3. The Compass newsletter
What Compass is. Compass is the weekday email briefing of State of Biz on central bank communication; the controller is Jubelprosa GmbH, which operates State of Biz. You receive it only if you subscribe and then confirm the subscription on the page that the link we send you opens (double opt-in, a two-step sign-up).
What data we process. When you subscribe we collect your email address and the language you subscribe in. We do not collect a name. Providing your email address is voluntary; without it we cannot send you Compass. Compass is available in German and in English; each language is a separate subscription with its own confirmation, unsubscribe link and consent record. As proof of your consent we store, for each step (subscription, confirmation, unsubscription, erasure at your request, automatic deletion of an unconfirmed request, or deletion because your address was permanently undeliverable, you reported an issue or our confirmation email as spam, or the delivery service suppressed your address), your email address, the time, the language, the technical source of the step (for example the website, the unsubscribe function of your email client, the automatic deletion run or a report from the delivery service), and the exact wording of the consent text in the version you agreed to, with its version identifier and checksum (a digital fingerprint of the text). For each of these steps we also store a digital fingerprint of your personal unsubscribe key, so that we can match an older unsubscribe link to your address and language; an older unsubscribe link therefore also ends a later subscription of the same address and language for as long as we keep the consent record. The consent record contains neither your IP address nor your browser identification.
Server logs. Separately, every request to this website is logged technically, including the subscription, confirmation, unsubscribe and rating pages, with among other things the IP address, time, requested address, browser identification and referrer. Confirmation, unsubscribe and rating links carry your personal identifier in the address. It remains in the web server's log files and in the server's system log; in the application log of our website and when the entries are copied into our traffic data, we replace it with a placeholder. The log files are replaced according to their size, and the system log is limited by storage space, as is the application log of our website; no fixed deletion period is currently set for these logs. We currently delete traffic data containing the full IP address after 90 days: a daily run removes older entries as soon as a daily count without IP addresses exists for their day. Only daily counts per traffic category, bot and page without IP addresses are kept. We use the logs to provide the website securely, to prevent abuse and to measure automated access (Art. 6(1)(f) GDPR).
Purpose and legal basis. We use your email address to send you Compass; the legal basis is your consent (Art. 6(1)(a) GDPR). We keep the consent record to be able to demonstrate whether and when you consented, withdrew or did not confirm (Art. 7(1) GDPR); storing it, including after a withdrawal, is based on our legitimate interest in demonstrating consent and defending against claims of unsolicited email (Art. 6(1)(f) GDPR).
Double opt-in. After you subscribe we send you an email with a confirmation link. The link leads to a page where you confirm the subscription with one more click; merely opening the link confirms nothing. The link is valid for 72 hours and can be used once. If you subscribe again within ten minutes in the same language, we do not send another email. If you subscribe again later, before confirming, we send the same link again while it is valid, or, once it has expired, a new link that is again valid for 72 hours; the language of a stored request does not change. If you subscribe with an address that is already confirmed in that language, we send a notice email without a confirmation link saying that the address is already subscribed; we store no consent record for it. If you subscribe in the other language, that is a separate subscription with its own confirmation email. So that nobody floods other people's mailboxes with sign-up emails, we limit the number of emails per address and overall; once the limit is reached we send no email. If you do not confirm, the daily deletion run removes the request with the first run after the link has expired, and at the latest with the first run after 30 days since the first request. The consent record of an unconfirmed request is kept according to the rules under “How long we keep data”.
Send log. For every email we send in response to a subscription (confirmation or notice email), we store a short value calculated from your address (a hash, not the address itself; it can be matched back to the address if the address is known), the language, the type of email and the time. We use it to limit abuse through third-party subscriptions (Art. 6(1)(f) GDPR). We delete the entries with the next daily deletion run once we no longer need them for the limit, so after a few days at the latest; immediately if you have us erase your data. Separately, our sending system logs every delivery of an issue with a shortened recipient address (for example “a***@b***.de”), the subject and the time; we rotate the log files weekly and automatically delete older generations after a few weeks (Art. 6(1)(f) GDPR, operation and troubleshooting).
Unsubscribe survey. After unsubscribing you can voluntarily say why (multiple choice, no free text). We store the selected reasons and the date, without an email address and without a reference to your subscription. The answer is pseudonymous, not anonymous: anyone with access to our database and logs may be able to match it to an unsubscription through the date and the time of unsubscribing. The basis is our legitimate interest in receiving feedback and improving Compass (Art. 6(1)(f) GDPR). We delete the answers once we no longer need them for the year-on-year comparison of feedback, after one year at the latest.
Delivery via Resend. Delivery is performed by the service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). For this purpose Resend receives your email address, the subject and the content of every email (the confirmation email with the confirmation link, the notice email and every issue including your personal unsubscribe and rating links), as well as an internal subscription number and technical delivery identifiers. The emails are sent via servers in the EU (Ireland); that determines the sending route, not where data is stored. According to Resend, it stores customer data, including message content and delivery logs, in the United States, retains content and logs for 30 days, and uses other service providers that are all located in the United States, including Amazon Web Services. We base the transfer to the United States on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), by which the Commission recognises an adequate level of data protection for certified US companies; Resend is listed there as a certified organisation (as of 15 September 2026). Open and click tracking is switched off at Resend for our domain, and our issues contain no tracking pixels and no click redirects; we do not analyse whether you open an issue or which links you follow. Resend reports back to us what happened to each email: delivered, delayed, undeliverable, reported as spam, or suppressed by Resend. We count these reports without your address and without the content of the email; only technical identifiers of the respective email and of the event remain stored, each only as long as we need them for error statistics and to protect against reports being processed twice, a little over a year at most. If Resend reports that your address is permanently undeliverable, that you reported an issue or our confirmation email as spam, or that Resend has suppressed your address, we delete your subscriber data and record that step in the consent record (see “How long we keep data”).
When you open an issue. Your email client loads images from our servers, which may be logged like any request to our servers; the image addresses carry no personal identifier. It does not load fonts from the internet: the issues embed no external fonts. Whether your email client loads images from the internet is set in its settings.
Ratings. At the end of every issue you can rate the issue with one click. The link first leads to an intermediate page; merely opening the link stores nothing. A rating is created only when you click “Save rating” there; we store it together with the issue date and the time of that click against your subscription. The basis is our legitimate interest in receiving feedback on the issues and improving Compass (Art. 6(1)(f) GDPR). The request is also logged as described under “Server logs”. When you unsubscribe or your subscription is erased, we remove the link to your subscription; the issue date, rating and time remain stored without that link. We delete ratings once we no longer need them for the year-on-year comparison of feedback, after one year at the latest.
Objection. Where we rely on our legitimate interest (server logs, consent record, ratings, send log, unsubscribe survey), you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We then no longer process the data unless compelling legitimate grounds override your interests or the processing serves to establish, exercise or defend legal claims, as with the consent record. If you object to the storage of your ratings, we delete the stored ratings without requiring reasons; delivery of Compass does not depend on it. Please send your objection to contact@state-of.biz.
Withdrawal and unsubscribing. You can withdraw your consent at any time with effect for the future: via the unsubscribe link at the end of every issue, via the unsubscribe function of your email client, or by emailing contact@state-of.biz. A withdrawal applies to the language in which you declare it; with it we delete the subscriber data of that subscription (email address, language, links) without undue delay and stop sending in that language. If you want us to end all your subscriptions, write to us. The lawfulness of processing carried out before the withdrawal is not affected.
How long we keep data. We keep your subscriber data until you withdraw, or until your address is permanently undeliverable, you report an issue or our confirmation email as spam, or the delivery service suppresses your address; in these cases we delete your subscriber data without any further action on your part and stop sending. Unconfirmed requests are removed as described under “Double opt-in”. We keep the consent record for three years, counted from the end of the calendar year in which the respective subscription was closed: by unsubscribing, by erasure (including erasure because of permanent undeliverability, a spam report or suppression by the delivery service), by expiry without confirmation, or because, before confirmation, a further confirmation email was sent to the same address in the same language. Records that have become due are removed by a monthly deletion run. Before each such deletion a backup copy is taken; a later monthly run removes it, so as a rule after about two months. Deleted data normally remains in the daily database backups for a few days; we mirror the backups daily to storage space at our hosting provider. If you request erasure of your data, we delete your subscriber data without undue delay. We continue to keep the consent record until the period expires, because it may serve to defend against legal claims and the right to erasure does not apply to that extent (Art. 17(3)(e) GDPR); we tell you the date from which it will be deleted.
Your rights are listed above under “What rights do you have regarding your data?”. Newsletter requests go to contact@state-of.biz.
4. Additional Information
Note on the responsible entity
The responsible entity for data processing on this website is:
Jubelprosa GmbH
Schierholzstraße 27
30655 Hannover, Germany
Represented by: Kay Bartelt, Managing Director
E-Mail: contact@state-of.biz
Audience measurement
We measure the reach of this website with Plausible Analytics, which we run ourselves on our own infrastructure; the data is not passed on to third parties. Plausible sets no cookies and does not store your IP address. For each page view we store the requested page, the referring page (if any), the country, browser, operating system, screen size and device, plus the time spent on the page and the target address of links you click that lead to other websites. Visits are combined using a hash of your IP address and your browser identification into which a key that changes daily is mixed; as a result a visitor can be recognised only within a single day. No fixed deletion period is currently set for this data. The basis is our legitimate interest in knowing the reach of our site (Art. 6(1)(f) GDPR). You may object to the measurement at any time (Art. 21(1) GDPR); write to contact@state-of.biz. On the newsletter subscription page and on its confirmation, unsubscribe and rating pages the measurement is switched off.
Inquiries by email
If you contact us by email, your inquiry, including all resulting personal data (name, inquiry), will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on your consent (Art. 6(1)(a) GDPR) and/or on our legitimate interests (Art. 6(1)(f) GDPR), as we have a legitimate interest in effectively processing inquiries addressed to us.
The data you send us via contact requests will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory statutory provisions – particularly statutory retention periods – remain unaffected.