Privacy notice

This notice explains what personal data the magazine processes when you read it or write to us, why, for how long, and what you can do about it. It is written for readers in the European Union under the General Data Protection Regulation (GDPR).

Who is responsible

The site is run by the editors of Actopolis, who are the controller of the personal data described here. For any question about this notice or your data, write to editors@actopolis.net.

The short version

• Reading the magazine does not require an account, and there are no reader accounts.
• There is no analytics software, no tracking pixel, no newsletter and no comment section.
• Some guides contain affiliate links to Amazon and to tour partners, and some city guides show one partner banner. They are explained below.
• We process personal data ourselves in only two situations: technical logs created when your browser requests a page, and messages you send through the contact form.

Server and network logs

When your browser asks for a page or an image, the web server and our content delivery network (CDN) record a few technical details about the request:

• your IP address;
• your browser's user agent, which describes the browser and operating system;
• the date and time of the request;
• the page or file requested.

These logs are held by our hosting provider and by the CDN. They are used to deliver pages, keep the site running, find faults, and detect and block attacks and abusive traffic. They are kept for a short period and then deleted or overwritten automatically. We do not use them to build profiles of readers, and we do not combine them with any other data.

Legal basis: our legitimate interest in running a secure and working website (Article 6(1)(f) GDPR).

Contact form messages

If you use the contact form, we receive the name, email address, subject and message you enter. We use them only to read your message, reply if needed, and act on it, for example by checking and correcting an article. If your message leads to a correction, the note at the foot of the article does not name you unless you ask us to.

Messages are kept only as long as we need them to deal with the matter, and never longer than 24 months. After that they are deleted. You can ask us to delete your message sooner at any time.

Legal basis: your consent and your own request, since you choose to write to us and ask us to deal with your message (Article 6(1)(a) GDPR). You can withdraw consent at any time by email; this does not affect anything we did with your message before you withdrew it.

Please do not send sensitive information, such as health details, through the form. We do not need it.

Affiliate links and partner banners

Some pages link to products on Amazon (we take part in the Amazon Services LLC Associates Program) and to tours sold by partners we reach through the CJ Affiliate network, such as City Sightseeing. If you follow one of these links and buy something, we may earn a commission. The price you pay is the same.

When you follow such a link you leave our site. Amazon, CJ and the partner may then set their own cookies in your browser to record that the visit came from us, under their own privacy policies: Amazon's privacy notice and CJ's privacy policy. We receive reports of clicks and orders per link, without your name, address or any other detail that identifies you.

In some city guides a "Book a visit" box shows a partner banner image. That image is loaded from CJ's servers, which receive the usual details of the request (your IP address, browser and the page it appeared on), as any web server does. We add no tracking code of our own to it.

Legal basis: our legitimate interest in funding the magazine through commissions (Article 6(1)(f) GDPR). Nothing happens on the partners' sites unless you choose to follow a link.

What we do not do

We do not sell, rent or trade personal data. We do not use cookies or similar tools of our own to follow you around the web, and we do not make automated decisions or build profiles about readers. The only cookies the site can set are described on the cookies page.

Who receives your data

Two kinds of service provider process data for us, and the affiliate partners described above receive data directly from you when you click or a banner loads:

• the hosting provider, which runs the server where the site and its logs are stored;
• the content delivery network, which sits between your browser and our server, delivers pages quickly and filters out malicious traffic.

Both act on our behalf under a data processing agreement and may not use your data for their own purposes. Contact form messages are stored on our server and read only by the editors. We would disclose data to an authority only if the law required us to, for example under a court order.

International transfers

The content delivery network runs servers in many countries, so your request may be handled at a location outside the European Union and the European Economic Area. Where personal data leaves the EEA in this way, the transfer is covered by the standard contractual clauses adopted by the European Commission. The same safeguard applies to any other provider that processes data outside the EEA on our behalf.

Embedded content

The magazine does not embed videos, maps or social media posts. The only material served by an outside platform is the partner banner in some city guides, described above. Links to other websites are ordinary links. Once you follow one, that site's own privacy notice applies.

Security

Connections to the site are encrypted. Access to the server and to contact messages is limited to the editors, and the back office is protected against repeated sign-in attempts.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• ask us to restrict how we use your data while a question is resolved;
• object to processing based on our legitimate interest, such as logging;
• receive data you gave us, such as a contact message, in a portable format (portability);
• withdraw your consent at any time;
• complain to a data protection supervisory authority, in particular in the country where you live or work.

To use any of these rights, email editors@actopolis.net. It costs nothing, and we will answer within one month. We may ask for a little information to confirm who you are. Logs contain only an IP address and browser details, so we may not be able to find your entries unless you tell us enough to identify them, such as the date, the time and the address you used.

Changes to this notice

If the way the site handles data changes, we will update this notice before the change takes effect and change the date at the top of the page. Any new service that touches personal data will be listed here first.