Privacy statement

Sponmag is the operating system for sponsored publishing. Publishers manage their issues, advertisers and material in it. This statement explains which personal data Sponmag processes and why.

For the data of advertisers and contact persons, the publisher is the controller and Sponmag is the processor: we process that data solely on the publisher's instructions, laid down in a data processing agreement that comes with every subscription.

Which data: account details of team members and contact persons (name, email address, language preference), the material and planning the publisher enters itself, and an audit log of actions in the system (who did what, when). The audit log never contains passwords or connection tokens.

What for: delivering the service (signing in by email, collaborating on issues, submitting material), keeping actions traceable, and service emails such as sign-in links, material requests and renewal announcements. There is no tracking and no profiling, and data is never sold.

Legal basis: performance of the agreement with the publisher; for the audit log a legitimate interest (security and traceability).

Retention: data exists as long as the subscription runs (the Archive plan counts). After a subscription ends, everything stays viewable and exportable for sixty days; after that the archive becomes inaccessible and all customer data is permanently erased, no later than 150 days after the end of the subscription. The token-free audit log remains as the record.

Your rights: access, correction and erasure. If you are an advertiser or contact person of a publisher, address your request to that publisher — it manages the data and Sponmag gives it the controls to do so. If you cannot work it out together, email post@sponmag.com. You can also file a complaint with the Dutch Data Protection Authority.

Security: data of different publishers is strictly separated, access works through email links instead of passwords, secrets never appear in logs, and the service runs in the European Union. The subprocessors that help with this have their own page.

Connections the publisher makes itself (such as Dropbox, Airtable or Canva) run through its own accounts with those services; the publisher decides whether to enable them.

If this statement changes, the new version appears on this page with a new date. Questions: post@sponmag.com.