What this site collects

Who is responsible

The controller under the GDPR is Daniel Guimarães, [email protected]; the postal address is in the Impressum. No data protection officer is appointed; a one-person publication is not required to have one.

Hosting

The site runs on a virtual server rented from Hostinger, under a data processing agreement (Art. 28 GDPR). The pages are static files: the server does not run a database of visitors and no account is needed to read anything.

Content delivery

Requests reach the server through Cloudflare (Cloudflare, Inc., San Francisco, USA), which provides encryption and absorbs attacks. Cloudflare therefore processes each request, including your IP address, before it reaches my server. It does so as a processor under a data processing agreement; transfers to the USA rely on Cloudflare's certification under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in delivering the site securely.

Server logs

The web server keeps ordinary access logs: the IP address that made a request, the page requested, the time, the response code and the browser's user-agent string. They are used only to keep the site running and to find faults and attacks, are not combined with anything else, and are deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR.

Analytics

Visits are counted with Umami, which runs on my own server, so nothing is sent to an analytics company. It sets no cookies and stores no IP addresses. What is recorded is the page you opened, roughly when, the referring site, and your browser, device type and country. It is not linked to a person and is shared with nobody. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in knowing which articles are read.

Your theme choice

If you switch the site between light and dark, that choice is saved in your own browser (localStorage) so the next page looks the same. It stays on your device and is never sent to the server. Because you asked for it, this needs no consent (§ 25(2) no. 2 TDDDG). Clearing your browser data removes it.

Videos

Some articles carry a video from Portside Report's YouTube channel. Until you press play, the page shows a picture from this server and nothing is sent to YouTube. When you press play, the player is loaded from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in its privacy-enhanced mode (youtube-nocookie.com): YouTube then receives your IP address and the page you watch from, and may store information on your device. Google may transfer data to the USA under the EU-US Data Privacy Framework. Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can also watch on YouTube itself, through the link under each video.

If you write to me

If you send an email or use the contact form, your name, address and message are kept to answer you and deleted when the conversation is over, unless they have to be kept for longer by law. Email is handled by Zoho as a processor. The form also keeps a copy on my own server, deleted after 90 days. Legal basis: Art. 6(1)(f) GDPR.

Newsletter

If you subscribe, the list stores your email address and, if you give them, your name and company, together with the time you signed up and the time you confirmed. The address is used to send the newsletter and nothing else.

Signing up takes two steps: the form sends one mail with a confirmation link, and you are on the list only after you click it (double opt-in). Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. An address that is never confirmed is deleted after 30 days.

Every issue has a link to leave with one click, or write to [email protected]. When you leave, your name and company are deleted. The address and the dates are kept on a do-not-send list, so that it is never mailed again by mistake and so that the consent can be shown to have been given. Legal basis: Art. 6(1)(f) GDPR.

The list is kept in a database on the server described under Hosting. The mails are sent by Zoho (Zoho Corporation B.V., Netherlands) as a processor. If sending moves to another provider, this page will name it before the first issue goes out that way.

What never happens

• No data is sold, rented or handed to advertisers.
• No third-party trackers, ad pixels or social widgets. The site loads no scripts other than its own theme switch and its own analytics.
• No profiling and no automated decisions about anyone.

Your rights

You can ask what is held about you, and have it corrected, deleted, restricted or handed over (Art. 15 to 20 GDPR). You can object at any time to processing based on legitimate interest (Art. 21 GDPR). Write to [email protected]. You also have the right to complain to a data protection supervisory authority, in particular the one where you live.

Last updated 24 October 2026.