Human on Paper

Privacy Policy

Effective date: 29 September 2026 | Website version

This Privacy Policy explains how Human on Paper Publishing processes personal data when you visit the Human on Paper website, subscribe to the newsletter, contact us, or follow links to external platforms. It is intended to provide the information required by Articles 12 and 13 of the General Data Protection Regulation (GDPR).

The Website is informational and editorial. Products are not purchased directly through the Website. Links may lead to external platforms, including Amazon or Hotmart, which process data under their own privacy notices.

1 Controller

The controller responsible for the processing described in this Policy is:

Human on Paper Publishing is operated by Natalia Sanchidrián Polo as an individual entrepreneur. A data protection officer has not been appointed because no statutory appointment requirement currently applies.

2 Scope and principles of processing

We process personal data only where a lawful basis applies and only to the extent necessary for the purposes described below. We apply the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality under Article 5 GDPR.

3 Website hosting and technical delivery

The Website is a static site hosted on Cloudflare Pages. Cloudflare, Inc. and its affiliated entities provide content delivery, DNS and related infrastructure. To the extent Cloudflare processes personal data on our instructions, it acts as a processor under Article 28 GDPR and the applicable data-processing terms.

When the Website is accessed, technical data may be processed in server, edge or request logs. Depending on the request and platform configuration, this may include the requested URL and HTTP method, response status, date and time, referrer URL, IP address, user-agent information and technical diagnostic data.

The purpose is to deliver the Website, maintain stability and security, diagnose errors and protect the service from misuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically efficient operation of the Website.

Technical log data is retained only for as long as required for operation, security, troubleshooting and applicable legal or contractual requirements.

4 Analytics and advertising tools

The Website does not contain Google Analytics, Google Tag Manager, Meta Pixel, TikTok Pixel, Hotjar, Microsoft Clarity or another third-party advertising or behavioural analytics tool.

We do not use the Website to create advertising profiles or to track visitors across unrelated websites. If optional analytics or advertising technologies are introduced later, this Policy and, where required, the consent mechanism will be updated before they are activated.

5 Newsletter and book updates

5.1 Subscription data

The Website uses an embedded signup form provided by the Lead Generator service operated for Human on Paper at leadgenerator.slowcode.io (Slowcode). When you subscribe, we process the information entered in the form, currently first name, last name, email address and the consent confirmation required by the form. The service may also process subscription status, language or list assignment, timestamps, technical confirmation data and information needed to document the subscription request.

First and last name are used to manage and, where appropriate, personalise communications. The email address is required to deliver the newsletter. You should not enter information about other people.

5.2 Purpose and legal basis

We use the data to administer the requested subscription and send Human on Paper newsletters, book news, resources and occasional offers. The legal basis is your consent under Article 6(1)(a) GDPR. Marketing emails are sent only where the applicable consent requirements under section 7 of the German Act Against Unfair Competition (UWG) have been met.

Providing newsletter data is voluntary. If you do not provide a valid email address and give the required consent, we cannot activate the subscription.

5.3 Confirmation of subscription

Depending on the email-delivery configuration in force at the time of signup, confirmation of the subscription may be required before marketing emails are sent, or the address may be activated after the form is submitted with consent. Where a confirmation email is used, you must complete that step before the address becomes active for campaign emails.

5.4 Language

Subscribers may be assigned to an English or Spanish communication stream according to the signup route or website language. These assignments are used to send communications in the relevant language and do not mean that duplicate campaign emails will be sent.

5.5 Withdrawal and unsubscribe

You may withdraw consent at any time with effect for the future by using the unsubscribe link included in each marketing email, where provided, or by writing to natalia@humanonpaper.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After unsubscribing, your address will no longer be used for newsletter marketing.

5.6 Retention

Newsletter data is retained while the subscription is pending or active and for as long as needed to administer the service. After withdrawal or unsubscribe, limited records may be retained where necessary to document consent and withdrawal, maintain a suppression list, comply with legal obligations, or establish, exercise or defend legal claims.

6 Newsletter and form service providers

Slowcode processes newsletter and contact-form data as a service provider and processor for the operation of the Lead Generator forms embedded on the Website. Form submissions are delivered to Human on Paper at natalia@humanonpaper.com.

Personal data may also be disclosed to public authorities, courts, professional advisers or other recipients where required by law or necessary to establish, exercise or defend legal claims.

7 Contact form and email

If you use the contact form or write to us by email, we process your name, email address, the content of your message and any information you provide voluntarily. The purpose is to respond and communicate with you.

The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or pre-contractual request, and Article 6(1)(f) GDPR for general enquiries. Our legitimate interest is responding to legitimate communications. Correspondence is retained only as long as necessary to handle the matter and any follow-up, subject to legal retention duties or the need to establish, exercise or defend legal claims.

The contact form is also delivered through the Lead Generator embed described in section 6 and includes a technical honeypot field (not intended for people) to reduce spam.

8 Cookies and similar technologies

The static Website does not itself set non-essential cookies or use localStorage, sessionStorage, IndexedDB or advertising pixels for tracking. Language is selected through separate English and Spanish pages rather than a stored preference.

The embedded Lead Generator forms establish a technical connection to leadgenerator.slowcode.io when they load or are used. Technical data required to deliver and secure the forms may be processed, including cookies or temporary storage needed for submission security and anti-abuse measures.

If technologies that store information on, or access information from, a visitor's device are introduced beyond what is strictly necessary for the service, the requirements of section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) will be assessed. Technologies requiring consent will not be activated before the legally required consent is obtained.

9 Fonts, images and media

The Website uses self-hosted EB Garamond and Inter fonts and serves images from the Website origin. No direct browser request to Google Fonts is required for the current design.

If future changes cause an independent third party to receive visitor data directly through fonts, media or embedded content, this Policy and any required consent controls will be updated before that integration is used.

10 External links and sales platforms

The Website may contain ordinary links to external services, including Amazon, Hotmart and social-media platforms. No payment-card or banking data is collected through the Human on Paper Website. A third party generally receives data only after you choose to follow its link or use its service. The external provider then processes data under its own privacy notice and terms.

The Website currently contains no embedded payment service, social-media widget, third-party map, CAPTCHA or cross-site advertising tracker.

11 International transfers

Website delivery through Cloudflare may involve processing outside the European Economic Area. Where personal data is transferred to a third country, we rely on the safeguards required by Chapter V GDPR, such as an adequacy decision or Standard Contractual Clauses and any necessary supplementary measures.

If a future provider processes personal data in a third country under different arrangements, we will apply the required safeguards and update this Policy accordingly.

12 General retention criteria

We retain personal data only for as long as necessary for the purpose for which it was collected, taking account of statutory retention requirements, security needs, contractual obligations and limitation periods. Data that is no longer required is deleted or anonymised unless further retention is legally permitted or required.

13 Your rights

Subject to the conditions and limitations of the GDPR, you may have the following rights:

• access to your personal data under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR, where applicable;
• objection to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR;
• withdrawal of consent at any time with effect for the future under Article 7(3) GDPR; and
• the right to lodge a complaint with a supervisory authority under Article 77 GDPR.

To exercise your rights, contact natalia@humanonpaper.com. We may request information reasonably necessary to verify your identity and protect personal data from unauthorised disclosure.

14 Right to object

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required to establish, exercise or defend legal claims.

You may object to processing for direct marketing at any time. Personal data will then no longer be processed for that purpose.

15 Supervisory authority

You may lodge a complaint with a data protection supervisory authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for the controller's establishment in Frankfurt am Main is:

16 Security

We use appropriate technical and organisational measures proportionate to the risks of processing to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure or access. No Internet transmission or storage system can be guaranteed to be completely secure.

17 Automated decision making and profiling

The Website does not use personal data for automated decision-making that produces legal effects or similarly significantly affects a person within the meaning of Article 22 GDPR.

18 Children

The Website and newsletter are not designed to intentionally collect children's personal data for behavioural advertising or profiling. If we become aware that personal data has been collected in circumstances requiring parental authorisation or another specific legal basis, we will take appropriate action under applicable law.

19 Changes to this Privacy Policy

We may update this Policy when the Website, legal requirements or our processing activities change. The current version and effective date will be published on the Website. Material changes will be communicated where required by law.