Effective Date: AUG 18, 2026
1. Controller
VAT Included is operated by Firat Ersin Corbaci, Germany ("we," "us"). Contact: privacy@vatincluded.com . Full details are in our Legal Notice.
2. What we collect
Newsletter subscription. When you subscribe, we collect your email address, plus the IP address and timestamp of your confirmation click. We record the IP and timestamp because German law requires us to be able to prove you actually opted in (double opt-in) if that's ever disputed — it is not used for any other purpose.
Website analytics. We use Plausible Analytics, a privacy-focused tool that does not use cookies and does not collect personal data. It reports aggregate visit statistics only (e.g. page views, referring sites) and cannot identify individual visitors.
Emails. We use Beehiiv to send the newsletter. Beehiiv records standard email engagement data (opens, clicks) tied to your subscription, which we use to understand what content resonates and to keep our sending reputation healthy.
3. Why we process this data (legal basis)
Sending the newsletter you signed up for: your consent (Art. 6(1)(a) GDPR), given via double opt-in.
Keeping records of that consent: our legal obligation (Art. 6(1)(c) GDPR).
Basic, non-invasive analytics: our legitimate interest in understanding readership (Art. 6(1)(f) GDPR), balanced against your privacy by using a cookieless, non-identifying tool.
4. Who else sees this data (processors)
We share data with the following service providers, each acting as our data processor under a data processing agreement:
Beehiiv, Inc. (USA) — email sending and subscriber list management.
Google Workspace / Google LLC (USA) — business email and admin tools.
Plausible Analytics (EU) — website analytics, cookieless.
Framer (USA) — website hosting.
Where data is transferred outside the EU/EEA (Beehiiv, Google, Framer are US-based), we rely on Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework as safeguards.
5. How long we keep it
We keep your subscription data for as long as you remain subscribed. If you unsubscribe, your email address is removed from active sending lists; some records may be retained briefly for legal/consent-proof purposes as required by law.
6. Your rights
Under GDPR, you have the right to access, correct, delete, or export your data, to object to or restrict our processing, and to withdraw consent at any time (unsubscribe link in every email). You also have the right to complain to a data protection supervisory authority — in Germany, this is the data protection authority for the state where we're based.
To exercise any of these rights, contact privacy@beehiiv.com
7. Changes
We may update this policy occasionally. The "last updated" date at the top reflects the most recent revision.