GDPR Rights

If you are located in the European Economic Area (EEA) or the United Kingdom, you have certain rights under the General Data Protection Regulation (GDPR) and the UK GDPR regarding your personal data. The data controller is Taciturn Studios LLC, operating thepublishingtimes.com.

Your Rights Under GDPR

Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you, along with information about how we use it.

Right to Rectification (Article 16): You have the right to request correction of inaccurate or incomplete personal data we hold about you.

Right to Erasure — "Right to Be Forgotten" (Article 17): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or when you withdraw consent.

Right to Restrict Processing (Article 18): You have the right to request that we limit how we use your data — for example, while we verify the accuracy of data you have contested.

Right to Data Portability (Article 20): Where processing is based on consent or contract, you have the right to receive your data in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit it to another controller.

Right to Object (Article 21): You have the right to object to processing of your personal data for direct marketing purposes at any time. You may also object to processing based on legitimate interests, unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent (Article 7(3)): Where processing is based on your consent (for example, newsletter subscriptions or non-essential cookies), you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent for cookies, clear your browser's localStorage for this site and select "Essential Only" when the consent banner reappears. To unsubscribe from our newsletter, use the unsubscribe link in any email.

Right Not to Be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not use automated decision-making of this kind.

Legal Bases for Processing

We process your personal data on the following legal bases:

• Consent — for newsletter subscriptions and non-essential cookies (analytics and advertising)
• Contract performance — for processing digital product purchases and delivering purchased content
• Legitimate interests — for site security, fraud prevention, and aggregated analytics that help us improve the site
• Legal obligation — for retaining transaction records as required by tax law

International Data Transfers

Your data may be transferred to and processed in the United States, where our servers and third-party service providers are located. The US does not have an adequacy decision from the European Commission. We rely on Standard Contractual Clauses (SCCs) and the data processing agreements of our third-party processors (Google, Stripe, Resend) to ensure appropriate safeguards for such transfers.

Data Retention

We retain personal data only as long as necessary. Newsletter subscriber data is retained until you unsubscribe. Purchase records are retained for seven years for accounting and tax compliance. Analytics data is retained for 26 months (Google Analytics default). Cookie consent records are stored locally in your browser and are cleared when you clear your cookies.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us via our contact form. We will respond within 30 days. We may ask you to verify your identity before processing your request.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection supervisory authority. If you are in the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the EU, you may contact your national data protection authority — a list is available at edpb.europa.eu.