Processing and protection of user data

Scope and definitions

This policy covers data gathered via web forms, analytics tools, email communications, and general browsing. “Personal data” means any information that identifies or can reasonably identify a natural person. Processing includes collection, storage, use, transfer, and deletion.

Data controller

For all privacy-related requests, the contact form should include “Privacy request” in the subject.

Categories of personal data collected

• Contact data – name, email address, and message content submitted via forms.
• Usage data – pages visited, time on page, device type, approximate location derived from IP, and general technical events.
• Content interaction – bookmarked items, likes, or feedback provided through on-site components.
• Partner submissions – materials sent by experts or companies for editorial review.

Purposes and lawful bases

• Responding to inquiries – to answer contact messages and provide requested information (lawful basis: legitimate interests or performance of a requested step).
• Improving content and UX – to analyze traffic and optimize articles, navigation, and performance (lawful basis: legitimate interests and/or consent where required).
• Editorial operations – to evaluate expert submissions, manage review workflows, and maintain an audit trail (lawful basis: legitimate interests).
• Legal compliance – to fulfill obligations under applicable laws and respond to lawful requests (lawful basis: legal obligation).

Cookies and similar technologies

The website may use essential cookies for security and function, as well as performance cookies for aggregated analytics. Where required, consent is collected before non-essential cookies are set. Browser settings can be used to block or delete cookies; blocking may affect site functionality.

Analytics

Aggregated metrics – page views, referrers, device categories, and performance – help evaluate content quality. IP addresses may be processed in a truncated or pseudonymised form where feasible. Analytics data is used only to improve the site and is not combined with direct identifiers for marketing.

Data sharing and processors

Personal data may be shared with carefully selected service providers acting as processors – hosting, analytics, security, and error monitoring. Processors act under written agreements and follow confidentiality and security requirements. Personal data is not disclosed to third parties for their independent marketing purposes.

International transfers

Where data is transferred outside the European Economic Area, appropriate safeguards are applied – such as Standard Contractual Clauses, documented risk assessments, and technical measures that reduce exposure of personal identifiers.

Data retention

• Contact records – typically retained for up to 24 months after the last interaction unless legal obligations require longer archiving.
• Analytics logs – kept in aggregated or pseudonymised form with technical retention aligned to operational needs.
• Editorial submissions – retained for the duration of the review lifecycle and compliance archiving.

Security measures

Time for Citizenship applies administrative, technical, and organizational measures to protect personal data – restricted access, encrypted transport, hardened configurations, and periodic reviews. No method of transmission over the internet or electronic storage is entirely secure; residual risk cannot be eliminated.

User rights under GDPR

Subject to conditions and exceptions under applicable law, individuals may exercise the following rights:

• Right of access – to obtain a copy of personal data processed.
• Right to rectification – to correct inaccurate or incomplete data.
• Right to erasure – to request deletion where data is no longer necessary or consent is withdrawn.
• Right to restriction – to limit processing under specific circumstances.
• Right to object – to object to processing based on legitimate interests.
• Right to data portability – to receive data in a structured, commonly used, machine-readable format.
• Right to withdraw consent – where processing relies on consent, without affecting prior lawful processing.
• Right to lodge a complaint – with a competent supervisory authority.

To exercise rights, the contact form should be used. A response will include confirmation of identity steps and timelines required by law.

Children’s data

The website is intended for adults and does not knowingly collect personal data from children. If a child’s data has been submitted, a removal request can be filed via the contact form.

Third-party links

Articles may reference external resources for context. External websites are governed by their own policies – Time for Citizenship is not responsible for their practices or content.

Policy updates

This policy may be updated to reflect legal, technical, or operational changes. The “Last updated” date will indicate the latest revision. Continued use of the website after an update signifies acceptance of the updated policy.

Key points at a glance

Contact for privacy requests

All requests regarding this policy or personal data should be submitted via the website contact form – with sufficient details to identify the request and verify identity.

Last updated – 17 October 2025.