Privacy Policy

This policy describes how personal data of users visiting hubfinanza.com is processed, pursuant to Regulation (EU) 2016/679 (“GDPR”).

Data controller

The data controller is Hub Finanza. To exercise your rights, contact admin@hubfinanza.com.

Data we process

• Registration data: name and email, if you create an account.
• Navigation data: browser type and IP address. Your IP address is what your device sends to our server in order to receive the pages: it is technical data required by the connection, never requested from you or obtained from third parties. We never store it in the clear: it is immediately turned into a non-reversible code (pseudonymisation under Art. 4(5) GDPR) and only that code is stored, to record consent and to block abuse.
• Cookie preferences: the choices made via the consent banner.
• Reading statistics: page visited, device type and referring site, tied to an anonymous fingerprint that changes every day and cannot follow a person over time. No cookies, no permanent identifier.
• Topics you choose: if you are registered, the topics you pick on the “Interests and personalisation” page, plus the articles you save and the topics you follow.
• Reading history — only if you turn on personalised suggestions: which article you opened, its section, how many seconds you read it, whether you reached the end, and the date. Not the text you read, not your location, not your device.

Purposes and legal bases

• Service delivery and account management — performance of a contract (Art. 6(1)(b) GDPR).
• Chosen topics, saved articles and followed topics — performance of a contract (Art. 6(1)(b)): these are the features you asked for by signing up. We do not ask for consent here, because this is the service itself.
• Personalised suggestions based on your reading history — consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). It is optional, it stays off until you turn it on, and you can withdraw it at any time.
• Security, abuse prevention and consent record-keeping — legitimate interest and legal obligation (Art. 6(1)(f) and Art. 7(1) GDPR).
• Newsletter and communications — consent, revocable at any time.
• Site reading statistics — these do not rest on consent because they are not personal data: the visitor fingerprint changes every night, so there is no continuity from one day to the next and no way to reconstruct an individual's path. No cookie and no permanent identifier are used to collect them.
• Google Analytics — consent to analytics cookies. The tool is loaded only after you accept it in the banner: if you decline, no Google script runs and no data reaches it.

Personalised suggestions: how they work

If you turn this on, we count the topics of the articles you open and how long you read them, and derive an interest score for each topic. More recent reading counts for more: an interest from two months ago is worth half of one from today. We use that score, together with the topics you picked by hand, only to order suggestions within the site.

The profile does not decide what you can see: the whole archive stays reachable through sections, search and most-read. We take no automated decision producing legal effects or similarly significantly affecting you (Art. 22 GDPR).

It is optional. If you never turn it on — or turn it off — the site works exactly the same: you will see the most recent articles, the most read and the ones chosen by the newsroom. Turning it off deletes the reading history already collected and resets the part of the profile derived from it; the topics you picked by hand remain until you remove them.

Who processes data on our behalf

We rely on providers acting as processors (Art. 28 GDPR):

• Hetzner Online GmbH (Germany) — infrastructure hosting the site and the database. European Union.
• Brevo (France) — sending service emails and the newsletter; receives your address. European Union.
• Zoho Corporation B.V. (Utrecht, the Netherlands) — the domain's mailboxes: if you write to us, your message passes through here. Our account is configured on the European data centre.
• Google Ireland Ltd / Google LLC — Google Analytics, only with your consent. Receives your IP address (in truncated form), the page visited and technical browser data.

Third-party services and transfers outside the European Union

Some services are based, or run infrastructure, outside the European Economic Area. We say so here, because your IP address reaches that service the moment the content loads:

• Google Analytics (United States) — only with prior consent, withdrawable at any time from the cookie banner. Google LLC participates in the EU–U.S. Data Privacy Framework, so the transfer rests on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).
• Have I Been Pwned (United Kingdom) — when you set a password we check its safety: only the first five characters of a code derived from the password are sent, never the password nor the full code. The United Kingdom is covered by an adequacy decision (Art. 45).
• TradingView charts (United States) — some articles embed an interactive chart loaded from tradingview.com. When you open such an article, it is your browser that contacts TradingView directly, and it receives your IP address, technical browser data and the referring page. This case differs from the ones above and we will say so plainly: TradingView does not process data on our behalf — its own notice describes it as an independent controller — so it answers for what it collects, and we have no contract with it that would let us promise you standard contractual clauses. What we can do, and do, is tell you that the contact happens, when, and what it involves. The chart is part of the article’s editorial content; if you would rather avoid it, you can block third-party iframes in your browser settings and the article stays readable.

Beyond what is listed above we do not transfer personal data outside the European Economic Area. Hetzner, Brevo and Zoho process data inside the European Union.

Retention

Data is kept only as long as needed for the purposes above. Specifically: reading history 12 months; reading statistics 14 months; security logs 24 months; consent records 24 months, always keeping the most recent choice while it remains valid. Deletion is automatic. Chosen topics, saved articles and collections are kept while the account exists and can be deleted at any time from your account area.

If you do not provide the data

Name and email are required to create an account: without them we cannot open one. Everything else is optional: you can read the site without registering, and once registered you may pick no topics and never turn on personalised suggestions, with no effect on what you can read.

Your rights

You have the right to access, rectification, erasure, restriction, portability and objection. You can export or delete your data directly from your account area. You may also lodge a complaint with the competent supervisory authority.

What remains after you delete your account, and why. Deleting your account removes your profile, chosen topics, reading history, saved articles, collections, followed topics and any newsletter subscription. Only two things remain, both detached from your name: the record of the consents you gave — this is the proof Art. 7(1) GDPR requires us to be able to produce, and deleting it would destroy the very evidence — and the security logs of actions performed on the account, kept for 24 months to reconstruct any abuse. If you wrote articles, the texts stay published and the byline passes to the newsroom: the article is the editorial product, not your personal data.

Withdrawing consent. Where processing relies on consent — newsletter, analytics cookies, personalised suggestions — you can withdraw it at any time, as easily as you gave it: from the “Interests and personalisation” page, from the cookie banner, or from the link at the bottom of every email. Withdrawal does not affect the lawfulness of processing carried out beforehand (Art. 7(3) GDPR).

You can also reset your interest profile at any time from the “Interests and personalisation” page, without closing your account.