Privacy policy

This is the data protection information required by Articles 13 and 14 of the General Data Protection Regulation, for the Bezirk 15 publication: the newsletter on Substack, the site it links to, and email sent to me about it. It is written to be read, not to be skimmed past.

1. Who is responsible

Patrick Böhler Seitenstettengasse 5/37, 1010 Vienna, Austria patrick@gazzetta.xyz

I am the controller for the processing described here. There is no data protection officer, because the scale of this publication does not require one under Article 37 GDPR.

2. What this covers

Three things:

• the newsletter and its subscriber list, which run on Substack

• the website, which runs on Cloudflare Pages

• email you send me

Where a service processes data under its own terms rather than mine, that is stated and linked below.

3. If you subscribe to the newsletter

What is processed. Your email address, any name you give, the date you subscribed, and whether you opened or clicked a given issue. Substack records this by default. I see it in aggregate and, for individual subscribers, in the subscriber list.

Why. To send you the newsletter, and to see roughly whether it is being read.

Legal basis. Your consent under Article 6(1)(a) GDPR, given when you enter your email address to subscribe. You can withdraw it at any time by unsubscribing, with effect for the future.

Who else is involved. Substack, Inc., 548 Market Street PMB 72296, San Francisco, CA 94104, USA, acts as processor for the subscriber list and sends the emails. Substack’s own privacy policy applies to your Substack account, which is a relationship between you and Substack that I am not party to: https://substack.com/privacy

For anything that concerns Substack rather than me, its privacy contact is privacy@substackinc.com and its representative in the EU under Article 27 GDPR is Bird & Bird GDPR Representative Services, Zuid-Hollandplein 22, 2596 AW The Hague, Netherlands, EUrepresentative.Substack@twobirds.com

Open and click tracking. Substack embeds a tracking pixel in outgoing emails and rewrites links, so opens and clicks are recorded against your address. I did not build this and cannot switch it off for the whole publication. If you would rather not be counted, most mail clients can be set to block remote images, which stops the open pixel.

Unsubscribing. Use the link at the bottom of any issue, or your Substack account settings. Substack keeps a record of the unsubscribe so you are not re-added by accident.

4. If you read the website

Hosting. The site runs on Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as processor. Serving a page necessarily involves your IP address, the time of the request, the page requested, and your browser’s user agent string. Cloudflare processes these to deliver the page and to defend against attacks.

Legal basis. Article 6(1)(f) GDPR, my legitimate interest in operating a website that works and is not knocked over.

The password cookie. Parts of the site are behind a password. When you log in, the site sets one cookie named b15_session. It contains a signed marker and an expiry time, nothing else: no name, no email address, no identifier that points back to you. It is strictly necessary to keep you logged in and therefore does not require consent under section 165(3) of the Austrian Telecommunications Act 2021. Clearing it logs you out.

Analytics. The site uses Cloudflare Web Analytics, which reports page views, referrers, countries, device types and load times. Cloudflare states that it does not track individual users across the sites that use it. What I see is counts, not people. Cloudflare’s data protection terms are at https://www.cloudflare.com/cloudflare-customer-dpa/

What the site does not do. No advertising, no third-party tracking scripts, no social media pixels, no profiling, no automated decision-making.

5. If you comment

Comments run on Substack and are visible to other readers along with the name on your Substack profile. Substack processes them under its own terms. I can delete a comment on my publication; deleting your Substack account is something only you and Substack can do.

6. If you write to me

Email to patrick@gazzetta.xyz is processed to answer you, on the basis of Article 6(1)(f) GDPR. Mail sits on the mail provider’s servers and on my machine.

If you write to me as a source, that correspondence is editorial material. Under section 31 of the Austrian Media Act I have a right to refuse to disclose the identity of a source, and I will use it. This is a right to refuse disclosure, not a technical guarantee: email is not secure against interception or against seizure of the device it sits on. If something is sensitive, say so and we will find a better channel before you send it.

7. If you appear in what I publish

Most of what this publication reports comes from public documents: motions, written questions, answers and minutes of the Rudolfsheim-Fünfhaus district council, and other official records. These contain the names of people acting in a public capacity, and reporting on them is the point of the exercise.

Processing personal data for journalistic purposes is governed by Article 85 GDPR and, in Austria, by section 9 of the Data Protection Act. That provision disapplies a substantial part of the GDPR, including most of the data subject rights in Chapter III, for processing carried out for journalistic purposes. The exact scope has been contested since the Constitutional Court struck down the earlier version, and it was rewritten with effect from 1 July 2024.

Rather than argue about the boundary, here is what I actually do. If you are named in a brief and something about you is wrong, write to me and I will check it against the source and correct it, and say in the text what changed. If you think something should not have been published at all, write to me and I will give you a reasoned answer. Research material about identifiable people is kept only while it is relevant to reporting, and is not used for anything else.

8. Transfers outside the EU

Substack and Cloudflare are both United States companies, so data reaches the United States.

• Substack states in its privacy policy that it complies with the EU-U.S. Data Privacy Framework, and provides Standard Contractual Clauses in its publisher agreement.

• Cloudflare provides Standard Contractual Clauses in its data processing addendum.

The European Commission’s adequacy decision for the Data Privacy Framework was challenged and upheld by the EU General Court on 3 September 2025 in Latombe v Commission. It remains in force. It could still be annulled on appeal or withdrawn, as its two predecessors were. If that happens I will say so and change the arrangement.

9. How long data is kept

• Subscriber data: for as long as you are subscribed, plus whatever record Substack keeps of the unsubscribe so you are not re-added.

• Server logs and analytics: for the retention periods Cloudflare applies. I do not keep a separate copy.

• Email: as long as needed to deal with the matter, and longer where it is editorial material or where a legal retention period applies.

• Published briefs: indefinitely, since a corrected archive is more useful than a deleted one. Corrections are marked rather than silently applied.

10. Your rights

Under Articles 15 to 21 GDPR you can ask for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what was done before.

Write to patrick@gazzetta.xyz. I will answer within one month. Section 7 explains where these rights are narrowed for journalistic processing.

If you think your data has been processed unlawfully, you can complain to the Austrian data protection authority:

Österreichische Datenschutzbehörde Barichgasse 40-42, 1030 Vienna, Austria +43 1 52 152-0 dsb@dsb.gv.at https://dsb.gv.at

11. Security and what I do not do

Access to the subscriber list is protected by two-factor authentication on the Substack account. The site is served over HTTPS.

I do not sell subscriber data, do not share it with advertisers, do not run advertising, and do not pass the list to anyone. There are no sponsors. The only third parties involved are the ones named above, and they are named because they are technically unavoidable, not because they pay for anything.

12. Changes

If this policy changes materially, the change will be announced in a post before it takes effect, and the date below will be updated.

Last updated: 17 August 2026.