GCJ EDITOR / PRIVACY
Your data,
clearly explained.
How personal data will be handled when an adult reader requests a book bonus or separately chooses to receive publishing updates.
Draft to review and approve before enabling the public form. The preview is limited to testing.
Draft last updated: 30 September 2026Download the privacy notice PDF · draftThe PDF is a printable summary of the draft; the full text is on this page.
Controller and contact
The controller is Claire Dawson, operating under the GCJ Editor publishing brand. For personal-data requests, write to privacy@gcj-editor.com.
Before public activation: verify that the controller identity and contact address given here are presented consistently in the form and reader communications.
Data collected
The site form requires an adult’s email address. First name is optional; last name is not requested. The system records the request, the optional publishing-updates choice, the version of the wording shown, email sending and confirmation, and technical data needed to secure access to the bonus. On the bonus page, Turnstile processes technical signals to distinguish visitors from bots: according to Cloudflare, these include IP address, TLS fingerprint, User-Agent header, widget sitekey and site origin. Brevo processes transactional-email events and, only if the box is ticked, data for the publishing list. Per-contact tracking consent is enabled in the account: recipients without a separate tracking choice are not individually tracked for future email opens and clicks. The publishing-updates box is not consent to email tracking.
To verify: other categories of provider logs and historic open or click events recorded before the settings changed. Book purchases take place on Amazon, not on the GCJ Editor website.
Purposes and lawful bases
The email address is used to confirm the request and enable the bonus download from this website. A record of the request and choice is separate from publishing updates. Only a voluntarily ticked marketing box may trigger subscription to the relevant list.
To confirm: the lawful basis for the bonus request, delivery and related records. The proposed basis for optional updates is consent (GDPR Article 6(1)(a)). Email confirmation alone does not prove marketing consent.
Required fields and choices
A valid, confirmed email address is needed to download the bonus; first name is optional. The publishing-updates checkbox is separate, empty by default and optional: the bonus remains available without it. Consent to updates may be withdrawn at any time through “Unsubscribe” in promotional emails or by writing to privacy@gcj-editor.com, without affecting prior lawful processing.
Before activation: test the full flow and link each choice to the version of the wording displayed. Viewing this notice does not mean accepting it as a contract.
Service providers and recipients
Cloudflare hosts the site, checks requests with Turnstile and stores the request, confirmation and recorded choice in a database. Bonus PDFs are held in non-public storage and downloaded from the site after verification. Cloudflare also states that it processes Turnstile signals as an independent controller to improve bot detection; see its Turnstile privacy notice. Brevo sends confirmation emails and manages publishing lists only for readers who opt in. Cloudflare forwards mail sent to privacy@gcj-editor.com to a mailbox managed by the controller. Purchases will take place on Amazon’s external website.
To verify: provider roles and agreements, subprocessors, processing locations and any transfers outside the European Economic Area and their safeguards.
Retention
The approach planned for the site separates purposes: unconfirmed requests are deleted 7 days after submission; confirmed bonus-only request records are deleted 90 days after email-address confirmation, even if the PDF is not downloaded. Scheduled deletion for these two categories is active in the site preview, not yet on the official domain. In the Brevo account, transactional-email logs are set to one month and new message previews are not stored; these settings do not erase contacts or any earlier events. For readers choosing publishing updates, the planned approach is to review inactive contacts annually and apply a 24-month limit after the last verifiable meaningful interaction, such as a new explicit choice to receive updates, a relevant reply or a preference confirmation. Simple email opens and automatic deliveries do not count. Without later actions, the period starts from the initial email-address confirmation associated with the positive choice. A new bonus-only request does not renew or recreate marketing consent; withdrawal and erasure requests do not restart the period.
Before public activation: deletion of bonus-only requests has been tested in the preview, but the overall procedure is not yet operational. Handle withdrawal and erasure requests, verify retention of contacts and logs in Brevo, and test the official domain. Retention periods and lawful bases for any consent evidence, logs and minimal suppression records must be defined separately: the same periods do not automatically apply. Removal from a list does not by itself erase the data.
Your rights
You may request access, rectification, erasure, restriction, portability where applicable, and object where the law provides. You may withdraw consent to publishing updates at any time without affecting prior lawful processing. You may also lodge a complaint with the Italian data protection authority.
Requests can be sent to privacy@gcj-editor.com. The form is intended for adults and is not designed to collect children’s data directly.
Cookies and automated decisions
After confirmation, the site uses a technical session for the bonus download; details are in the draft cookie page. No automated decision with legal or similarly significant effects for readers is planned.
To verify: network requests, identifiers and the final Cloudflare Turnstile and site configuration before publication.
GCJ EDITOR / NOTE
Before publication
Check this draft against the final Cloudflare, Brevo and other service configurations, and approve it before collecting data through the website. Email confirmation is not marketing consent.
References: Articles 6, 7 and 13 of Regulation (EU) 2016/679 and guidance from the Italian data protection authority.