Three groups of people are affected, and they are affected differently.

The controller is Entro314 Labs SINGLE MEMBER P.C. (Entro314 Labs), a single-member private company (Ι.Κ.Ε.) registered in Greece, seat Cheimarras 3, 13561 Agioi Anargyroi, Attica, Greece, Γ.Ε.ΜΗ. 193782603000. Full registration details are in the legal notice.

Because the controller is established in Greece, the lead supervisory authority is the Hellenic Data Protection Authority, and a complaint may also be made to the authority where you live. No data protection officer is appointed; the Article 37 appointment criteria are among the assessments still outstanding.

Privacy requests go to hello@pressdb.co or, for a record in the corpus, the take-down form.

Professional contact data: name, outlet, role or beat, a work address where one was published or derived from an outlet pattern, and public profile links used as corroboration. It is obtained from public directories, Wikidata, mastheads, impressum pages, bylines and crawls of outlets’ own editorial pages — not from the people concerned, which is why Article 14 applies and why this notice exists at that URL rather than behind a login.

The basis relied on is legitimate interests in maintaining a professional media-contact directory, balanced against the interests of people whose job is to be contactable by people with news. The balancing test is not yet written down, which is one reason this document is a draft. The page for journalists states the same facts from the other side.

The service providers listed on the subprocessors page — hosting, authentication, database, mail delivery, address verification and the model gateway. No personal data is sold, and there is no advertising or cross-context behavioural tracking anywhere in the product.

A workspace that sends a campaign necessarily learns which of its recipients opened, clicked, bounced or unsubscribed. That is the point of the feature, and it is disclosed rather than buried.

Access, correction, erasure, restriction, portability, and objection to processing based on legitimate interests — which, for a media-contact record, is an objection that will simply be honoured. You may withdraw consent where consent is the basis, and complain to a supervisory authority.

For a record in the corpus, the take-down form is the fastest route. Everything else goes to hello@pressdb.co. The written identity-verification procedure — how a requester is confirmed to be who they say they are before data is disclosed or erased — is still to be produced, and is one of the records this notice remains a draft for.

Register views and saved lists export as CSV, as does a campaign’s recipient log with its per-address outcomes; release copy is already a document you hold. No switching, egress or exit charge is made or contemplated. Authentication records — account identity, sessions — are held by Clerk and may have to be requested there.

To delete rather than export, delete the authentication account through the account controls and write to hello@pressdb.co for workspace data. One exception survives deletion: suppression entries. The record that somebody asked not to be contacted is the only thing that stops them being contacted again, so it is retained rather than erased.

Whether Press Hub is a data processing service covered by the EU Data Act’s switching regime has not been established, so no claim is made that the full set of switching obligations is complete.

There is no advertising network, no cross-context behavioural tracking and no Global Privacy Control handler anywhere in the code. Whether signed-in access to a professional contact corpus falls within a US state-law definition of sale or sharing depends on facts and thresholds that have not been established; neither an exemption nor a completed opt-out process is claimed here.

There is no published retention schedule yet, and inventing periods here would be worse than admitting that. Two things are already true and permanent: a take-down honoured against a publication sets a flag that keeps it unpublished for good, and a suppression entry is deliberately retained rather than deleted — the record that somebody asked not to be contacted is the only thing that stops them being contacted again.