Legal
Privacy notice
Draft template — final text pending counsel review
This is a working draft, published early rather than held back: the rest of the site makes commitments about how Pressmerit handles data, and they should be checkable somewhere. The structure and the substance below describe how the platform actually operates. The wording is not final, and everything marked in brackets is settled with counsel before launch.
If you are here because an email arrived and you want the short version, the disclosure written for you — and the form that removes your address — is at pressmerit.com/why-this-email.
Who is responsible
Pressmerit is operated by [PLACEHOLDER — legal entity name and registration details], reachable at privacy@pressmerit.com and at the postal address published on the about page ([PLACEHOLDER — postal address, required before launch]).
[PLACEHOLDER — data protection contact, and an Article 27 representative if one is required, to be confirmed with counsel]
Data we process
Three categories, kept separate from one another.
- Account data for Pressmerit users: a name, a work email address, the sites added to the account, and billing identifiers held by the payment provider ([PLACEHOLDER — provider to be named]).
- Business-contact data for publishers and site owners: a work email address, the website it belongs to and, where the source published them, a name and a role. Collected either from a public page on the site itself or from a licensed data partner.
- Operational records: which contact was revealed to which user, which requests were sent, and the results of the link verification checks that follow.
- [PLACEHOLDER — server logs, IP address retention and security telemetry, to be described with counsel]
Legal basis
For business-contact data the basis is legitimate interest: contacting a site in a business capacity, about work it has already published, regarding a collaboration on that same site. That basis carries an obligation to weigh our interest against yours, and a legitimate interests assessment (LIA) is the document that records the weighing.
The outcome of the LIA is visible in the product rather than only on paper — business-to-business scope, no consumer data, no profile built about a recipient, and an objection route that needs no account. You can object at any time, and the form at pressmerit.com/why-this-email is that objection, handled directly. [PLACEHOLDER — LIA summary, publication and review cadence, to be agreed with counsel]
Account data is processed to perform the contract with the account holder. Where marketing to account holders requires consent, it is asked for separately and can be withdrawn.
Disclosure of contact data to platform users
Revealing a verified work contact to a Pressmerit user is a processing purpose in its own right, not a side effect of something else, and it is named separately here because it is the part a publisher most needs to see stated plainly.
A contact is disclosed to the single user who requested it for a specific site of their own. It is not published, not sold, not shared with other users, and not assembled into a directory that anyone can browse.
[PLACEHOLDER — the disclosure clause in final form, including the obligations a user takes on as the sender of the resulting message, to be settled with counsel]
The do-not-contact list
Any address can be suppressed across the whole platform, with no account and no reason given, at pressmerit.com/why-this-email. A suppressed address is dropped from results, cannot be revealed to any user, and is not written to again by anyone using Pressmerit.
Suppression keeps a minimal record of the address for one purpose: recognising it if it appears in a data set we license later. Erasure — deleting the record outright — is a separate request, goes to privacy@pressmerit.com, and is honoured as a GDPR erasure request.
Retention
Each category above has its own defined retention period, and none of them is open-ended.
[PLACEHOLDER — retention period per category, plus the deletion process at the end of it, to be set with counsel]
Suppression entries are the deliberate exception: they are kept for as long as they are needed to keep an address out of the platform, because deleting one would defeat the purpose it exists for.
Subprocessors
Published as a table so it can be checked rather than requested. The rows below are stubs until the final text lands.
| Subprocessor | Purpose | Location |
|---|---|---|
| [PLACEHOLDER] | [PLACEHOLDER — hosting and delivery] | [PLACEHOLDER] |
| [PLACEHOLDER] | [PLACEHOLDER — transactional email] | [PLACEHOLDER] |
| [PLACEHOLDER] | [PLACEHOLDER — payments] | [PLACEHOLDER] |
| [PLACEHOLDER] | [PLACEHOLDER — licensed business-contact data] | [PLACEHOLDER] |
Your rights
Access, rectification, erasure, restriction, portability, and objection — including the objection that the opt-out form implements directly, without an email exchange to get to it.
Requests go to privacy@pressmerit.com. [PLACEHOLDER — response window, the identity checks that go with a request, and the supervisory authority a complaint can be taken to, to be set with counsel]