Privacy Policy

Privacy Policy

Last updated: 30 September 2026.

This is the whole policy. Before writing it we looked at what the site actually sends and receives, so what follows describes real behaviour rather than a template downloaded from somewhere.

The short version

  • No advertising, no tracking pixels, no third-party analytics. The only counting here is a page counter on our own server that stores no personal data; it is described below.
  • We do not sell or rent your personal data, and we do not share it for advertising. Limited technical data, such as your IP address, reaches the outside services named below.
  • The only personal data we hold is what you hand over yourself: a newsletter address, a comment, a submitted case or document, or a message.
  • Three things can still load from other companies’ servers: a spam check on forms, a web font and the small pictures next to comments. Each of them sees your IP address. If you subscribe to the newsletter, your address also goes to the service that delivers it, named below.
  • You can ask what we hold about you and ask us to delete it. One email is enough.

Who is responsible for this site

Brussels Record is published and edited by Pavel Kadlec. For anything in this policy, write to info@brusselsrecord.com. The site runs on a server in the Czech Republic. Under the GDPR the editor is the data controller.

What we collect, and why

Nothing here collects data quietly in the background. Every item below happens only because you filled something in.

  • Newsletter. Your email address, a name if you choose to give one, and the time and IP address of your sign-up and of your confirmation, which is how we can show that you asked for it. The list lives in our own database. The emails are delivered by the MailPoet Sending Service, which receives your address in order to deliver them; what it keeps is described on MailPoet’s page Data collected and stored by MailPoet. We do not track whether you open an email or click a link in it. Every issue contains an unsubscribe link, and unsubscribing stops all email at once.
  • Comments. WordPress stores the name and email you type, the comment itself, your IP address and your browser identification string. Your email address is never published.
  • Submissions. If you send us a case, a story or a document, we keep the name, email, text and any files you attach, so that we can reply to you and check the material.
  • Contact messages. Whatever you write in the form, so that we can answer it.
  • Accounts. Readers cannot register on this site. The only accounts are the editor’s and the author accounts used to credit republished work.
  • Server logs. The hosting keeps ordinary web-server logs: IP address, time, the page requested and the browser string. They exist to keep the server running and to stop abuse, and they are kept only briefly.
  • Signal messages. If you write to us on Signal, the message is end-to-end encrypted and Signal itself cannot read it. We see only what you choose to send: the username or number you have not hidden, the text, and any files. We keep the thread until the story is finished or turned down, and then delete it.

The legal grounds are consent for the newsletter, carrying out what you asked for in the case of submissions, messages and accounts, and legitimate interest for security logs and spam protection.

Analytics: a counter, not a tracker

In July 2026 we removed the last third-party analytics script from the site and closed the account behind it. Since August 2026 visits are counted by Koko Analytics, a plugin that runs on our own server and sends nothing to anyone else. It keeps daily totals: how many people opened which page, and which site they came from. To tell a returning visit from a new one on the same day it uses a one-way hash of your IP address, your browser string and a secret that changes every day; the hash is wiped at midnight and is never stored with the counts. It sets no cookie, does not locate you, does not record your device, and visits by the editor are excluded. That is the whole of it. This paragraph replaces an earlier statement that the site had no analytics at all. That was true until the counter went on in August; the change should have been written here at the time, and it was not.

What loads from other companies

Three requests still leave our server. Naming them is worth more than a clean-sounding claim.

  • Cloudflare Turnstile checks that a form is being filled in by a person. Cloudflare sees your IP address and limited technical information about your browser. It replaces the older kind of puzzle that had you labelling photographs for somebody else’s machine-learning model.
  • Google Fonts are still delivered from Google’s servers, which means Google sees your IP address when a page loads. We intend to host the fonts ourselves; until we do, this is the one avoidable leak on the site, and we would rather write it down than hide it.
  • Gravatar, run by Automattic, supplies the small pictures next to comments. If a commenter has a Gravatar account, a scrambled form of their email address is sent there to fetch the image.

What is not here: no Google Analytics, no Meta or TikTok pixel, no advertising network, no data-broker code, no session recording, no heat maps, no A/B testing service. Signal is a contact channel, not a component: nothing from it is loaded on this website, so reading this page tells us nothing about whether you use it.

How long we keep things

  • Newsletter addresses: while you are subscribed. After you unsubscribe, the address stays on the list marked as unsubscribed, so that nothing is sent to it again; ask us and we delete it entirely.
  • Comments: as long as the comment is published, unless you ask us to remove it.
  • Submissions and messages: while they are still relevant, then deleted.
  • Server logs: a short rolling window kept by the hosting provider.

Your rights

If you are in the European Union, the GDPR gives you the right to ask what we hold about you, to receive a copy, to correct it, to have it deleted, to restrict or object to its use, to take it elsewhere, and to withdraw consent at any time. Write to info@brusselsrecord.com and we will answer within thirty days. You can also complain to the Czech data-protection authority, the Úřad pro ochranu osobních údajů.

In practice a deletion request is short work. For most readers the only thing we hold is one line in a mailing list.

Children

This site is not aimed at children and we do not knowingly collect data from anyone under sixteen.

Security

The whole site runs over HTTPS. Administrative access is limited to the editor. Backups are kept so that content can be restored, which also means a deleted comment may sit inside a backup file for a while before it ages out.

Changes to this policy

The date at the top changes when the text changes. If we ever start doing something materially different, such as advertising or paid content, it will be written here first and mentioned in the newsletter, rather than slipped in quietly. The counter described above is the one case so far where this policy was updated after the fact rather than before, on 6 September 2026. On 28 September 2026 the short version was brought into line with the details below: it named two outside services instead of three, and it said we never share personal data, although the services named below do receive your IP address. On 30 September 2026 the newsletter section was corrected: since 3 September 2026 the emails have been delivered by the MailPoet Sending Service, not sent from our own server as this policy said, and the sign-up record also keeps the time and IP address of your sign-up and your confirmation.

What this policy does not cover

It covers this site only. We link outwards constantly, and the moment you follow a link you are under somebody else’s rules, which are usually less pleasant than ours. Our guide on reading a privacy policy in ten minutes exists partly for that reason.