Privacy and data protection notice

We operate the following websites:

• 🇪🇺 Built with Ghost CMS (privacy policy), hosted on Digital Ocean with data stored in the EEA: noties.consulting and dpohub.eu
• 🇺🇸 Built with Kajabi CMS (privacy policy), hosted on AWS with data stored in the US: join.dpohub.eu (cookie notice) and community.dpohub.eu (cookie notice)

We use privacy-first Fathom Analytics (privacy policy) across all sites. Your IP address and User-Agent are only processed briefly; we don't track which pages you view, only time and total requests per IP. Our Kajabi sites have native analytics that can't be disabled, covering only (individual) page views and optins. Either way, we never see your IP address. The lawful basis for website analytics is our legitimate interest to improve our websites and keep our business sustainable.

We aim to limit third-country transfers and don't use marketing or ads cookies on any of our sites.

On join.dpohub.eu/yes you can sign up for The Rieview, a free newsletter with Rie's unfiltered thoughts on building DPO foundations (not fighting fires), practical insights from CJEU rulings she's actually read, Grumpy GDPR podcast exclusives, and occasional product promotions. Sent 1-2 times monthly, or when inspiration strikes.

You must share your email address to receive the newsletter – name is optional (Rie thinks it's nice to know who's subscribing!). When you sign up, we're notified by email and Kajabi (hosted on AWS with data stored in the US – privacy policy) stores your record with signup date and time, email address, name, consent confirmation and newsletters received, opened and links clicked. If you reply to a newsletter, it lands in Rie's Proton inbox.

Kajabi's newsletter metrics (opens/clicks) can't be disabled. If this concerns you, please don't subscribe – follow Rie's LinkedIn posts instead.

We process your personal data to deliver emails, build relationships and optimise content for all subscribers, hopefully converting some of you to customers to run a viable business. The lawful basis is your consent. You can easily withdraw it by unsubscribing via the link in any newsletter, and your data is usually deleted within a few days, at most within a month.

PS: Rie used an EEA-based service before but switched to a US one for several reasons. First, however, she redid a complete GDPR due diligence and risk assessment of Kajabi, including all six forms (vendor, system, privacy policy, DPAg, and more). Listen to our Grumpy GDPR podcast discussion for more details.

The personal data we process depends on the product or service and payment method. For invoicing, we typically process your name, email address, company name, billing address, VAT number, order details, payment details, purchase/offer history and similar. Stripe handles all our online payments and currently only applies to DPO Hub, see the dedicated notice here.

We process this data to deliver the products and services you've purchased and to manage the customer relationship. The lawful bases are contract and legal obligations related to accounting, tax and other business rules we must follow.

We keep the data for as long as we have a legal obligation. Norwegian law requires us to store business records, which may include personal data, for at least five years for accounting and tax purposes. We also store data from customer projects and engagements for up to five years after the customer relationship ends, based on our legitimate interest in documenting deliverables and defending ourselves against legal claims.

DPO Hub lives on dpohub.eu and runs on Ghost CMS (privacy policy), hosted on Digital Ocean with data stored in the EEA. Please read the dedicated DPO Hub notice here.

The DPO Hub Community lives on community.dpohub.eu (cookie notice) and runs on Kajabi CMS (privacy policy), hosted on AWS with data stored in the US.

The Community is a space to exchange thoughts, ideas and interact with other members – meaning you'll share plenty of personal data!

To get access, you must create an account with a password and share your email address, full name and accept the terms. When you sign up, Kajabi creates and stores your account with added date and time, email address, name, terms confirmation, granted or purchased offers, payment information, products, product progress, sign-in count, last activity date and time, emails received, opened and links clicked. If you reply to an email, it lands in Rie's Proton inbox.

Kajabi's email metrics (opens/clicks) can't be disabled. If this concerns you, please don't join the Community – engage with Rie and others on LinkedIn instead.

The Community is part of a paid product, so we must process your personal data to give you access. The lawful basis is contract, which you enter into when you submit the signup form and accept the terms. You can end your access by cancelling the paid product or ask to be removed.

If you leave the Community, your account will be deleted from the platform, but your profile will only show as inactive and your interactions will remain visible. You can change your profile name and delete any of your contributions before you leave.

Currently, there's no way to delete all your data automatically, so if you want your contributions removed, you must do it yourself. By joining the Community, you agree to this under the terms, and we process your personal data on that basis. We otherwise rely on our legitimate interest in facilitating a dynamic and lively community and keeping a complete conversation history for members.

PS: We're in dialogue with Kajabi to get a better erasure process in place.

If you're one of our awesome podcast guests, we'll process your name, email, correspondence, calendar invites and everything related to the actual recording, including audio.

We do this to manage the dialogue around the episode, record it and share the final audio. After you’ve agreed to be a guest, our lawful basis for publishing is our legitimate interest in sharing the audio with our privacy and data protection community to support continued learning.

As a general rule, we don’t delete episodes, so the recording will remain available for as long as the podcast exists (hopefully for a long time!). If you want to request deletion of your contribution for any reason, please reach out so we can discuss.

PS: Note that the controllers for this particular processing are your hosts Miloš Novovic and Rie Aleksandra Walle.

If you contact us – whether through our website (contact form, blog comments, chat), email, phone, social media or by giving us your business card – we process your personal data. Depending on how you reach out, this may include your name, contact details, IP address and any other information you choose to share.

We use this to respond to your enquiries and, when needed, to keep records in case of complaints or legal claims. The lawful basis is our legitimate interest for these same purposes. We review this data regularly and delete it when appropriate – typically within three years, or five years if required by Norwegian accounting rules.

If you attend our free events, we process your name and contact details. For paid events, we also collect order and payment information as described above. We use this data to manage your registration and attendance and, where relevant, payment. The lawful basis is consent for free events, or contract and legal obligations related to accounting, tax and other business rules for paid events.

We may also use your data to send you an evaluation of the event, invite you to other relevant events and/or offer relevant products and services. The lawful basis is our legitimate interest to offer you things we think you'll find useful. If you don't wish to receive such messages, you can easily opt out – for example through an unsubscribe link in our emails. We keep this data for up to two years after you attended, unless you subscribe to our newsletter or become a customer.

Responding to our evaluations and surveys is voluntary. We process your name, contact details and any other information you choose to share to gather feedback and improve our products, services and customer service. The lawful basis is consent. We keep this data until you ask us to delete it, or no later than two years after you responded.

If you enter into an agreement with us as a vendor, partner or processor, we process your name, contact details and correspondence. We use this data to enter into and manage the agreement and to respond to your enquiries. The lawful bases are contract and legal obligations related to accounting, tax and other business rules we must follow.

We keep the data for as long as we have a legal obligation. Norwegian law requires us to store business records, which may include personal data, for at least five years for accounting and tax purposes. We also store data from collaboration projects for up to five years after the it ends, based on our legitimate interest in defending ourselves against legal claims.