Privacy Policy
The processing of personal data is governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation — GDPR).
www.nicoletteshirley.com is a literary and editorial publication. It shares essays and original writing and offers an email newsletter. It sells no products, operates no online shop and processes no payments.
1. Who processes your data
The controller is slowflow s.r.o., company ID 53827449, entered in the Commercial Register of the District Court Prešov, section Sro, insert no. 42313/P. The publication appears under the literary name Nicolette Shirley.
For any matter concerning your data or the exercise of your rights, write to hello@nicoletteshirley.com.
No data protection officer has been appointed.
2. What data is processed and why
Newsletter subscription
Data: your email address, and your name if you choose to provide it.
Purpose: sending essays and news about new writing.
Legal basis: consent under Article 6(1)(a) GDPR.
Retention: for as long as you remain subscribed. You may withdraw consent at any time using the unsubscribe link at the foot of every email.
Email correspondence
Data: your email address and whatever you choose to include in your message.
Purpose: reading and replying to your message.
Legal basis: legitimate interest under Article 6(1)(f) GDPR in ordinary correspondence with readers.
Retention: for as long as necessary to deal with your message and any follow-up.
Website analytics
Data: technical information about your visit in anonymised, aggregated form (pages viewed, referral source, device type, truncated IP address).
Purpose: understanding which essays readers read, and improving the site.
Legal basis: consent given through the cookie bar.
Retention: according to the settings of the analytics tool, at most 26 months.
3. Who has access to your data
Personal data is never sold, rented or shared with third parties for marketing purposes. It is processed only by technical providers necessary to run the publication:
– the hosting provider — technical operation of the website
– Substack Inc. (United States) — delivery of the newsletter
– Google Ireland Limited / Google LLC — website analytics
4. Transfers outside the European Union
Newsletter delivery and website analytics involve transfers of data to the United States.
Substack Inc. states that it complies with the EU-U.S. Data Privacy Framework and has certified to the U.S. Department of Commerce that it adheres to its principles. The current status of that certification can be verified on dataprivacyframework.gov.
For Google services, transfers rely on the same framework or on standard contractual clauses approved by the European Commission.
5. Your rights
You have the right:
– of access to the data held about you
– to rectification of inaccurate or incomplete data
– to erasure of your data
– to restriction of processing
– to data portability
– to object to processing based on legitimate interest
– to withdraw consent at any time
To exercise any of these rights, write to hello@nicoletteshirley.com with GDPR in the subject line.
You also have the right to lodge a complaint with the supervisory authority, which in the Slovak Republic is the Office for Personal Data Protection (dataprotection.gov.sk).
6. Data security and cookies
Appropriate technical and organisational measures are in place to protect your data against loss, unauthorised access and misuse.
This site uses cookies. Details are set out in the Cookie Policy.
Effective from August 2026.
