{
  "notice_id": "https://tcieg.org/transparency.html",
  "notice_url": "https://tcieg.org/transparency.html",
  "notice_version_id": "v2026-10-19-0458e3aa",
  "notice_hash": "0458e3aad6768f044882d80201910aa8b65b7c1f4d3f5ddf60e098f8121183b0",
  "notice_hash_alg": "sha256",
  "published_at": "2026-10-19T09:49:40Z",
  "notice_type": "online_notice",
  "controller_identity_record_id": "https://tcieg.org/.well-known/transparency/cir.json",
  "language": "en-GB",
  "processing": [
    {
      "service": [
        "https://tcieg.org",
        "https://insights.tcieg.org"
      ],
      "data": "Network metadata (IP address, timestamp, request)",
      "purpose": "Serve and secure the sites",
      "legal_basis": "legitimate_interests",
      "processor": "Hetzner Online GmbH",
      "processor_role": "hosting processor",
      "processing_location": "FI"
    },
    {
      "data": "Email you send us",
      "purpose": "Answer your message",
      "legal_basis": "your request",
      "processor": "Proton AG (Switzerland)",
      "processor_role": "email processor"
    },
    {
      "service": "https://tcieg.org/survey",
      "data": "Expert survey answers; no name, email or IP address required; an email address only if the respondent asks to be interviewed",
      "purpose": "Input to the Internet Transparency Code of Practice (ITCoP), reported in summary without names unless you agree; and, on request, arranging an interview",
      "legal_basis": "consent",
      "withdrawal": "receipt number at https://tcieg.org/survey#withdraw; answers and any interview email address deleted",
      "retention": "until the survey summary is published, and no later than 31 March 2027; the anonymous summary is kept",
      "processor": "Hetzner Online GmbH",
      "processor_role": "hosting processor",
      "processing_location": "FI",
      "transfer_evidence": "survey notice receipt; receipt_id displayed to the respondent, bound to notice_version_id"
    },
    {
      "service": "https://tcieg.org/whitepaper",
      "data": "Receipt number, notice version and time; email address, name and organisation only if the reader asks to be contacted about the review; no IP address",
      "purpose": "Provide the draft white paper and, on request, contact the reader about the review",
      "legal_basis": "consent",
      "withdrawal": "receipt number at https://tcieg.org/whitepaper#withdraw; request and contact details deleted",
      "retention": "until version 1.0 of the paper is published, and no later than 31 March 2027",
      "processor": "Hetzner Online GmbH",
      "processor_role": "hosting processor",
      "processing_location": "FI",
      "transfer_evidence": "white paper notice receipt; receipt_id displayed to the reader, bound to notice_version_id"
    },
    {
      "service": "https://insights.tcieg.org",
      "data": "Email address, if you subscribe",
      "purpose": "Send the updates you asked for",
      "legal_basis": "consent",
      "withdrawal": "unsubscribe link in every email, or write to info@tcieg.org",
      "processor": "Hetzner Online GmbH (subscriber list, FI); Mailgun Technologies, Inc. (delivery, EU region)",
      "processor_role": "newsletter processors",
      "recipient_jurisdictions": [
        "US"
      ],
      "transfer_mechanism": "explicit consent, GDPR and UK GDPR Article 49(1)(a)",
      "transfer_evidence": "1FN notice receipt; receipt_id displayed to the subscriber, bound to notice_version_id",
      "rights_derogations": "Mailgun is a US company. Access by US authorities under US law to data it holds is not governed by EU or UK data protection law.",
      "surveillance_risks": "Email address held by a US company is reachable under US state access law, including from its EU region."
    },
    {
      "service": "https://insights.tcieg.org",
      "data": "Fediverse account identifiers, if you follow Insights",
      "purpose": "Deliver Insights posts to accounts that follow it",
      "legal_basis": "legitimate_interests",
      "processor": "Ghost Foundation (ActivityPub service on Google Cloud)",
      "processor_role": "federation processor",
      "recipient_jurisdictions": [
        "US"
      ]
    }
  ],
  "not_processed": [
    "advertising trackers",
    "behavioural analytics",
    "profiling"
  ],
  "transfers": [
    {
      "description": "Hosting in Finland (EEA).",
      "recipient_jurisdictions": [
        "FI"
      ],
      "safeguard": "UK adequacy regulations for the EEA"
    },
    {
      "description": "Newsletter delivery by Mailgun, a US company, from its EU region; exposed to US law.",
      "recipient_jurisdictions": [
        "US"
      ],
      "safeguard": "explicit consent at the 1FN notice, UK GDPR Article 49(1)(a)"
    }
  ],
  "hosting": {
    "provider": "Hetzner Online GmbH",
    "location": "Helsinki, FI",
    "dns": "Cloudflare (DNS only, no site traffic)"
  },
  "retention": {
    "server_logs": "short-lived",
    "subscriber_list": "kept while subscribed, on the server in Finland",
    "email": "deleted on request"
  },
  "rights": [
    "access",
    "rectification",
    "erasure",
    "objection",
    "withdraw_consent"
  ],
  "rights_access": "Write to info@tcieg.org. No account or identification is needed to ask.",
  "complaint_authority": [
    {
      "name": "Information Commissioner's Office (UK)",
      "url": "https://ico.org.uk/make-a-complaint/"
    },
    {
      "name": "EU or EEA data protection authority where the person lives or works",
      "url": "https://edpb.europa.eu/about-edpb/about-edpb/members_en"
    }
  ]
}