use any of these rights, a one-line email to the data-protection contact address below is enough. You do not have to give a reason, it costs you nothing, and we answer within one month at the latest. We do not ask you for identity documents in order to erase your address or to act on an objection.

You also have the right to lodge a complaint with the data-protection supervisory authority of the country where you live, where you work, or where you believe the infringement took place (Article 77).