Last updated: October 30, 2026
This Privacy Notice explains how personal data is processed when you visit davidpareto.com (the “Website”), subscribe to the newsletter or buy content.
1. Who is responsible
The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:
PARETO Digital GmbH & Co. KG
Tulpenweg 19
71287 Weissach
Germany
Email: info@paretodigital.de
For any privacy question or to exercise your rights, contact me at the email address above.
2. What data I process, why, and on what legal basis
Visiting the Website
When you open the Website, your browser automatically sends technical data to the server: IP address, date and time of access, page requested, referrer URL, browser type and operating system. This is necessary to deliver the Website and to keep it secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, working website). Server log files are deleted after [number] days.
Fonts
The Website uses fonts provided by Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When a page loads, your browser connects to Google’s servers and transmits your IP address. Legal basis: Art. 6(1)(f) GDPR (consistent, readable presentation). More information: Google Privacy Policy.
Newsletter
If you subscribe to the newsletter, I process your email address and the time of subscription to send you new articles by email. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw your consent at any time using the unsubscribe link in every email or by contacting me. Your data is stored until you unsubscribe. [If you use an email delivery service, name it here, e.g. “The newsletter is sent via [provider], [address].”]
Buying Paid Content
Purchases are processed by Paddle (Paddle.com Market Limited, Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom), which acts as reseller and Merchant of Record. Paddle collects and processes your name, email address, billing address, country, payment details and transaction data as an independent controller under its own Privacy Notice.
Paddle shares with me the data I need to give you access: your email address, name, country, the post you bought and the transaction details. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (statutory retention obligations). I keep this data for as long as you have access to the purchased content and as long as required by statutory retention periods (up to 10 years).
Signing in to purchased content
To sign in to posts you have bought, you enter your email address and receive a one-time sign-in link. After signing in, a cookie keeps you signed in. Legal basis: Art. 6(1)(b) GDPR.
Contacting me
If you email me, I process the data you send to answer your request. Legal basis: Art. 6(1)(b) GDPR for questions about a purchase, otherwise Art. 6(1)(f) GDPR. I delete it once it is no longer needed, unless statutory retention periods apply.
3. Cookies
The Website only uses cookies that are strictly necessary for its operation: a sign-in cookie for purchased content, cookies set by WordPress when you log in, and cookies set by Paddle when you open the checkout. Legal basis: § 25(2) German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) and (f) GDPR. The Website currently does not use analytics or marketing cookies.
4. Recipients
Personal data is only shared where necessary:
- Hosting provider: [name and address of your hosting provider], which hosts the Website on my behalf under a data processing agreement (Art. 28 GDPR).
- Paddle as Merchant of Record for all purchases (see above).
- Google for delivering fonts (see above).
- Email delivery provider for the newsletter and sign-in links: [name, if any].
- Professional advisers, such as tax advisers, where necessary.
- Authorities, where I am legally required to disclose data.
5. International transfers
Paddle is based in the United Kingdom; transfers rely on the European Commission’s adequacy decision for the UK. Where data is transferred to the United States, this is based on the EU–U.S. Data Privacy Framework (where the recipient is certified) or on the European Commission’s Standard Contractual Clauses.
6. Your rights
Under the GDPR you have the right to:
- access your personal data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw your consent at any time, with effect for the future (Art. 7(3));
- lodge a complaint with a supervisory authority, for example [the data protection authority of your German federal state].
I will respond to your request within one month.
7. Security
I take appropriate technical and organisational measures to protect your data, including TLS encryption for all connections, restricted access to the Website’s administration, and regular updates of the software in use.
8. Changes
I may update this Privacy Notice when the Website or the law changes. The date at the top shows the latest version.