Privacy policy

Principle

Veräin Media collects the minimum data needed for each flow, never asks for information without a concrete use, and never sells anything to third parties.

Data collected

The data depends on the subscription flow you follow:

• Standard newsletter (form in the header, footer or popup) — email address required, first name optional.
• Interactive diagnostic (/en/diagnostic-asbl) — in addition to email and first name: name of your non-profit, your function in the organisation, and your answers to the categorisation quiz (3 size questions + 1 question on public utility status). This data is used to generate your personalised Checklist and to tailor the welcome series emails.
• Direct lead magnet (legacy flow, now in the minority) — email and first name only.

In all cases we also record: the subscription language, the form source (popup, hero, inline) and, where applicable, the diagnosed category. All this data lives in our Resend audience, nowhere else.

Legal basis: explicit consent given upon form submission. Revocable at any time via the "Unsubscribe in one click" link at the bottom of every email we send.

Cookies and local storage

No advertising cookies, no profiling cookies, no third-party tracking tools such as Google Analytics or Meta Pixel.

We only use:

• Vercel Web Analytics — aggregated, cookieless measurement of traffic (page views, traffic sources, device type). No personal data, no cookies, GDPR-compliant. Hosted in a European region.
• Browser localStorage — only to remember that you have closed the newsletter popup or are already subscribed. No identifiers, no data sent to a third-party server.

Retention

• Email address and associated data (first name, non-profit name, function, category) — retained as long as you are subscribed. Upon unsubscription (via the link in every email), effective deletion within 30 days on Resend's side.
• Personalised PDF download links — HMAC-SHA256 signed and valid for 30 days, after which they become inactive.

Your rights

Under the GDPR you have the following rights at any time:

• Access to your data
• Rectification of inaccurate data
• Erasure
• Portability (export)
• Objection to a processing activity
• Withdrawal of consent — in one click via the link at the bottom of every email

To exercise a right other than unsubscribing, write to contact@veraein.lu. Response within 30 days maximum. You also have the right to lodge a complaint with the Luxembourg Data Protection Authority (CNPD).

Processors

• Vercel (USA, EU infrastructure) — website hosting and Web Analytics, servers in Frankfurt (FRA1)
• Resend (USA, EU infrastructure) — email sending, audience management, European hosting
• OVH (France) — registrar for the veraein.lu domain and DNS