Privacy Policy
Privacy Policy
Last updated: June 2026
The protection of your personal data is of paramount importance to us. As explained in Section 1 below, we do not consider this website to be subject to the GDPR on a targeting basis; nonetheless, we apply data protection practices modelled on the GDPR and TDDDG as a matter of policy. This Privacy Policy describes data processing on elgazettario.com, with reference to the standards those frameworks set out.
1. Controller
Harbinger Bros. LLC
1309 Coffeen Avenue, Sheridan, WY 82801, United States
Email: support@harbingerpressmedia.com
Contact form: /contact
El Gazettario does not specifically direct its content or services at residents of the European Union or European Economic Area, and we do not consider the GDPR to apply to us on a targeting basis under Art. 3 para. 2 GDPR. Nonetheless, as a matter of policy, we apply data protection practices modelled on the GDPR to all visitors regardless of location.
2. Data Protection Officer
No statutory DPO obligation exists. Contact the controller for all data protection enquiries.
3. Data Processing Principles (Art. 5 GDPR)
We strictly adhere to all GDPR Art. 5 principles: lawfulness, fairness, transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. We use a single, cookie-less, anonymous analytics tool to measure aggregate visitor numbers (see Section 8 below); beyond that, we operate no tracking or advertising systems and create no user profiles. Data processing remains at a minimum.
4. Server Logs
When you visit our website, your browser automatically transmits technical connection data (IP address, date/time, URL, referrer, data volume, HTTP status, browser/OS user agent) to our hosting provider. Technically mandatory. Purpose: Secure operation, attack defence, error diagnosis — no personal evaluation or third-party disclosure. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest: maintaining secure technical operation). Provider: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. DPA in place per Art. 28 GDPR. Third-country transfer basis: SCCs (Art. 46 para. 2 lit. c GDPR, Decision (EU) 2021/914) and EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795). Retention: Up to 30 days, then automatically deleted.
5. Database (Editorial Content)
Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. DPA in place per Art. 28 GDPR. SCCs used for international transfers. Only editorial content is stored, with one exception: if you use the contact form, your name, email address, and message are stored here too — see the Contact Form section below. More: Supabase Privacy Policy.
Image Delivery
Article images may be hosted on and served directly from Unsplash (Unsplash Inc., Montreal, QC, Canada). When your browser loads an image from Unsplash servers, Unsplash may receive your IP address and standard browser request headers as part of the HTTP connection. We have no control over Unsplash’s data processing. Unsplash’s privacy policy: unsplash.com/privacy
Article images may also be hosted on and served directly from Wikimedia Commons (Wikimedia Foundation, Inc., 1 Montgomery Street, Suite 1600, San Francisco, CA 94104, USA). When your browser loads an image from Wikimedia Commons servers, the Wikimedia Foundation may receive your IP address and standard browser request headers as part of the HTTP connection. We have no control over the Wikimedia Foundation’s data processing. Wikimedia Foundation’s privacy policy: foundation.wikimedia.org/wiki/Policy:Privacy_policy
Email Correspondence
If you contact us by email at support@harbingerpressmedia.com, your message and any attachments are received, stored, and managed through GoDaddy Workspace Email (GoDaddy.com, LLC, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, USA), our email hosting provider. GoDaddy processes this correspondence as our data processor, acting on our instructions; we have no control over its underlying infrastructure. GoDaddy's privacy policy: godaddy.com/legal/agreements/privacy-policy
6. Self-Hosted Fonts
All fonts are hosted exclusively on our own servers. No connections to Google Fonts, Adobe Fonts, or any external font services. No IP address transmitted via font requests.
7. Local Storage — Cookie Consent
| Name | Type | Provider | Content | Purpose | Legal Basis | Retention |
|---|---|---|---|---|---|---|
hpm_cookie_consent |
Browser Local Storage | First-Party | JSON: consent status + timestamp | Store cookie consent decision and document it | § 25 para. 2 No. 2 TDDDG; Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR | Until manually deleted |
Local Storage data stays exclusively in your browser — never transmitted to servers or third parties. Delete via: Developer Tools (F12) → Application → Local Storage → elgazettario.com → delete hpm_cookie_consent.
8. Anonymous Web Analytics and Other Tracking
We use Vercel Web Analytics, a cookie-less, anonymous analytics service provided by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA), to measure aggregate visitor numbers. It collects only aggregated, non-personal metrics (e.g. page views, referrers, approximate country-level location), sets no cookies, does not permanently store IP addresses, and does not re-identify visitors across sessions. Legal basis: our legitimate interest in understanding website usage (Art. 6(1)(f) GDPR); no consent is required as no information is stored on or read from your device (§ 25 TDDDG / Art. 5(3) ePrivacy Directive). More information: Vercel Web Analytics privacy documentation.
Beyond Vercel Web Analytics, we expressly do not use: Google Analytics (Universal Analytics or GA4); Google Tag Manager; Matomo/Piwik or any other cookie-based or profiling analytics platform; Google Ads; Facebook Pixel; any programmatic advertising network; social media plugins that auto-transmit data to Meta, X/Twitter, LinkedIn, YouTube, TikTok, or others; session replay tools (Hotjar, Mouseflow, Clarity, etc.); browser fingerprinting; or cross-site tracking of any kind. No user profiles are created.
9. Third-Country Transfers
| Recipient | Country | Transfer Basis | Data |
|---|---|---|---|
| Vercel Inc. | USA | SCCs (Art. 46 para. 2 lit. c GDPR) + EU-US DPF (Decision (EU) 2023/1795) | Server log data |
| Supabase Inc. | Singapore | SCCs (Art. 46 para. 2 lit. c GDPR) | Editorial content only (no visitor data) |
10. Technical Security Measures (TOMs)
TLS 1.3 end-to-end encryption; HSTS to prevent downgrade attacks; regular security patching of software dependencies; least-privilege access to production systems; encrypted database connections; no unnecessary data retention.
11. Minors
This website is not directed at children under 16. We do not knowingly collect personal data from minors. Such data is deleted immediately if discovered.
12. Privacy Rights We Extend to All Visitors
12.1 Right of Access (Art. 15 GDPR)
You may request confirmation of whether we process personal data about you, and if so, access to that data along with the information specified in Art. 15 GDPR (purposes, categories, recipients, retention period, rights, source).
12.2 Right to Rectification (Art. 16 GDPR)
You may demand immediate correction of inaccurate personal data and completion of incomplete data.
12.3 Right to Erasure (Art. 17 GDPR)
You may demand immediate erasure where any ground in Art. 17 para. 1 applies and no exception under Art. 17 para. 3 exists.
12.4 Right to Restriction (Art. 18 GDPR)
You may demand restriction of processing under the conditions of Art. 18 para. 1 lit. a–d GDPR.
12.5 Right to Data Portability (Art. 20 GDPR)
You may receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is based on consent or a contract.
12.6 Right to Object (Art. 21 GDPR)
You may object on grounds of your particular situation to processing based on Art. 6 para. 1 lit. e or f GDPR. We will cease processing unless compelling legitimate grounds override your interests.
12.7 Withdrawal of Consent (Art. 7 para. 3 GDPR)
You may withdraw consent at any time without affecting the lawfulness of prior processing.
12.8 Exercising Rights
Although, as explained above, we do not consider the GDPR to apply to us on a targeting basis, we voluntarily extend the rights described in this Section 12 to all visitors. Contact: support@harbingerpressmedia.com. We aim to respond within one month.
13. Raising Concerns with a Data Protection Authority
Although we do not consider ourselves subject to the jurisdiction of EU/UK supervisory authorities for the reasons explained above, if you believe such an authority nonetheless has jurisdiction over your complaint, you may contact the data protection supervisory authority in your country of habitual residence, workplace, or the place of the alleged infringement.
14. Additional Notices for Other Jurisdictions and Data Breaches
14.1 United Kingdom (UK GDPR)
The rights described in Section 12 apply equally to visitors in the United Kingdom under the UK GDPR and the Data Protection Act 2018. The supervisory authority is the Information Commissioner's Office (ICO).
14.2 California, USA (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”) grants you the following rights: the right to know what personal information we have collected about you, its sources, and the purpose of collection; the right to delete personal information we have collected from you, subject to certain exceptions; the right to correct inaccurate personal information; and the right to non-discrimination for exercising your rights. We do not sell or share your personal information, so no opt-out mechanism is required. We do not collect sensitive personal information as defined under the CPRA. To submit a request, email support@harbingerpressmedia.com with the subject line “California Privacy Request.” We respond within 45 days, with a possible 45-day extension where reasonably necessary. Categories of personal information collected in the preceding 12 months: internet or electronic network activity information (server log data including IP addresses and browser identifiers). We have not sold or shared any personal information.
14.3 Canada (PIPEDA)
Visitors from Canada have rights under the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial legislation, including the right to access your personal information held by us and to challenge its accuracy. To exercise these rights, contact support@harbingerpressmedia.com.
14.4 Brazil (LGPD)
If you are located in Brazil, the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018, “LGPD”) applies to our processing of your personal data. You have the right to: confirmation of the existence of processing; access to your data; correction of incomplete, inaccurate, or outdated data; anonymisation, blocking, or deletion of unnecessary or excessive data; data portability; deletion of personal data processed with your consent; information about the public and private entities with which we share data; information about the possibility of denying consent and its consequences; and revocation of consent. The legal bases described in Section 3 above (in particular, legitimate interest for server logs and Vercel Web Analytics) apply equally under Art. 7, X LGPD. To exercise your rights, contact support@harbingerpressmedia.com. Complaints may also be directed to Brazil's national data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD).
14.5 Argentina (Ley de Protección de Datos Personales)
If you are located in Argentina, Law No. 25,326 on the Protection of Personal Data applies to our processing of your personal data. You have the right to access, rectify, update, and request deletion of your personal data. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the Agencia de Acceso a la Información Pública (AAIP).
14.6 Australia (Privacy Act 1988)
If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our processing of your personal information. You have the right to access and seek correction of your personal information, and to lodge a complaint about a potential breach of the APPs. Complaints may be directed to us at support@harbingerpressmedia.com and, if unresolved, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
14.7 India (DPDP Act 2023)
If you are located in India, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) applies to our processing of your personal data. As a Data Principal, you have the right to obtain a summary of the personal data we process about you, the right to correction and erasure of your personal data, and the right to grievance redressal. To exercise these rights or raise a grievance, contact support@harbingerpressmedia.com. Unresolved grievances may be escalated to the Data Protection Board of India.
14.8 South Korea (PIPA)
If you are located in South Korea, the Personal Information Protection Act (“PIPA”) applies to our processing of your personal information. You have the right to access, correct, delete, and suspend the processing of your personal information. To exercise these rights, contact support@harbingerpressmedia.com. Complaints may also be directed to the Personal Information Protection Commission (PIPC) of the Republic of Korea.
14.9 Notification of Personal Data Breaches
Although we do not consider ourselves bound by Articles 33–34 GDPR for the reasons explained above, we apply, as a matter of policy, breach-notification practices modelled on those provisions: in the event of a personal data breach likely to result in a risk to your rights and freedoms, we aim to notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, describing the nature of the breach and the measures taken or proposed.
15. No Automated Decision-Making (Art. 22 GDPR)
No automated decision-making including profiling is used. No decisions are made based solely on automated processing that produce legal or similarly significant effects.
16. Journalistic Media Privilege
El Gazettario invokes the journalistic media privilege (Art. 85 GDPR) for journalistic work and source protection to the extent necessary.
17. Contact Form
If you use the contact form at /contact, we collect and store your name, email address, and message content in our application database in order to respond to your inquiry. This data is stored via our database provider, Supabase Inc., and is accessible only to authorised personnel who handle correspondence. Legal basis: Art. 6(1)(b) GDPR (necessary to respond to your request) or, where no contractual relationship is established, Art. 6(1)(f) GDPR (legitimate interest in handling incoming communications). We retain contact form submissions for as long as necessary to address your inquiry and for a reasonable period thereafter for documentation purposes, typically no longer than 12 months, unless a longer retention period is required by law. You may request earlier deletion of your message at any time by contacting us.
18. Changes
This Privacy Policy may be updated to reflect legal requirements or service changes. The last update date appears above.