Logo
Help us understand what you read

Some cookies are needed to run the site.

With your consent, we also use Google Analytics to understand which articles and features readers use, which guides what we cover.

We use no advertising cookies, no marketing trackers, and no profiling. Nothing changes if you refuse. Data Protection Declaration

Independent
Nuclear News

Join NucNet

NucNet Data Protection Declaration

Version 7, Brussels, 8 September 2026. Download as PDF

1. Persons With NucNet Who Are Handling Data Protection Issues

The controller of the personal data processed as described in this declaration is NucNet ASBL/VZW, Ave des Arts/Kunstlaan 56 / 2 C, 1000 Brussels, Belgium, enterprise number BE 0887.040.353. Address your questions and queries regarding data processing and protection to NucNet’s contact points:

by e-mail or by using the contact form on NucNet’s website https://www.nucnet.org, or by sending a letter to NucNet a.s.b.l., Ave des Arts/Kunstlaan 56 / 2 C, 1000 Brussels, Belgium.

2. Categories Of Processed Data

NucNet is a non-profit associations processing only a limited scope and amount of personal data. NucNet does not process so-called critical personal data.

Most processed data have been or are provided by institutional members and subscribers, and the processed data are related to the professional activity of the concerned persons. The remainder of the processed data has been or is being submitted directly by the concerned persons themselves using the website contact form, or sending an e-mail or postal letter, or by self-service registration on the website.

NucNet does not disclose data to third parties. Exceptions are mentioned hereafter and due to justified technical reasons in providing NucNet’s online services.

NucNet processes the following categories of data:

2a. Master Data

  • Contact data (eg, full name and postal or e-mail addresses, telephone numbers);
  • Content data (eg, entered or linked texts, pictures or videos);
  • Usage data (eg, visited websites, interests shown for contents by visiting pages or by submitting searching keywords, access date and time);
  • Meta and communication data (eg, information on the type of used devices, IP addresses).

2b. Personal Data

  • Visitors and users of online offers;
  • Persons working with members or subscribers and other persons who are direct recipients of the various classes of news and newsletters, which are sent by e-mail;
  • Reason and/or purpose of processing.

2c. Administration of Visitor and User Data, and Member or Subscriber Data

  • Information, which is necessary for supplying the online offers, functions and contents;
  • Answers to contact form requests and related communication with users and visitors;
  • Data, which are pertinent for safety and security, or which help prevent repetitive registration of free trial offers, or which help protect copyrights on texts, pictures or videos;
  • Reaching assessment and other data, which are useful for marketing by NucNet.

3. Relevant Regulatory Bases

In accordance with article 14 of EU’s GDPR, NucNet informs you here on the regulatory bases for the various data processing activities. The following regulation clauses are applicable to visitors and users living in a European Union or European Economic Area country:

  • Requesting consent is regulated by article 6 (1 a) of the GDPR.
  • The regulatory basis for NucNet’s processing in delivering the offered services, fulfilling the contractual obligations and activities, and answering requests is article 6 (1 b) of the GDPR.
  • The regulatory basis for NucNet’s processing in fulfilling legal obligations is article 6 (1 c) of the GDPR.
  • The regulatory basis for NucNet’s processing in preserving its justified interests is article 6 (1 f) of the GDPR.
  • Processing of data for other purposes than the purposes for which they were collected is governed by article 6 (4) of the GDPR.
  • Processing of especial categories of data, which correspond to article 9 (1) of the GDPR, is governed by article 9 (2) of the GDPR.

4. Safety And Security Measures

NucNet takes suitable technical and organisational measures to warrant an appropriate protection level. It corresponds to the level of risk, is in accordance with the regulatory requirements, and takes account of the state of technology, implementation costs, the kind, volume, circumstances and purposes of data processing, and the different occurrence probabilities and severities of the various risks for the rights and liberties of natural persons.

The measures concern in particular the security of confidentiality, integrity and availability of data by controlling physical access to them, and the availability of the data by controlling the rights of using, entering, forwarding, backing up and separating the data.

NucNet has implemented procedures, which ensure the protection of the rights of those affected, the deletion of data, and the countermeasures in case of endangerment of the data.

NucNet takes account of the protection of personal data already when choosing hardware, and when choosing and developing software, applications and processes in accordance with the data-protection principle of appropriate technological design and data-protection friendly default settings.

5. Cooperation With Contractual Processors, Common Controllers And Thirds

When in the framework of processing data, NucNet needs to disclose data to other persons and enterprises (contractual processors, common controllers or third parties), to transmit data, or to allow accessing data, this occurs only on the basis of a legal permission (eg, when it is necessary to transmit data to thirds such as an e-mail sending service or payment service in order to enable fulfilling a contract with the concerned person), or the users have authorized it, or there is a regulatory or contractual obligation such as a membership or subscription, or it occurs on the basis of NucNet’s justified interests (eg, when employing contractors, website hosting services or similar processors).

If NucNet discloses data to third persons or enterprises, transmits them or allows accessing them in any other way or form, this occurs only for an administrative reason in the framework of a justified interest and on a basis, which complies with the legal requirements.

6. Transmission To Third Countries

If NucNet processes data in a third country (ie, in a country outside the European Union, the European Economic Area or the Swiss Confederation), or has data processed in the framework of services provided by a processor in a third country, or data are disclosed or transmitted to other persons or enterprises in a third country, this occurs only, when it is necessary to meet contractual obligations, or on the basis of the concerned persons’ consent, a legal requirement, or NucNet’s justified interest.

Under the reserve of legal or contractual permissions, NucNet processes data or has processed data in a third country only, when the legal conditions were or are given. This

means, the disclosure or processing has occurred or occurs on the basis of especial guarantees such as the officially acknowledged statement that the data protection level of the processor equals the level in the EU (eg, for the United States by certification under the EU-US Data Privacy Framework, recognised by the European Commission’s adequacy decision of 10 July 2023), or by respecting officially acknowledged especial contractual obligations such as the European Commission’s Standard Contractual Clauses (2021).

7. Rights Of Concerned Persons

You as a concerned person have the right to request confirmation if data concerning you are processed, of being informed on these data, and of getting a copy of these data.

In accordance with the legal requirements, you have the right to request that the data concerning you are completed and that incorrect data are corrected.

In accordance with the legal requirements, you have the right to request that data concerning you are deleted immediately or alternatively the processing of these data is limited (eg, by requesting that your data are deactivated in a customer relationship management system).

You have the right to request a copy of the data concerning you or that these data are transferred to other data controllers.

In accordance with the legal requirements, you have the right of submitting a complaint at the Belgian data protection authority (https://www.dataprotectionauthority.be/). Their website is available in English, French, Dutch and German.

Right Of Withdrawal You have the right to withdraw from a given agreement with effect for the future.

Right Of Objection You have the right of objection against future processing of data concerning you in accordance with the legal requirements at any moment. Your objection may concern the processing for direct marketing.

8. Cookies And Consent Settings

So-called “cookies” are small data files, which are stored by website servers on the device (eg, console, personal computer, laptop, tablet or mobile smart phone) of the visitor of a website or other online service user. The cookies enable servers to recognize visitors or users (actually, identify their device instead of using the visitor’s IP address) by storing various kinds of information during or after a visit to an online offer.

There are various classes of cookies. They may differ in lifetime, origin, use and other characteristics, and a specific cookie can belong to more than one of the following classes:

  • Temporary cookies – also called “session cookies” or “transient cookies” – are automatically deleted when the online offer is left and the browser closed. Such cookies typically store the result of a text search or the login status.
  • Permanent cookies – also called “persistent cookies” – remain stored on the visitor’s device even after closing the browser. They enable storing of information, which is useful when returning to the website or similar service. Typical applications are storing login credentials allowing automatic login at the next visit, or especial interests and preferences of a user such as a format or language version. They can also be used for media-reach metrics, visitor analytics and other marketing purposes.
  • First-party cookies are placed by the on-line offer the user is visiting.
  • Third-party cookies are placed by other online service suppliers meaning that they do not stem from the operator of the visited website.
  • Session management cookies are typically used for unique session identification purposes (eg, content of a shopping chariot or log-in status) or for improving page load time.
  • Personalisation cookies are used to remember personal preferences of the user in order to show more relevant content.
  • Tracking cookies store the user’s or visitor’s browsing habits (instead of using the IP address for this purpose, because cookies allow to do this job with more precision), and they are the basis for compiling information needed to generate a so-called user profile.

NucNet uses only two kinds of cookies: strictly necessary cookies (login and session management, subscription and paywall access, security and bot-protection cookies set by the security layer (see chapter 16a), and the cookie storing your consent choice), which are always active because the services cannot be provided without them and which are exempt from consent, and one analytics cookie set (Google Analytics 4, see chapter 23), which is set only after you have given your consent.

On your first visit, a cookie banner asks for your consent to the analytics cookies with two equally presented choices, “Accept analytics cookies” and “Refuse”. No analytics cookie is set before you accept. Refusing does not restrict your use of the website. You can change or withdraw your choice at any time via the “Cookie settings” link in the website footer; withdrawal stops the analytics processing from that point on. Your choice is stored (with a time stamp as proof of consent) and you will be asked again after it expires.

If users dislike that cookies are stored on their device (computer or similar appliance), they can additionally deactivate the corresponding option in their browser’s settings. Many browsers offer a choice of adaptive cookie settings and allow selective acceptance (eg, only first-party cookies) and storage management (eg, “only session cookies” allowed or “automatic cookie management” enabled, which usually is a recommendable, smart handling choice). In addition, the browser setting options usually allow to delete all or a choice of stored cookies periodically.

Be advised that the complete exclusion of cookies results in noticeable constraints of essential website facilities. In case of NucNet’s website, login, access to restricted archived news material (so-called NucNet services) and exclusion of robots in submitting of contact forms does not work properly, and this even, if a visitor has entered the correct personal credentials, because the server is programmed in way that it cannot recognize the device without finding a pertinent cookie. Also, search results are not presented in full or not at all and page reloading may take more time.

NucNet does not use advertising or marketing tracking cookies, so no objection procedure via third-party opt-out platforms is necessary.

9. Deletion Of Data

The data processed by NucNet are deleted or their processing will be limited in accordance with legal requirements. Except in cases specified in this data protection declaration, data stored by NucNet are deleted as soon as they are no more needed for fulfilling their purpose and if their deletion is not in contradiction to specific legal requirement (eg, storing pertinent business and accounting data is legally required for up to ten years).

In case the data are not deleted because they are requested for legally acceptable purposes, their processing is normally restricted by deactivation in NucNet’s customer relationship management system. Deactivation means that the data are marked as “blocked” and can be accessed and processed only with special controller credentials. This policy applies to data which must be stored for reasons of commercial regulation or tax declaration.

Note that NucNet is not obliged to store any data on behalf of users after the completion of a contractual obligation or relationship. It is up to the users to back up their data before a relationship expires. NucNet has the right to irretrievably delete all data, which had been stored during the contractual period, without consultation.

10. Modification And Updating Of This Data Protection Declaration

You are invited to inform yourself periodically on the content of this data protection declaration. It will be updated when data protection regulation changes or when NucNet’s data processing is submitted to modifications for technical or management reasons. You will be informed proactively by NucNet only when a data-processing modification requests your explicit consent (agreement), which normally does not apply.

11. Performing NucNet’s Statutory And Business Services

NucNet processes the data of its members, supporters, subscribers and other actual and prospective members or customers, and of other persons in accordance with article 6 (1 b) of the GDPR, when providing contractual services or developing activities in the framework of existing business relationships in particular with members, or when NucNet is a recipient of services or donations.

NucNet processes the data of persons in accordance with article 6 (1 f) of the GDPR based on NucNet’s justified interests and when administrative tasks are fulfilled, or for public relations or marketing purposes.

The data processed in such contexts, the methods, the volume and the purpose, and the need of processing are determined by the contractual situation on which they are based. Principally, master data and personal data (in particular names, working places or companies, in specific cases complete postal addresses or just information on the country of residence), electronic contact data (in particular e-mail addresses and for especial services mobile telephone numbers), contract data (requested services, logging of delivered contents and other information, names of contact persons, mutation data and reasons), and in case of delivering paid services or products payment status and limited transaction metadata (full payment data such as card and bank details are processed directly by the payment service provider Stripe and are not received by NucNet, see chapter 29) are concerned by processing.

NucNet deletes or deactivates (i.e., blocks and makes inaccessible for other persons than the controllers) the data which are no more needed for performing statutory or business services. Deletion or deactivation depends on the concerned tasks, the past, present or potentially future contractual relationship status and the legal background. In case of business relationships, NucNet stores the data as long as it is necessary for diligent business management including possible warranty and liability periods. The necessity of storing such data is reassessed every three years. The legal storage requirements are respected.

12. Registration Function

Users can launch the creation of a user account or have a user account created by a commissioned third party. In the framework of the registration process, the users are informed on the compulsory data, which depend on the registration category, and on the additional data they may reveal for optimizing services.

Registration data are processed based on article 6 (1 b) of the GDPR in order to enable the requested functions of the user account (eg, membership, subscription or trial). The processed data can comprise personal login credentials (user identity, preferred e-mail address and password). The data, which are entered for registration, are exclusively used for the purposes of the registered user account. The users may be informed by e-mail on the information which is pertinent for the user account such as technical modifications. When a user has cancelled the account, the data are deleted or deactivated under provision of legal storage requirements. It is up to the users to back up their data before they terminate a contractual relationship. NucNet has the right to irretrievably delete all data, which had been stored during the contractual period, without consent.

In the framework of using NucNet’s registration and membership and subscription functions and during the contractual period, NucNet may store the IP addresses and time stamps

characterising the using activities. The basis for storage is the protection of both NucNet’s justified interests and the user’s interest in protection against abuse or other unauthorized utilization. Forwarding of data to third parties is principally excluded except when forwarding is necessary for protecting NucNet’s interests or for technical reasons when performing contractual services, or if there is a legal requirement according to article 6 (1 c) of the GDPR. Stored IP addresses are anonymized or deleted not later than seven days after their storage as a rule.

13. Free Accounts And Trial Functions

NucNet offers a free registered account (“NucNet Free”) created by self-service registration on the website. New registered users may receive a one-time free trial of the paid subscription tier for the period stated at registration (currently 14 days). No payment details are collected for the trial, and at the end of the trial period the account automatically reverts to NucNet Free unless the user takes out a paid subscription. Registration data are processed for these purposes on the basis of article 6 (1 b) of the GDPR. Newly registered users receive a confirmation e-mail (double opt-in) with the purpose of making sure that they are the owner of the given e-mail address and have launched the registration. Data which help prevent repeated registration for free trials (see chapter 2) are processed on the basis of NucNet’s justified interests in accordance with article 6 (1 f) of the GDPR.

Users may cancel a trial registration any moment. The confirmation mail they have received comprises information on the withdrawal options and procedures. In order to have a proof of evidence on the consent by the user, NucNet stores the registration time stamp including the user’s IP address and deletes or deactivates this information in due course after cancellation by the user.

The reception of a trial service may be cancelled any moment by withdrawing the consent (authorisation). However, NucNet may store names and e-mail addresses in form of deactivated data for up to ten years based on protecting its justified interests by keeping a proof of evidence regarding the formerly given consent. Processing of deactivated data is limited to the defence against possible claims. An individual deletion request may be submitted any moment when confirming at the same time the former existence of consent.

14. Contact Establishment

When a user establishes her or his contact with NucNet (in particular when submitting a request by using the contact form, sending an e-mail, calling, or contacting NucNet via social media), the user data are stored in order to enable processing and handling of the request in accordance with article 6 (1 b: pre-contractual or contractual relationship) or with article 6 (1 f: other requests). NucNet may enter the user data into its customer relationship management system or in comparable request-handling systems (eg, archive of received e-mails).

Requests are deleted or deactivated as soon as they are no more needed. The need for further storage of such data is checked every three years or in accordance with the legal requirements.

15. News And Newsletters

The following comments inform on the content of NucNet’s news and newsletters (hereafter shortly called “newsletters”), the registration, the dispatching and the statistical analysis procedures, and on the recipients’ rights of objection. By registering for receiving NucNet’s newsletters, the recipients declare consent with newsletter reception and with the explained procedures.

15a. Content Of The Newsletters

NucNet produces and sends newsletters by e-mail and – should the situation arise – by other electronic and telecommunication means only with the consent of each recipient or a legal permission. NucNet’s newsletters are focused on factual information on nuclear energy, ionizing radiation and related topics. NucNet may enclose or attach supplementary and paid advertising information to the newsletters such as announcements of events and other publicity on products and services in the fields of nuclear energy, ionizing radiation and related topics, and additional information on NucNet’s services and their background. Such sponsored elements are always clearly marked as sponsored and visually distinguished from NucNet’s editorial content; they form part of the newsletters as described in NucNet’s subscription terms and conditions.

In case, a newsletter registration specifies a format and/or content in more detail, these specifications are relevant for the user’s agreement.

15b. Registration Without Or With Double-opt-in Procedure And Registration Logging

There are two methods to register for reception of NucNet’s newsletters, which in most cases involve a paid membership or subscription contract:

  • Classical registration is based on an exchange of e-mails or postal letters. This kind of registration is habitually launched by a member representative in the framework of a new or existing paid membership or subscription, and the representative suggests adding a person to the list of direct recipients of e-mailed newsletters, other e-mailed services or other services using telecommunication services. Alternatively, the registration starts with a request by an individual person wanting to be registered following an offer sent back by NucNet and a trial period before a formal membership adherence or subscription order is received. All new newly registered members and subscribers get a welcome e-mail with information on the newsletter service conditions and options (reason for starting the service, reference to the membership or subscription contract, methods of modification or cancellation of the services, login-in credentials, use of cookies, etc.). The exchanged e-mails are logged by NucNet in order to have proof of evidence for consent in accordance with legal requirements. Logging comprises adding

the personal data, membership or subscription data and date and time of confirmation to the aforementioned customer relationship management system, and logging of the IP address. Later modifications are also logged in the customer relationship management system.

  • Double-opt-in: NucNet offers a self-service registration for free accounts and trials directly on the website (see chapter 13). In reply of his or her preliminary registration, the user gets an e-mail, which requests confirmation of the registration. This confirmation process step is necessary to make sure that nobody can register with a foreign e-mail address. When confirmation has succeeded, the following steps are the same as in the classical registration procedure, and each step is logged to have proof of evidence in accordance with legal requirements.

15c. Registration Data Handling

Delivery of the family name and a valid e-mail address is sufficient for newsletter registration. However, and in order to enable personalisation and optimisation of the services provided, more personal data such as salutation, title, name of the employer, working place or private postal address and country of residence are welcome and useful. In the event of a paid membership or subscription this kind of additional information is requested for obvious diligent business management reasons.

The aforementioned registration procedure methods are the basis of consent by the recipient in accordance with article 6 (1 a) and article 7 of the GDPR. If consent is not necessary based on NucNet’s justified interests in direct marketing of its services, directly sending newsletters is in accordance with article 6 (1 f) of the GDPR.

The logging and storage of the registration process data is based on NucNet’s justified interest according to article 6 (1 f) of the GDPR. NucNet’s interest is focused on operating a user-friendly, dependable and safe newsletter system. This approach serves both NucNet’s business interests and the users’ expectations, and it allows to keep proof of consent.

15d. Cancellation And Revocation

A subscriber or member may cancel reception of NucNet’s newsletters any moment, ie revoke his or her consent. A link to an e-mail address for sending the revoking request can be found at the end of all newsletters.

Note that this declaration governs only the processing of personal data. The duration, renewal and cancellation of paid subscriptions and memberships are governed by NucNet’s subscription terms and conditions published on the website; the rights and obligations of NucNet’s statutory members are governed by NucNet’s articles of association and by-laws.

NucNet is allowed to store expired e-mail addresses and other data of a cancelled agreement for up to ten years before deletion to protect NucNet’s justified interests by keeping proof of consent. Such data are “deactivated”, ie they can be accessed only by controllers and their authorized office support staff, and their processing is limited. An individual deletion request

may be submitted any moment when confirming at the same time the former existence of consent.

16. Website Hosting And Handling Of E-mails Others Than News And Newsletters

NucNet has subscribed DNS registration, website hosting and e-mail services, which are needed for providing the offered online services.

NucNet has contracted DNS registration, “Plex” website hosting and “OX e-mail” services for handling e-mails others than news and newsletter dispatching with EuroDNS S.A., rue Léon 21, 3372 Leudelange, Luxemburg, who cooperate with Open-Xchange AG, Rollnerstrasse 14, 904087 Nürnberg, Germany for e-mail services.

The data protection policies of these providers can be consulted at https://www.eurodns.com/privacy-policy and https://www.open-xchange.com/privacy/

NucNet’s hosting service provider processes master data, contact data, content data, contract data, usage data, and meta and communications data of customers, interested persons and visitors of the online services on the basis of NucNet’s justified interest in efficiently, dependably and safely providing NucNet’s offered online services in accordance with article 6 (1 f) and article 28 of the GDPR (conclusion of a processor service contract). Note that the DNS, hosting and e-mail service providers are not allowed to use the personal data they process on behalf of NucNet for any other purposes.

16a. Content Delivery And Security Layer (Cloudflare)

NucNet routes the traffic of its websites through the content delivery and security services of “Cloudflare”, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States. Cloudflare acts as a reverse proxy: requests to NucNet’s websites pass through Cloudflare’s network, which protects the websites against distributed denial-of-service attacks and other abusive or fraudulent traffic, filters malicious requests, and accelerates the delivery of contents by caching.

For these purposes, Cloudflare processes the technical data of each request, in particular the IP address of the visitor, the requested URL, technical browser and device information, and security-relevant metadata. Cloudflare may set strictly necessary cookies serving exclusively the security and bot-protection functions; these cookies do not track visitors across websites, are not used for marketing, and are exempt from consent as they are required to provide the requested service securely (see chapter 8).

The regulatory basis for this processing is NucNet’s justified interest in accordance with article 6 (1 f) of the GDPR in the security, integrity and availability of its online services. Cloudflare has been commissioned as a processor under a contract in accordance with article 28 of the GDPR and is not allowed to use the data for any other purposes. Transfers to the United States are safeguarded by Cloudflare’s certification under the EU-US Data Privacy

Framework and by the European Commission’s Standard Contractual Clauses. Cloudflare’s data protection policy can be consulted at https://www.cloudflare.com/privacypolicy/.

16b. Human Verification Service (hCaptcha)

On pages containing forms (in particular registration, contact and quote-request forms), NucNet uses the human verification service “hCaptcha” provided by Intuition Machines, Inc., 350 Alabama Street, San Francisco, CA 94110, United States, in order to distinguish requests made by humans from automated requests and to protect the forms against spam, abuse and automated attacks.

For this purpose, hCaptcha processes technical data of the visitor’s request, in particular the IP address, browser and device information, and interaction data generated when completing the verification (such as mouse movements and time spent on the page). hCaptcha may use cookies or similar technologies serving exclusively this verification function; these are strictly necessary for the secure provision of the requested form function, do not track visitors across websites and are not used for marketing (see chapter 8).

The regulatory basis for this processing is NucNet’s justified interest in accordance with article 6 (1 f) of the GDPR in protecting its forms and services against automated abuse. Transfers to the United States are safeguarded by the provider’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses. hCaptcha’s data protection policy can be consulted at https://www.hcaptcha.com/privacy

17. Cloud-based Application Platform

NucNet has subscribed a platform as a service (PaaS) contract which enables NucNet and its commissioned IT specialists to develop, build, run and operate the applications needed for providing the offered online services in an efficient, dependable and safe cloud environment.

The contracted application PaaS is provided by “Heroku” of Salesforce.com Inc., Salesforce Tower, 3rd floor, 415 Mission Street, San Francisco, CA 94105, United States.

The data protection policy of this provider can be consulted at https://www.salesforce.com/company/privacy/

NucNet’s PaaS contract ensures that master data, contact data, content data, contract data, usage data, and meta and communications data processed on behalf of NucNet in the Heroku cloud environment are sufficiently protected and not used for other purposes than in NucNet’s justified interest in accordance with article 6 (1 f) and article 28 of the GDPR (conclusion of a processor service contract). Transfers to the United States are safeguarded by Salesforce’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses incorporated in the processing contract.

18. Newsletter Dispatching Service Provider

The e-mails bringing NucNet’s news and newsletters are sent by means of a specialized dispatching service provider. This mass SMTP service is provided by “Mailgun EU Region Global Services” of Mailgun Technologies Inc. (a Sinch company), 548 Market Street #43099, San Francisco, CA 94104, United States. The server employs a fixed IP address.

The data protection policy of the SMTP service provider can be consulted at https://www.mailgun.com/gdpr

The dispatching service provider has been commissioned as an external processor based on NucNet’s justified interests according to article 6 (1 f) of the GDPR and the service contract agrees with article 28 (3.1) of the GDPR, and receives only the minimum of data needed for performing the contracted service. The dispatching service provider may use the received recipients’ data in a pseudonymous format, ie without assignment to the users to allow optimisation or improvement of the dispatching services (eg, enabling technical optimisation of sends, exchange with spam or junk filtering service providers, improving the newsletter presentation or collecting statistical data). But the dispatching service provider is not allowed to use the data of NucNet’s newsletter recipients for sending anything else to them, and transmission of the data to any third party is forbidden. Transfers to the United States are safeguarded by the provider’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses; NucNet uses the provider’s EU region for dispatching.

Links contained in the newsletters are routed via the dispatching service provider in order to count, in aggregate, how often each link is clicked (“click tracking”). This processing is based on NucNet’s justified interest in accordance with article 6 (1 f) of the GDPR in understanding, at an aggregate level, which contents and placements of the newsletters are relevant to recipients, in improving the service, and in reporting aggregate click counts for clearly marked sponsored placements. The click data are retained by the dispatching service provider for no longer than 15 days and are then deleted. NucNet does not export these data, does not link them to individual recipients or to its customer relationship management system, and does not create engagement profiles. NucNet’s newsletters do not contain open-tracking pixels: whether and when a recipient opens a newsletter is not recorded. You may object to click tracking at any time (see chapters 1 and 7).

19. Access Data Collection And Logfiles

NucNet’s hosting service provider EuroDNS (see chapter 16) collects data based on NucNet’s justified interest according to article 6 (1 f) of the GDPR about every access to the server, where these online services are hosted (so-called server logfiles). The access data comprise the name of the visited website and files, date and hour of the access, transmitted amount of data, report on successful page calls, type and version of the used browser and operational

system used by the visitor, the referrer URL (identification of the previously visited page), IP address, and the requesting provider.

The logfile information is collected for safety reasons (eg, to enable investigation of abusing services or other fraudulent activities) and it is stored for not more than seven days. Afterwards, it is deleted unless an extended storage period is needed for reason of keeping evidence on an abnormal event. Such logfiles are deleted only after final clarification of the event.

20. Image Processing

NucNet uses the online image processing service “Imgix” provided by Zebrafish Labs Inc., 1141 Howard Street, San Francisco, CA 94103, United States, on the basis of NucNet’s justified interest according to article 6 (1 f) of the GDPR.

The data protection policy of this provider can be found at https://www.imgix.com/privacy

Image processing does normally not involve personal data except copyright information on pictures and possible rights on photographs showing persons. In any case, the provider is not allowed to use image data for any other purpose than rendering the contracted service. Transfers to the United States are safeguarded by the European Commission’s Standard Contractual Clauses incorporated in the processing contract.

21. Data Storage

NucNet’s has a data storage contract with the data storage service provider “Amazon Simple Storage Service” (Amazon S3), Amazon Web Services EMEA SARL, 5 rue Plaetis, 2338 Luxembourg, Luxemburg, on the basis of NucNet’s justified interest according to article 6 (1 f) of the GDPR.

The data protection policy of this provider can be consulted at https://aws.amazon.com/compliance/data-privacy-faq

According to the service contract, the provider stores the data, protects them against unauthorized access, and ensures permanent availability and backup of the data, but does not process the data and is not allowed to use the data for any other purpose than safely storing them. Data are stored in an EU region; where a transfer to the United States occurs, it is safeguarded by Amazon’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses.

22. Application Suite Maintenance

NucNet has contracted a maintenance and updating service contract for its IT application suite with its main developer Evermore Ltd., 19 Yanko Sakazov, 1504 Sofia, Bulgaria, on the basis of NucNet’s justified interest according to article 6 (1 f) of the GDPR.

The data protection policy of this provider can be consulted at https://weareevermore.com/privacy-policy.htm

Although the maintenance contract involves administrator credentials enabling the provider’s specialists to access all facilities and data of NucNet’s IT application suite, the provider and its staff are not allowed to process and use any of these data for purposes other than ensuring availability of NucNet’s services, testing applications and keeping them up-to-date.

23. Use Of Google Analytics 4 (With Consent)

NucNet uses “Google Analytics 4” (GA4), a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse how NucNet’s online offers are used and to improve them. GA4 is activated only after you have given your consent via the cookie banner described in chapter 8; the regulatory basis for this processing is your consent in accordance with article 6 (1 a) of the GDPR. If you refuse or withdraw consent, no GA4 cookies are set and no analytics data about your visit are collected. You can withdraw your consent at any time via the “Cookie settings” link in the website footer.

GA4 does not log or store the IP addresses of visitors; IP data are used only transiently to derive coarse location and are then discarded by Google. NucNet has disabled Google Signals and advertising personalisation features, does not use GA4 data for advertising purposes, and has set the data retention period in GA4 to the minimum that serves its analysis needs. Analytics data may be transmitted to Google servers outside the European Union; such transfers are safeguarded by Google’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses.

More information on the use of data by Google and on setting and objection options can be found in Google’s data protection declaration at https://policies.google.com/privacy and https://support.google.com/analytics/answer/9019185?hl=en#zippy=%2Cin-this-article

24. Online Presence In Social Media

NucNet is present online on social media network platforms in order to communicate there with active customers, interested persons and other users and enabling to inform on NucNet’s services.

Note that social media may process user data outside European Union and European Economic Area countries resulting in certain risks for users such as complications in enforcement of user rights.

Regarding the offers from the United States, transfers are safeguarded where the providers are certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov ) or rely on the European Commission’s Standard Contractual Clauses.

Note also that the data of social media networks are usually processed for marketing research and advertising purposes. This processing allows to generate user profiles based on the usage behaviour and the deduced interests. The user profiles can then be used for posting advertisements inside and outside the platforms guessing that a user is interested in. As a general rule, tracking cookies, which characterise the user behaviour and interests, are placed on the users’ computers or other devices for this purpose. In addition, the user profiles can comprise data which are independent from the used device. (This happens in particular when the user is a member of the visited social media platform and has logged in to the platform.)

The possible processing of personal user data due to visiting NucNet’s profiles on social media platforms occurs on the basis of NucNet’s justified interests in efficient user information and communications with the users in accordance with article 6 (1 f) of the GDPR. In case the users are asked for consent with data processing by the social network platform operators (ie, they declare their consent simply by ticking a control box or clicking on a button), the regulatory basis of processing is established in accordance with article 6 (1 a) and article 7 of the GDPR.

The below links bring a more detailed presentation of the processing and objection options (opt-out conditions) offered by each social media platform operator. Please note that requests for more information and assertion of user rights should be addressed directly to the platform operators who alone can handle them since only platform operators have access to the actually stored user data, can directly answer questions, and can launch suitable measures.

24a. Meta (Facebook)

Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland

24b. Google And YouTube

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland

24c. X (formerly Twitter)

X Corp., San Francisco, USA (EU users: Twitter International Unlimited Company, One Cumberland Place, Dublin 1, Ireland)

24d. LinkedIn

LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland

The assumption is always that the third-party operator sees the user’s IP address since contents cannot be delivered back to the browser without IP address. With other words: the availability of the IP address is requested for the presentation of contents. NucNet makes an extra effort to use only contents from its profiles, which just need the IP address for delivery.

Note that third party providers can use so-called pixel tags (practically invisible graphics also called “web beacons”) for statistical and marketing purposes. Pixel tags allow to collect information such as the visitor traffic on website pages. In addition, pseudonym information can be placed on the user’s computer or other website visiting device in form of cookies, which store technical information on the browser and operational system, referring websites, date and time of the visit and more user information on the usage of NucNet’s profiles on social media platforms, and such information can then be merged with information stemming from other sources (for more information on cookies: see chapter 8).

25. Use Of Facebook Social Plugins

Based on NucNet’s justified interests (ie, the interests of analysing and optimising economic operations of NucNet’s online offers according to article 6 (1 f) of the GDPR), NucNet may use plugins of the social network https://www.facebook.com/ operated by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland).

These plugins may comprise contents such as texts, pictures or videos and buttons which allow the users to share the contents of the online offer made by NucNet’s profile inside Facebook. The list and presentation of Facebook’s social plugins can be viewed under the link https://developers.facebook.com/docs/plugins/

Transfers to the United States by Meta are safeguarded by Meta’s certification under the EU-US Data Privacy Framework.

When a user calls a function of the online social plugin offer by clickng on a button such as “like” or “share” on the profile, the device established a direct connection with the Facebook server. Facebook will send back the content of the plugin directly to the user’s device and the device merges it with the online offer. Doing this, Facebook may use the processed data to generate or update a user profile. NucNet cannot influence the volume of data, which Facebook collects using social plugins and can just inform the users directly according to NucNet’s best state of knowledge.

By merging of the plugins, Facebook receives the information that a user has called the corresponding page of the online offer. In case the user is logged in on Facebook (what is

usually the case), Facebook can assign the visit to the user’s Facebook account. When the user interacts with the plugins, for instance by clicking a “like” button or entering a “comment”, the user’s device sends the corresponding information directly to Facebook, where it is stored. When the user is not a member of Facebook, the social media platform can nevertheless read the IP address and store it. Facebook says that only an anonymised IP address is stored from users staying in a European Union or European Economic Area country.

The purpose and amount of data collected, processed and used by Facebook together with the rights and setting options to ensure privacy of the users can be found in Facebook’s data protection notes at https://www.facebook.com/about/privacy. If a user is a member of Facebook, but dislikes that Facebook collects data on such online offers and visits, and links them with the membership data stored by Facebook, it is necessary to log out from Facebook before using NucNet’s offers on Facebook and in addition delete all pertinent cookies. More setting options and objection facilities against the use of data for advertising purposes are available within the Facebook profile settings at https://www.facebook.com/settings?tab=ads, on the US website “Your Ad Choices” at http://optout.aboutads.info/?c=2&lang=EN or via the EU website “Your Online Choices” at http://www.youronlinechoices.com/. The chosen settings are independent from the platform and are effective on all kinds of devices such as desktop computers, laptops, tablets or smart mobile phones.

26. More On X

In the framework of its online offers, NucNet may integrate functions and contents of the social network X, formerly Twitter (X Corp., San Francisco, USA; for EU users: Twitter International Unlimited Company, One Cumberland Place, Dublin 1, Ireland).

Contents such as texts, pictures or videos and buttons may belong to the integrated online offers allowing users to share these online offers within X with X members. In case the user is a member of the platform, X can assign the called contents and functions to the profile of the registered user.

X’s data protection declaration can be found at https://x.com/en/privacy; privacy settings can be found at https://x.com/settings/privacy_and_safety

27. More On LinkedIn

In the framework of its online offers, NucNet may integrate functions and contents of the social network LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland).

Contents such as texts, pictures or videos and buttons may belong to the integrated online offers allowing a user to share these online offers within LinkedIn with LinkedIn members. In case the user is a member of the platform, LinkedIn can assign the call of the contents and functions to the profile of the user.

Transfers to the United States by LinkedIn are safeguarded by LinkedIn’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses.

LinkedIn’s data protection declaration can be found at https://www.linkedin.com/legal/privacy-policy. Opting out options can be found at https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

28. Bitly Link Management

In the framework of its online offers, NucNet may use the link management services for text, picture and video files provided by “Bitly”, Bitly Inc., 139 5th avenue, 5th floor, New York, NY 10010 USA. Links to contents such as texts, pictures and videos are simplified and unified by Bitly. In case the user is a member of the service provider, Bitly can assign the use of the linking function to the profile of the user.

Transfers to the United States by Bitly are safeguarded by the European Commission’s Standard Contractual Clauses.

Bitly’s data protection declaration can be found at https://bitly.com/pages/privacy .Bitly uses cookies and visitors may opt out by clicking the corresponding links in the data protection declaration.

29. Payment Processing (Stripe)

Payments for NucNet’s paid individual subscriptions are collected through the payment service provider “Stripe”, Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (with affiliated Stripe entities, including Stripe Inc. in the United States).

Your credit or debit card details, bank details and other payment credentials are provided by you directly to Stripe and are processed by Stripe. NucNet does not receive, store or otherwise handle your card or banking details at any time. NucNet receives from Stripe only confirmation of the payment status and limited transaction metadata (such as the amount, date, invoice reference and the last digits of the card) necessary to administer the subscription, issue invoices and meet accounting and tax obligations.

The regulatory basis for this processing is article 6 (1 b) of the GDPR (performance of the subscription contract) and article 6 (1 c) of the GDPR (legal accounting and tax obligations). For the payment data it processes, Stripe acts under its own responsibility as an independent controller in accordance with its own privacy policy, which can be consulted at https://stripe.com/privacy. Transfers of data to Stripe entities in the United States are safeguarded by Stripe’s certification under the EU-US Data Privacy Framework and by the European Commission’s Standard Contractual Clauses.

30. Verification Of Reduced-Rate Eligibility

NucNet may offer reduced-rate subscriptions to eligible groups such as students and retirees. To confirm eligibility, NucNet may ask for suitable evidence, for example a valid student card or enrolment confirmation. Verification is a one-time check at the point of application or renewal.

NucNet does not retain copies of documents provided for verification. Documents are viewed for the sole purpose of confirming eligibility and are deleted or returned once eligibility has been confirmed or refused. NucNet records only the outcome of the check (eligible or not eligible) and its date. The regulatory basis for this processing is article 6 (1 b) of the GDPR (steps at the request of the concerned person prior to entering into, or performing, the subscription contract).

31. Dedicated Partner Emails (Opt-in)

Separately from the newsletters described in chapter 15, users may opt in at registration, or at any time afterwards in their account settings, to receive occasional dedicated partner emails from NucNet. These emails may contain partner content such as sponsored articles, advertorials and sponsored opinion pieces, and announcements of industry events, conferences, webinars, white papers and similar material. All such content is clearly marked as sponsored.

The regulatory basis for sending these emails is the user’s consent in accordance with article 6 (1 a) and article 7 of the GDPR. Consent is requested by an unticked checkbox presented separately from the acceptance of NucNet’s subscription terms, and the time stamp and source of each consent are logged as proof of evidence. Consent may be withdrawn at any time via the unsubscribe link contained in every partner email or through the account settings, without any effect on the user’s account, subscription or newsletters.

All partner emails are prepared and sent by NucNet itself (using the dispatching service provider described in chapter 18). NucNet does not share, sell, rent or otherwise disclose the personal data of its users, subscribers or newsletter recipients to partners, sponsors or advertisers.

32. Used Reference Material

  • Data protection generator “Datenschutz-Generator.de” posted in German by Dr. iur. Thomas Schwenke Attorneys, Berlin, Germany (https://datenschutz-generator.de);
  • Keeping up with the GDPR – an overview of the guidelines of the Article 29 Working Party and the Belgian Privacy Commission published by Eubelius Attorneys, Brussels, Belgium (https://www.eubelius.com/);
  • European Commission adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/);
  • Belgian Data Protection Authority cookie guidance

(https://www.dataprotectionauthority.be/).

© 2026 NucNet. All Rights Reserved.