Human on Paper

Privacy Policy

Effective date: 7 October 2026 | Website version

This Privacy Policy explains how Human on Paper Publishing processes personal data when you visit the Human on Paper website, subscribe to the newsletter, contact us, or follow links to external platforms. It is intended to provide the information required by Articles 12 and 13 of the General Data Protection Regulation (GDPR).

The Website is informational and editorial. Products are not purchased directly through the Website. Links may lead to external platforms, including Amazon or other sales, social-media or content platforms, which process data under their own privacy notices.

1 Controller

The controller responsible for the processing described in this Policy is:

Human on Paper Publishing is operated by Natalia Sanchidrián Polo as an individual entrepreneur. A data protection officer has not been appointed because no statutory appointment requirement currently applies.

2 Scope and principles of processing

We process personal data only where a lawful basis applies and only to the extent necessary for the purposes described below. We apply the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality under Article 5 GDPR.

3 Website hosting, CDN and technical delivery

The Website is a static website hosted and delivered through Cloudflare Pages. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, provides hosting, content-delivery-network (CDN), DNS/proxy, security and related technical infrastructure. To the extent Cloudflare processes personal data on our behalf, it acts as a processor under Article 28 GDPR and its applicable Data Processing Addendum.

When the Website is accessed, Cloudflare may process technical traffic and request data necessary to deliver and protect the Website. Depending on the service and request, this may include IP address, requested URL, date and time, traffic-routing data, system configuration information, browser/user-agent information, response or security information and related technical metadata.

The purposes are to deliver the Website, maintain availability and security, diagnose technical problems, prevent misuse and attacks and operate the service efficiently. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically efficient operation of the Website.

The Website itself does not maintain a separate proprietary server-log database. Cloudflare may process and retain technical metadata in accordance with the services used, the account configuration and Cloudflare's contractual and privacy documentation.

4 Analytics and tracking

The Website does not currently use Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Hotjar, Microsoft Clarity or another third-party advertising or behavioural analytics tool. We do not use the Website to create advertising profiles or to track visitors across unrelated websites.

If optional analytics, advertising or comparable tracking technologies are introduced later, this Policy and, where required, the consent mechanism will be updated before those technologies are activated.

5 Newsletter and book updates

5.1 Subscription data and Mailchimp

Human on Paper uses Mailchimp as its newsletter and email-marketing system. Mailchimp is a service of The Rocket Science Group LLC d/b/a Mailchimp, an Intuit company, USA. Newsletter signup forms on the Website are configured to transmit subscription information to Mailchimp, where subscriber records are stored and managed. Human on Paper does not intend to maintain a separate permanent newsletter-subscriber database in Slowcode Lead Generator.

When you subscribe, we process the information requested in the relevant signup form, which may include your first name, last name and email address. Mailchimp may also process subscription status, language or segmentation information, timestamps, IP address and other technical confirmation data needed to administer the subscription, secure the service and document consent.

The email address is required to deliver the newsletter. Name fields, where requested, are used to manage and, where appropriate, personalise communications. Please do not enter information about other people.

5.2 Purpose and legal basis

We use newsletter data to administer the requested subscription and send Human on Paper newsletters, book news, editorial resources and occasional offers. The legal basis is your consent under Article 6(1)(a) GDPR. Marketing emails are sent only after the applicable consent requirements under section 7 of the German Act Against Unfair Competition (UWG) have been met.

Providing newsletter data is voluntary. If you do not provide a valid email address and the required consent, we cannot activate the subscription.

5.3 Double opt-in

Human on Paper uses a double opt-in process for newsletter subscriptions. After submitting the signup form, you must confirm the subscription through the confirmation procedure before the address becomes active for marketing emails. This process is used to verify the subscription request and document consent. Depending on the Mailchimp form configuration, Mailchimp may use technical anti-abuse measures, including CAPTCHA/reCAPTCHA functionality, as part of the signup or confirmation process.

5.4 English and Spanish communications

Human on Paper uses one primary Mailchimp audience and organises subscribers according to language preference or signup source, for example English or Spanish. Language information may be implemented through tags, groups, segments, audience fields or equivalent Mailchimp functionality. This allows us to send the appropriate English- or Spanish-language communications without maintaining separate permanent subscriber databases. A subscriber may receive communications in more than one language where they have chosen or subscribed to both.

5.5 Newsletter delivery and campaign information

Mailchimp processes information necessary to deliver and operate email campaigns and may generate delivery, engagement and technical information associated with the service. Depending on the Mailchimp features and settings used, this may include delivery status and interactions such as opens or clicks. Such processing is used to operate, secure and evaluate newsletter communications. Where processing is based on consent, you may withdraw that consent as described below. Human on Paper will configure newsletter features in accordance with applicable data-protection and electronic-communications requirements.

5.6 Withdrawal and unsubscribe

You may withdraw your consent to newsletter marketing at any time with effect for the future by using the unsubscribe link included in each marketing email or by writing to natalia@humanonpaper.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After unsubscribing, your address will no longer be used for newsletter marketing unless you subsequently subscribe again.

5.7 Newsletter retention

Newsletter data is retained while the subscription is pending or active and for as long as necessary to administer the service. After withdrawal or unsubscribe, information may be retained where necessary to document consent and withdrawal, maintain a suppression or do-not-contact record, comply with legal obligations, prevent unwanted re-subscription, or establish, exercise or defend legal claims. Mailchimp processes and deletes customer data in accordance with its applicable contractual terms, Data Processing Addendum and retention rules.

6 Newsletter service provider and international processing

Mailchimp processes newsletter customer data on behalf of Human on Paper in accordance with its Data Processing Addendum. Mailchimp states that customer data may be transferred to and processed in the United States and in other locations where Mailchimp, its affiliates or subprocessors maintain processing operations.

For transfers of personal data protected by European data-protection law, Mailchimp's Data Processing Addendum provides for the EU-U.S. Data Privacy Framework where applicable and incorporates the European Commission's Standard Contractual Clauses where required. Mailchimp may engage subprocessors in accordance with its Data Processing Addendum.

7 Contact forms, email and Slowcode Lead Generator

If you contact Human on Paper through a Website contact form, the form may be technically operated through Lead Generator at leadgenerator.slowcode.io, provided by Slowcode. Slowcode processes personal data on behalf of Human on Paper for the operation, transmission, security and anti-abuse protection of the form and acts as a processor under Article 28 GDPR on the basis of an applicable data-processing agreement (AVV/DPA).

Depending on the contact form and the information you choose to provide, we may process your name, email address, message content and other information entered voluntarily. The form may also generate technical access or error data such as IP address, user-agent, URL, timestamp and response status. Contact submissions may be forwarded to natalia@humanonpaper.com so that we can respond.

The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or pre-contractual request, and Article 6(1)(f) GDPR for general enquiries. Our legitimate interest is responding to legitimate communications and maintaining secure and functional contact channels.

Slowcode technical logs and temporary form-processing data are retained for no longer than 30 days where such retention is required for operation, security, troubleshooting or anti-abuse purposes, unless earlier deletion occurs or a longer period is legally required in an individual case. Correspondence received by Human on Paper is retained only as long as necessary to handle the matter and any follow-up, subject to statutory retention duties or the need to establish, exercise or defend legal claims.

8 Cookies and similar technologies

The static Website itself does not currently set non-essential tracking cookies or use local storage for advertising or behavioural tracking. The English and Spanish versions are provided through separate Website routes rather than a stored tracking preference.

Third-party services integrated into the Website may use strictly necessary technical storage or comparable technologies where required to provide security, prevent abuse or perform a service requested by the user. In particular, Mailchimp signup/confirmation functionality and Slowcode contact-form functionality may involve technical security or anti-abuse mechanisms.

Where information is stored on or accessed from a visitor's device, the requirements of section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) will be assessed. Technologies requiring consent will not be intentionally activated before the legally required consent has been obtained.

9 Fonts, icons, images and media

The Website uses self-hosted typography including Playfair Display, Inter and Caveat. It also currently loads Google Material Symbols through a Google-hosted resource (including fonts.googleapis.com) for certain interface or credibility icons. When this resource is requested, the visitor's browser establishes a connection to Google and technical data, including the IP address and request information, may be transmitted to Google.

The purpose is the technically consistent display of icons and interface elements. The legal basis relied upon for this integration is Article 6(1)(f) GDPR, based on our legitimate interest in a consistent and functional presentation of the Website. If the implementation changes so that these resources are self-hosted or another legal basis or consent mechanism becomes necessary, this section will be updated accordingly.

Website images and other media are otherwise delivered through the Website/Cloudflare environment unless a specific external service is identified. The Website currently contains no embedded YouTube or Vimeo player.

10 External links and sales platforms

The Website may contain ordinary links to external services, including Amazon and social-media or other sales/content platforms. No payment-card or banking data is collected through the Human on Paper Website. A third party generally receives data only after you choose to follow its link or use its service. The external provider then processes data under its own privacy notice and terms.

The Website currently contains no embedded payment service, third-party map, Meta Pixel or cross-site advertising tracker.

11 International transfers

Some service providers used by Human on Paper are established in, or may process personal data in, countries outside the European Economic Area, particularly the United States. This applies in particular to Cloudflare and Mailchimp.

Where Chapter V GDPR applies, transfers are made on the basis of an applicable adequacy decision, including the EU-U.S. Data Privacy Framework for participating organisations where applicable, or other appropriate safeguards such as the European Commission's Standard Contractual Clauses and any supplementary measures required by law. Cloudflare and Mailchimp provide contractual data-protection terms addressing international transfers.

12 General retention criteria

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of statutory retention requirements, security needs, contractual obligations and limitation periods. Data that is no longer required is deleted or anonymised unless further retention is legally permitted or required. Specific retention information for newsletter and Slowcode technical processing is provided above.

13 Your rights

Subject to the conditions and limitations of the GDPR, you may have the following rights:

• access to your personal data under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR, where applicable;
• objection to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR;
• withdrawal of consent at any time with effect for the future under Article 7(3) GDPR; and
• the right to lodge a complaint with a supervisory authority under Article 77 GDPR.

To exercise your rights, contact natalia@humanonpaper.com. We may request information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

14 Right to object

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required to establish, exercise or defend legal claims.

You may object to processing for direct marketing at any time. Personal data will then no longer be processed for that purpose.

15 Supervisory authority

You may lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for the controller's establishment in Frankfurt am Main is:

16 Security

We use appropriate technical and organisational measures proportionate to the risks of processing to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access. Service providers acting as processors are required to provide appropriate safeguards in accordance with the applicable contractual and legal requirements. No Internet transmission or storage system can be guaranteed to be completely secure.

17 Automated decision-making and profiling

The Website does not use personal data for automated decision-making that produces legal effects or similarly significantly affects a person within the meaning of Article 22 GDPR. Human on Paper does not use the Website for behavioural advertising profiling.

18 Children

The Website and newsletter are not designed to intentionally collect children's personal data for behavioural advertising or profiling. If we become aware that personal data has been collected in circumstances requiring parental authorisation or another specific legal basis, we will take appropriate action under applicable law.

19 Changes to this Privacy Policy

We may update this Policy when the Website, service providers, legal requirements or our processing activities change. The current version and effective date will be published on the Website. Material changes will be communicated where required by law.