1. Data Controller

The data controller responsible for processing your personal data in connection with this website is:

If you have any questions or concerns regarding this Privacy Policy or the processing of your personal data, please contact us at the address or email above.

2. About This Website

thyroidum is an independent editorial health magazine providing background information, research summaries and experience reports focused on thyroid health, hypothyroidism and Hashimoto's disease, primarily for a female readership. The website does not offer medical advice and does not replace professional medical consultation.

3. Data We Collect

We may collect the following categories of personal data:

3.1 Data Collected Automatically

When you visit thyroidum.org, our servers and third-party services may automatically collect technical information, including:

• IP address (typically anonymised or truncated where possible)
• Browser type and version
• Operating system
• Referring URL and pages visited on this site
• Date and time of access
• Device type and screen resolution

3.2 Data You Provide Voluntarily

If you contact us via email or any contact form, we collect the information you provide, such as your name and email address, together with the content of your message.

4. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under Article 6 GDPR:

• Legitimate interests (Art. 6(1)(f) GDPR): Operating, securing and improving the website; analysing aggregated usage statistics to understand our audience and improve editorial content.
• Consent (Art. 6(1)(a) GDPR): Where we set non-essential cookies or use analytics and tracking technologies, we rely on your freely given, informed consent obtained via our cookie consent mechanism. You may withdraw your consent at any time.
• Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR): Where applicable, e.g. if you subscribe to a newsletter or similar service.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR): Where processing is required to fulfil a statutory obligation.

5. Hosting and Infrastructure

This website is hosted by a third-party hosting provider. As part of normal server operations, the hosting provider may process certain technical data (such as IP addresses and access logs) on our behalf as a data processor. We have entered into appropriate data processing agreements with our hosting provider to ensure your data is handled in accordance with GDPR requirements.

All data transmission between your browser and our servers is encrypted using SSL/TLS technology (HTTPS). You can verify this by checking for the padlock icon in your browser's address bar. While we take all reasonable technical and organisational measures to protect your data, no method of transmission over the internet is 100% secure.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on this website. Cookies are small text files stored on your device by your browser.

6.1 Types of Cookies We Use

6.2 Managing Your Cookie Preferences

When you first visit this website, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can change your preferences at any time by clicking the cookie settings link on the website or by clearing cookies in your browser settings.

Please note that disabling certain cookies may affect the functionality or performance of the website.

7. Web Analytics

We may use third-party web analytics services to collect and analyse anonymised or pseudonymised usage data about how visitors interact with this website. Such services may set cookies on your device and may transmit data to servers, potentially including servers outside the European Economic Area (EEA).

Where analytics tools are used:

• IP addresses are anonymised or truncated before processing where technically feasible.
• Data is used only for aggregated statistical analysis to improve the editorial quality and usability of this website.
• We have entered into data processing agreements with analytics providers as required by GDPR.

Analytics cookies are only activated with your prior consent.

8. Sharing Data with Third Parties

We do not sell your personal data. We may share data with third parties only in the following circumstances:

• Service providers and data processors: We engage trusted service providers (e.g. hosting, analytics, email delivery) who process data solely on our instructions and are contractually bound to protect your data under data processing agreements.
• Advertising partners: With your consent, we may share anonymised or pseudonymised identifiers with advertising technology partners to serve relevant advertisements and measure their effectiveness.
• Legal requirements: We may disclose data where required to comply with a legal obligation, court order or lawful request from a competent authority.
• Business transfers: In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction. We will notify affected users in advance where required by law.

Where data is transferred to recipients outside the European Economic Area, we ensure adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognised transfer mechanisms.

9. Embedded Content and External Links

Articles on this website may contain embedded content (e.g. videos, images, or interactive elements) or links to external third-party websites. Embedded content from other websites behaves in exactly the same way as if you had visited those websites directly. These third-party sites may collect data about you, use cookies and independently monitor your interaction with their embedded content.

We have no control over the content or privacy practices of external websites. Please review the privacy policies of those websites before providing any personal data.

10. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access to the personal data we hold about you (Art. 15 GDPR).
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure of your data (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object to processing based on legitimate interests (Art. 21 GDPR).
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise any of these rights, please contact us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence or place of work (Art. 77 GDPR).

11. Data Retention

We store personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law. Once the purpose no longer applies and no legal retention period requires further storage, the data is deleted.

12. Data Security

This website uses SSL/TLS encryption to protect data transmitted between your browser and our servers. You can recognise an encrypted connection by "https://" in the address bar and the lock symbol in your browser.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or in our services. The current version is always available on this page.