This Privacy Policy explains how Boringly Effective (the operator of the Boringly Effective podcast and website at boringlyeffective.com) collects, uses, and protects your personal data when you visit our website, subscribe to our newsletter, or contact us.
We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable Romanian data protection law.
1. Who we are
The "data controller" responsible for your personal data is:
- Boringly Effective — operator of the Boringly Effective podcast
- Address: 145 Calea Plevnei, Bucharest, Romania
- Contact email: [email protected]
- Represented by: Andrei Tarnovski
If you have any questions about this Privacy Policy or how we handle your data, please contact us at the email above.
2. What data we collect and why
We only collect the personal data we need to operate the website, deliver the newsletter, and respond to your enquiries. We do not collect more data than is necessary.
2.1 Newsletter subscriptions
When you subscribe to the Boringly Effective newsletter using the subscription form on our website:
- Data collected: your email address (and your name, if you provide it).
- Purpose: to send you our newsletter — new episodes, articles, and marketing insights — by email.
- Legal basis: your consent (Article 6(1)(a) GDPR). You give consent by ticking the newsletter consent checkbox, submitting your email, and confirming your subscription via the magic link sent to your inbox.
- Recipients: your data is stored in our membership system (Ghost) and processed by our email service provider (Brevo) and our email marketing provider (Kit, formerly ConvertKit) for the purpose of sending emails.
You can withdraw your consent and unsubscribe at any time by clicking the "unsubscribe" link in any newsletter email. Withdrawal does not affect the lawfulness of processing before the withdrawal.
2.2 Contact forms
When you submit one of our contact forms (Boringly Effective consultancy enquiries, podcast enquiries, or general enquiries):
- Data collected: your name, email address, and the details you choose to provide in the form (such as company, budget range, guest or topic suggestions, enquiry type, subject, and your message).
- Purpose: to read, respond to, and act on your enquiry.
- Legal basis: our legitimate interest in responding to your request and corresponding with you (Article 6(1)(f) GDPR), and where your enquiry relates to a potential business relationship, taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
- Recipients: your enquiry is emailed to our team and stored in our contact-management system (Brevo) so we can manage and respond to it.
Each contact form includes an optional, unticked checkbox where you can also consent to receive our newsletter and marketing emails. Checking that box is completely optional and not required to submit your enquiry. If you tick it, we record your consent and add you to a separate marketing list so we can send you newsletter and marketing emails. You can withdraw that consent and unsubscribe at any time. If you leave it unticked, we will use your details only to respond to your enquiry.
2.3 Website analytics
We use three analytics tools to understand how the website is used: Umami (self-hosted, cookieless aggregate counting), PostHog (EU-hosted, reached through our reverse-proxy domain e.boringlyeffective.com), and Google Analytics 4 (GA4) (provided by Google):
- Data collected: aggregated usage statistics (pages viewed, approximate region, referring website). PostHog and — only for visitors who consent — Google Analytics also use small pseudonymous first-party cookies (__posthog; _ga and _ga_19Y1FMVJ0N) to distinguish returning visitors. GA4 additionally processes a truncated (anonymised) IP address, used only to derive approximate location, and device/browser information for aggregate reports. We do not collect your name or email through analytics unless you voluntarily identify yourself to us, which we do not do on this website.
- When: cookieless aggregate analytics (Umami, and PostHog in cookieless mode) always run. PostHog's cookie and Google Analytics are disabled by default: they only load after you click “Accept analytics” in our consent banner, which stores the cookies above. If you click “Reject”, we set no analytics cookies (and delete any that were set) and Google Analytics does not load at all. You can change your choice at any time via the “Cookie settings” link in our website footer.
- Legal basis: your consent (Article 6(1)(a) GDPR) for the PostHog and Google Analytics cookies and the processing that follows them; and our legitimate interest (Article 6(1)(f) GDPR) in the always-on cookieless aggregate counts, which set no cookies and store no identifier on your device. Where we rely on consent you may withdraw it at any time.
- Recipients: analytics data stays on our own servers (Umami), goes to PostHog (EU), or goes to Google Ireland Limited for GA4 — see sections 4 and 5.
2.4 Technical data from hosting
When you visit the website, our hosting provider and content delivery network (Cloudflare) automatically process limited technical data (such as server logs and IP addresses) for the purposes of security, fraud and spam prevention, and delivering the website to your browser.
- Legal basis: our legitimate interests in providing a secure and functioning website and our legal obligations regarding security (Article 6(1)(f) and (c) GDPR).
2.5 Data we do not collect
- We do not process special categories of sensitive personal data (Article 9 GDPR) such as health, religion, or ethnicity.
- We do not run third-party advertising or tracking networks, and we do not sell your data to anyone. Analytics are only enabled with your consent, as described in section 2.3.
- The website is not directed at children, and we do not knowingly collect data from anyone under 16.
3. Legal bases for processing
We rely on the following legal bases under Article 6 GDPR:
| Activity | Data | Legal basis |
|---|---|---|
| Newsletter emails | Email address, name | Consent (Art. 6(1)(a)) |
| Contact form enquiries | Name, email, message, etc. | Legitimate interest / pre-contractual (Art. 6(1)(f), (b)) |
| Marketing emails from contact opt-in | Email address, name | Consent (Art. 6(1)(a)) |
| Website analytics (cookies) | Pseudonymous cookie data from PostHog and Google Analytics (only with consent) | Consent (Art. 6(1)(a)) |
| Cookieless aggregate analytics | Anonymous page-view counts (no cookies, no identifiers) | Legitimate interest (Art. 6(1)(f)) |
| Website security & delivery | Technical data, IP address | Legitimate interest / legal obligation (Art. 6(1)(f), (c)) |
4. Who we share your data with (processors & recipients)
We do not sell your personal data. We share it only with trusted service providers ("processors") who help us operate the website and send emails, under written agreements that require GDPR compliance:
| Provider | Service | Location |
|---|---|---|
| Brevo | Email marketing & newsletter delivery | EU (France / Germany) |
| Kit (ConvertKit) | Newsletter subscribers & email delivery | USA (see section 5) |
| Ghost (self-hosted) | Content management & membership | EU (Germany — Hetzner) |
| Cloudflare | Content delivery, security & DDoS protection | EU (data residency in the EU) |
| PostHog | Website analytics (consent-based, EU-hosted, reverse-proxied) | EU |
| Google Ireland Limited | Google Analytics 4 website analytics (consent-based) | EU / USA (see section 5) |
| Mave.digital | Podcast audio hosting | Processes media; no subscriber data |
We may also disclose your data where required by law, court order, or competent public authority.
5. International data transfers
Our primary service providers process data within the European Union. Where data is transferred outside the EU/EEA — in particular, subscriber data shared with Kit (ConvertKit), a provider based in the United States — we rely on appropriate safeguards under Article 46 GDPR. Kit is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and we also rely on the EU Standard Contractual Clauses (Module 2: controller-to-processor), together with the UK International Data Transfer Addendum where applicable, as incorporated into our data processing agreement with Kit.
Google Analytics: when you accept analytics, limited usage data (including a truncated IP address, used only to derive approximate location) is transferred to Google Ireland Limited and may be processed by Google LLC in the United States. We rely on Google's certification under the EU-U.S. Data Privacy Framework and, where applicable, the EU Standard Contractual Clauses, together with the Google Ads Data Processing Terms accepted for this account. IP anonymisation is enabled, and Google retains GA4 event-level data for a maximum of two months (property setting).
6. How long we keep your data
- Newsletter subscribers & marketing opt-ins: we keep your data for as long as you remain subscribed. When you unsubscribe, we remove you from the active mailing list. We may retain minimal records of your subscription and consent for our legitimate business records and to honour your choices.
- Contact form enquiries: we retain enquiry data for as long as necessary to respond to your request and for a reasonable period afterwards (typically up to 36 months) for business record-keeping, unless you ask us to delete it sooner.
- Analytics: aggregate statistics are kept only as long as needed for reporting. Google Analytics event-level data is retained for 2 months (property setting); analytics cookies expire after up to 2 years, or earlier when you withdraw consent, in which case they are deleted. No more personal data is retained than is described in section 2.3.
- Server logs: retained for a short period for security and troubleshooting.
7. Your data protection rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Article 15) — to be told what data we hold about you.
- Right to rectification (Article 16) — to have inaccurate data corrected.
- Right to erasure (Article 17) — the "right to be forgotten."
- Right to restriction (Article 18) — to limit how we use your data.
- Right to data portability (Article 20) — to receive your data in a structured format.
- Right to object (Article 21) — to object to processing based on legitimate interests.
- Right to withdraw consent — at any time, including your analytics consent.
- Right to lodge a complaint (Article 77) — with a data protection supervisory authority. For Romania this is ANSPDCP (www.dataprotection.ro); you may also lodge the complaint in the EU member state where you live or work.
To exercise any of these rights, email [email protected]. We will respond within one month, as required by law.
8. Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, and reputable EU-based hosting. However, no method of transmission over the internet is 100% secure.
9. Cookies
We use only strictly necessary cookies by default. Analytics cookies are set only after you give consent through our consent banner. For full details, please read our Cookie Policy.
10. Links to third-party websites
Our website contains links to third-party platforms such as YouTube, Apple Podcasts, Spotify, and other podcast services. Some pages also embed video players directly from YouTube. When you interact with an embedded player, YouTube may set its own cookies, subject to its own privacy and cookie policies. We are not responsible for the privacy practices of these platforms. If you click a link to a third-party service, you are subject to that service's own privacy policy.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will change the "Last updated" date above and, where changes are significant, notify you (for example, via the newsletter). We encourage you to review this page periodically.
12. Contact us
If you have any questions about this Privacy Policy or your personal data, please contact us:
- Email: [email protected]
- Address: Boringly Effective, 145 Calea Plevnei, Bucharest, Romania