Buyout Diary – Privacy Policy

Your privacy is taken seriously.
This Privacy Policy explains what personal data is collected, how it’s used, and how your rights are protected under the EU General Data Protection Regulation (GDPR).

1. Who Operates This Publication

Buyout Diary is published by Alexander Kelm, based in Amsterdam, the Netherlands.
Email: alex@buyoutdiary.com

The platform used is Substack, Inc., headquartered in San Francisco, USA.
Substack acts as the data processor, while Alexander Kelm is the data controller for EU data protection purposes.

2. What Data Is Collected

When you subscribe or interact with Buyout Diary, the following data may be collected:

• Email address and name (if provided)

• Subscription type and payment details (processed directly by Stripe via Substack)

• Engagement data, such as opens, clicks, or comment activity

• Technical data such as browser type, IP address (anonymised), or device type, to improve the user experience

No additional trackers, cookies, or third-party advertising tools are added manually by the author.

3. How Your Data Is Used

Data is used for legitimate and transparent purposes, including:

• Sending newsletters and member content

• Processing subscriptions and payments

• Managing access to posts and comments

• Analysing engagement to improve content

• Responding to emails or questions

• Complying with legal obligations

Your personal data will never be sold, rented, or shared for marketing or advertising purposes.

4. Legal Basis for Processing (GDPR)

Data is processed under the following legal bases:

• Consent – You actively subscribe or opt in.

• Contractual necessity – To deliver paid subscription services.

• Legitimate interest – To analyse general engagement and improve content.

You can withdraw consent at any time by clicking “unsubscribe” in any email or by contacting alex@buyoutdiary.com.

5. Data Sharing and Storage

Substack securely stores and processes subscriber data in accordance with its own Privacy Policy and Terms of Use, available at https://substack.com.

Payment information is handled exclusively by Stripe, which complies with PCI DSS and GDPR requirements.

Data may be transferred outside the EU to the United States, where Substack and Stripe are located, under appropriate safeguards (e.g., Standard Contractual Clauses).

6. Data Retention

Subscriber data is retained for as long as your subscription remains active.
Once you unsubscribe, your personal data will be deleted or anonymised after a reasonable period, unless required for legal or accounting purposes.

7. Your Rights

Under GDPR, you have the right to:

• Access your personal data

• Request correction of inaccurate data

• Request deletion (“right to be forgotten”)

• Restrict or object to processing

• Request data portability

You can exercise these rights at any time by contacting alex@buyoutdiary.com.

If you believe your data has been misused, you have the right to lodge a complaint with your local data protection authority (Autoriteit Persoonsgegevens in the Netherlands).

8. Cookies and Analytics

Substack may use basic cookies to remember preferences (e.g., logged-in sessions) and track aggregated metrics such as open rates.
Buyout Diary does not use any external tracking cookies, pixels, or ads.

9. Changes to This Policy

This Privacy Policy may be updated periodically to reflect regulatory or operational changes.
All updates will be dated clearly at the top of the page.

10. Contact

If you have any questions about privacy, data handling, or your subscription, please contact:
📩 alex@buyoutdiary.com
📍 Amsterdam, The Netherlands