Privacy Notice
This notice explains how EU Reg Brief handles personal data when you request the DIWASS checklist, subscribe to updates, or contact us.
1. Data controller
EU Reg Brief, operated by Marc Calbet
Spain
Contact: marccg@euregbrief.com
2. What data we collect
- Your work email address.
- Your selected professional role.
- If you opt in to future updates: your consent status, the date/time of consent, the consent-text version, and signup source.
- Technical data that may be generated by hosting and security infrastructure, such as IP address, request metadata and server logs.
We do not ask you to provide special-category data such as health information, political opinions, religious beliefs, trade-union membership, biometric/genetic information, sexual orientation or similar sensitive information through the signup form.
3. Why we use the data and our legal basis
Delivering the requested checklist
We use your email address and role to provide the DIWASS checklist that you expressly request. The legal basis is your clear request and consent to this specific processing under Article 6(1)(a) GDPR. The checklist email is a communication you requested, not an automatic subscription to future marketing.
Optional EU Reg Brief updates
We send future DIWASS and EU compliance updates only if you actively tick the separate optional checkbox. The legal basis is your consent under Article 6(1)(a) GDPR. For electronic commercial communications, we also apply the prior-consent rule in Article 21 of Spain's Law 34/2002 (LSSI).
You can withdraw consent at any time using the unsubscribe mechanism in an email or by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.
Security and service operation
Limited technical logs may be processed to operate, secure and troubleshoot the website and email-delivery infrastructure. Where EU Reg Brief determines this processing, the legal basis is our legitimate interest in maintaining a secure and functional service under Article 6(1)(f) GDPR.
4. Retention
- Checklist-only requests: if you do not opt in to future updates, the Resend contact record is scheduled for deletion after 30 days, unless it must be retained for a specific support, security or legal reason.
- Subscribers: contact and subscription data are kept while you remain subscribed. You may withdraw consent at any time.
- Compliance evidence: minimal evidence relating to consent, withdrawal or suppression may be retained where reasonably necessary to demonstrate compliance with legal obligations or handle potential claims.
- Technical logs: retained according to the applicable hosting/security settings and only for as long as reasonably needed for service operation and security.
5. Service providers
We currently use the following providers to run the service:
- Resend (Plus Five Five, Inc.) — email delivery, contact preferences and consent records.
- Vercel Inc. — website hosting and serverless infrastructure.
- Google Workspace — correspondence when you email EU Reg Brief directly.
These providers may process personal data on our behalf or, for limited service-generated data, under their own responsibilities as described in their applicable privacy terms.
6. International transfers
Some service providers are established in the United States or may process data outside the European Economic Area. Where an international transfer requires safeguards, the providers' current data-processing terms provide mechanisms such as the European Commission's Standard Contractual Clauses. You can review the current provider terms here:
7. Your rights
Subject to the GDPR and applicable law, you may request access, rectification, erasure, restriction, portability, or object to relevant processing. Where processing is based on consent, you may withdraw that consent at any time.
To exercise a right, email marccg@euregbrief.com. We may need to verify your identity before fulfilling a request.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): aepd.es, or with another competent EU supervisory authority where applicable.
8. Cookies and analytics
EU Reg Brief currently does not deploy advertising or non-essential analytics cookies on this landing page. If we introduce non-essential cookies or comparable tracking technologies, we will update this notice and implement the required consent controls before using them.
9. Changes to this notice
We may update this notice when the service, providers or legal requirements change. The current version and update date will always be shown at the top of this page. Material changes affecting consent will not be treated as consent to a new purpose without an appropriate new opt-in where required.
EU Reg Brief is an independent information resource. This privacy notice describes our current operational setup and is not a substitute for tailored legal advice.