Newsdirector builds a CMS for news publishers. This policy explains which personal data we process, why, and what rights you have. We comply with the General Data Protection Regulation (GDPR).
This is a translation. If it differs from the Dutch version, the Dutch version applies.
1. Who is responsible?
We have two roles, depending on whose data it is:
- Controller for the data of visitors to this website, of people who contact us, and of the users of the CMS (our customers' editors and administrators).
- Processor for the data of readers of the news sites our customers publish with Newsdirector. The publisher of that site is responsible for it; we process it only on their behalf and under a data processing agreement. See section 4.
2. This website
- No tracking. We use no analytics, advertising or tracking cookies on newsdirector.nl.
- Local storage. If you pick the light or dark theme, your browser remembers that choice in local storage. It stays on your device and is never sent to us.
- Fonts. Fonts are loaded from Google Fonts. To do so your browser connects to Google's servers, which reveals your IP address to Google.
- Server logs. Our hosting provider keeps technical logs (such as IP address, time and requested page) to keep the website secure and available. These logs are kept briefly and are not used to follow visitors.
3. Customers and CMS users
Contact and demo requests
If you email us, we use your name, email address, organisation and message to answer you and to arrange a demo or quote. Legal basis: our legitimate interest in replying, or steps taken before entering into a contract. We keep this correspondence for up to two years after the last contact, unless it leads to a customer relationship.
User accounts
For everyone who works in the CMS we process:
- name, email address, profile picture and role (for example editor or editor-in-chief);
- a hashed password and login sessions;
- who wrote or changed what and when, and who is online at a given moment;
- use of AI features (how much and when), so costs can be accounted for to the customer.
Legal basis: performance of the contract with the organisation you work for. We keep account data for as long as the account exists, and delete it after the contract ends as described in section 7.
Invoicing
We process the customer's contact and payment details for invoicing and keep them for seven years, as Dutch tax law requires.
4. Readers of sites on Newsdirector
When you read a news site that runs on Newsdirector, the publisher of that site is responsible for your data. Their privacy policy applies, and that is where you exercise your rights. On their behalf we process:
- Statistics. Page views and reading time are added up into totals per article or page. No cookies are needed for this. IP addresses are stored separately for the publisher and deleted automatically after30 days.
- Newsletters. Subscribers' email addresses, the topics they chose and the status of their subscription. Every newsletter has a one-click unsubscribe link.
- Push notifications. The technical subscription your browser creates when you allow push notifications.
- Consent and advertising. The publisher decides which consent banner (CMP) and which advertising partners appear on the site. Advertising partners only set cookies once you consent.
5. Who do we share data with?
We never sell personal data. We only use parties we need to deliver the service:
- Hosting: the servers and databases Newsdirector runs on;
- Cloudflare: to deliver pages quickly and securely, when a publisher uses it for their site;
- Email delivery: for newsletters and account emails such as password resets;
- Anthropic and OpenAI: only when a customer turns on the AI features. The text an editor asks the AI to work on is then sent to that provider;
- Google: for the fonts on this website.
We have agreements with these parties on the security and confidentiality of the data. We also disclose data when the law requires us to.
6. Transfers outside the EEA
Some of these parties (such as Cloudflare, Google, Anthropic and OpenAI) are based in the United States. Data only goes there with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. Retention
We keep data no longer than needed for the purpose we received it for. Beyond the periods above: after a contract ends, the customer can export their data for another 30 days. We then delete it, except for data we are legally required to keep. Backups are overwritten within 90 days.
8. Security
We protect data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, role-based access separated per customer and per site, and limited access for our own staff. In the event of a data breach we follow the GDPR notification rules.
9. Your rights
You have the right to access, correct or delete your data, to restrict processing, to object, and to data portability. Where we rely on consent, you can withdraw it at any time. Send your request to[email protected]; we reply within one month. If it concerns your data as a reader of a news site, please contact the publisher first. We help them handle your request.
If you disagree with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.
10. Changes
We update this policy when our service or the law changes. The date at the top shows when that last happened. We tell customers in advance about changes that matter to them.
11. Contact
Questions about privacy? Email [email protected].