Privacy notice

1. Who is responsible

The controller for personal data processed on this website is:

For any privacy question or request, write to privacy@gobasco.com.

2. Which law applies

Because the operator is established in Estonia, our processing is governed by the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act. Most of our readers live in Singapore. We handle the personal data of Singapore readers in a manner consistent with Singapore’s Personal Data Protection Act 2012 (PDPA): we collect only what we need for a stated purpose, with consent where required, protect it, and let you access and correct it.

3. What we do not collect

This site never asks for your NRIC or FIN number, Singpass details, bank account or card numbers, passwords or one-time passwords, and it processes no applications for any government scheme. If anyone asks you for such details claiming to act for Gobasco, it is not us.

4. Visiting the website

When you open a page, our web server automatically processes technical data your browser sends: IP address, date and time, the page requested, the referring page, and browser and operating-system information. We use it to deliver the site, keep it secure and find errors. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR). Server logs are kept for a short period, normally no more than 14 days, unless needed to investigate a security incident. Our hosting provider processes this data on our behalf under a data processing agreement.

Fonts and images are served from our own server. We do not load fonts, maps, videos or social-media widgets from third parties.

5. The newsletter

If you sign up for the Wednesday Brief, we process your email address and the record of your consent (date, time and the consent text) in order to send the newsletter. We use double opt-in: we first send a confirmation email, and you are subscribed only after clicking the link in it. If the page you arrived on carried campaign parameters (for example click_id or utm_source), these are held in your browser for the visit and submitted with the sign-up so we can see which advertisement led to it.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through the unsubscribe link in every email or by writing to privacy@gobasco.com. We keep your address until you unsubscribe, and unconfirmed sign-ups are deleted. If we use an email service provider to send the newsletter, it acts on our behalf under a data processing agreement.

6. Cookies, browser storage and measurement

The site stores your cookie choice in your browser’s local storage so the banner does not reappear on every page, and keeps campaign parameters and the email you entered in session storage for the current visit only. These are needed for the site to work as you asked.

At present no advertising pixel, analytics or other measurement tag is active on this website. The site has a consent mechanism so that, if a measurement tag of an advertising network (such as Taboola or Outbrain) is configured in future, it loads only on content pages and only after you choose “Accept” in the cookie banner; choosing “Essential only” keeps it off. If that happens, this notice and the cookie notice will be updated first to name the provider and the data involved. You can change your choice at any time on the cookie notice page.

7. Emails you send us

If you write to us, we use your message and address to reply, on the basis of our legitimate interest in answering enquiries, and delete the correspondence when it is no longer needed, normally within two years, unless the law requires us to keep it longer.

8. Transfers outside the EU

We aim to use service providers in the European Union or European Economic Area. Where data is transferred to a country without an EU adequacy decision, we use the safeguards required by the GDPR, such as the European Commission’s standard contractual clauses.

9. Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Under the PDPA, Singapore readers may ask to access and correct their personal data and to withdraw consent. Write to privacy@gobasco.com; we answer within one month.

10. Complaints

You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, which is our lead supervisory authority, or to the authority in the EU country where you live. Readers in Singapore may also contact the Personal Data Protection Commission (PDPC), pdpc.gov.sg. We would appreciate the chance to resolve any concern directly first.

11. Changes

We update this notice when the website or the law changes. The date at the top shows the current version.