Privacy Policy

1. Introduction

1.1 This Privacy Policy describes how MXA Consulting Services Pty Ltd (the Company, we, us or our), a company incorporated in Australia, collects, holds, uses and discloses personal information in connection with the Slow News Day website at slow-news-day.com and related services (the Service).

1.2 The Company is the controller of the personal information processed in connection with the Service. This Policy is intended to satisfy the Company’s obligations under the Privacy Act 1988 (Cth), the General Data Protection Regulation (EU) 2016/679 (the GDPR), the GDPR as it forms part of the law of the United Kingdom (the UK GDPR), the California Consumer Privacy Act of 2018 as amended (the CCPA) and other data protection laws to the extent they apply to the Company (together, Data Protection Laws).

1.3 In this Policy:

• personal information means information about an identified or reasonably identifiable individual, and includes “personal data” and any equivalent term under Data Protection Laws;
• Member means an individual who holds an account for the Service, and you means a Member or any other individual whose personal information we process;
• Content means articles, drafts, images, comments and other material a Member submits to the Service; and
• Service Providers means third parties that process personal information on our behalf and on our instructions.

2. Personal information we collect

2.1 We collect the following personal information directly from you:

• Account information: your name, your email address and a record of your agreement to this Policy, including the version agreed to and the time of agreement. We do not verify the name you provide, and you may use a name of your choosing.
• Profile information: a description of yourself, your current job title, the company you work for and the date from which you have held that position.
• Work email address: if you elect to confirm the company you work for, an email address at that company’s domain.
• Content, together with information about it such as the time it was created, published or withdrawn and the topics assigned to it.
• Correspondence: the contents of any communication you send to us.

2.2 We collect the following personal information when you use the Service:

• Activity records: a record of the actions you take on the Service, including signing in and out, opening articles, giving and withdrawing marks, following and unfollowing other Members, posting comments, saving and publishing Content, changing your profile and searching, together with the item acted on and the time of the action. Activity records identify you by an account identifier and are held separately from your name and email address. We do not record the text of your searches.
• Technical information: your IP address, and information about your browser and device that is collected for security purposes or sent to our Service Providers in the ordinary course of delivering the Service.

2.3 We receive from our bot-detection Service Provider the result of the check that a person joining the Service is not an automated program.

2.4 If we introduce paid subscriptions or payments to Members for their articles, we will collect the billing, payment and payout information necessary for those purposes through payment Service Providers, and will amend this Policy before doing so.

2.5 You must provide your name and email address to create an account. Without them we cannot provide the Service to you. Profile information and a work email address are optional.

2.6 When you upload an image, we remove the metadata embedded in the file, including location data, before we store it.

3. How we use personal information

3.1 We collect, hold and use personal information for the following purposes:

• to provide, operate and maintain the Service, including creating and administering accounts, authenticating Members, publishing and displaying Content and profiles, and selecting and presenting Content to Members;
• to confirm the company a Member states they work for, where the Member requests it;
• to send service communications, including sign-in codes and notices about your account;
• to protect the security and integrity of the Service, including preventing automated access, limiting misuse, and detecting and investigating fraud, manipulation of marks and other conduct that breaches the terms on which the Service is offered;
• to enforce those terms and to respond to complaints and reports about Content;
• to analyse how the Service is used, to measure its performance, and to develop and improve the Service;
• to conduct research and produce statistics, using aggregated or de-identified information;
• when payments are introduced, to collect subscription fees and to pay Members for their articles;
• to comply with our legal obligations, to respond to lawful requests from public authorities, and to establish, exercise or defend legal claims; and
• in connection with any actual or proposed merger, acquisition, financing, restructure or sale of all or part of our business or assets.

3.2 We may use personal information for any other purpose that is related to a purpose set out above and that you would reasonably expect, or to which you consent, or that is required or authorised by law.

3.3 Information that has been aggregated or de-identified so that it no longer identifies any individual is not personal information, and we may use and disclose it for any purpose.

4. Disclosure of personal information

4.1 We may disclose personal information to:

• Service Providers who provide hosting, database, authentication, file storage, bot-detection and email delivery services, and, when payments are introduced, payment services;
• our professional advisers, auditors and insurers;
• courts, regulators, law enforcement agencies and other public authorities, where we are required or authorised by law to do so, or where we believe disclosure is necessary to protect the rights, property or safety of the Company, Members or others;
• any actual or prospective purchaser, investor or successor in connection with a transaction described in clause 3.1, subject to obligations of confidentiality; and
• any other person with your consent or at your direction.

4.2 The following information is visible to other Members: your name, profile information, the domain of your confirmed work email address, your published articles and comments, the number of your followers, and the total marks your articles have received. The number of marks on each article is visible to Members. We do not disclose to other Members your email address or which Members gave marks.

4.3 We do not sell personal information, and we do not use or disclose it for targeted advertising.

5. Overseas disclosure and international transfers

5.1 We store the Service’s database, files and authentication records in Australia. Our Service Providers may process personal information in other countries in the course of providing their services, including the United States. Our email delivery Service Provider holds records of the emails we send in the United States. Our bot-detection Service Provider processes information in the countries in which it operates.

5.2 For individuals whose personal information is subject to the GDPR or the UK GDPR: the Company is established in Australia. The European Commission has not adopted an adequacy decision in respect of Australia. Where we transfer personal information to a country that is not the subject of an adequacy decision or adequacy regulations, we rely on appropriate safeguards, such as standard data protection clauses, or on a derogation permitted by the GDPR or the UK GDPR. You may request a copy of the relevant safeguards by contacting us.

6. Retention

6.1 We retain personal information for as long as it is necessary for the purposes described in this Policy, and in particular:

• account information, profile information and Content: for as long as you hold an account, subject to section 7;
• activity records: for as long as you hold an account, and afterwards in the form described in clause 7.2;
• details submitted by a person who begins to join but does not confirm their email address: no longer than one day;
• records used to limit misuse of sign-in, which hold your email address and IP address only in a non-readable form: no longer than one day;
• a work email address: until you confirm it or the confirmation code expires, after which we retain only its domain; and
• any personal information we need to comply with a legal obligation, to resolve a dispute, to complete an investigation, or to establish, exercise or defend a legal claim: until that need ends.

6.2 Copies of personal information may remain in backup systems for a limited period after deletion until they are overwritten.

7. Closing your account

7.1 You may close your account at any time from the Leave Slow News Day page. When you close your account we delete your account information, profile information, comments, drafts, follows and authentication records. You may elect either to have your published articles deleted or to have them remain on the Service attributed to a former Member. If your articles are deleted, the comments on them are deleted. Marks you have given continue to count but are no longer associated with you.

7.2 When you close your account we remove your account identifier from your activity records, reduce the time of each record to the week in which it occurred, and replace references to your own articles with the topic of the article. We retain the resulting records for the purposes described in section 3.

8. Security

8.1 We hold personal information electronically, using Service Providers’ systems. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. Access to Members’ email addresses and activity records is restricted to authorised personnel. No method of transmission or storage is completely secure, and we cannot guarantee the security of personal information.

9. Cookies

9.1 We use cookies that are necessary to provide the Service: to keep you signed in, to complete the joining process in the browser in which it began, and to record whether you asked to stay signed in. If you select “Keep me signed in”, your sign-in cookies last for 30 days after your last visit. Otherwise they expire when you close your browser.

9.2 The joining page loads a script from our bot-detection Service Provider, which collects information from your browser and device in order to determine whether you are a person.

9.3 We do not use advertising or analytics cookies, and we do not place third-party advertising or analytics scripts on the Service.

10. Automated processing

10.1 We use automated processing to select and order the Content presented to Members, to limit misuse of the Service and to assess the integrity of activity on the Service. Where a decision based solely on automated processing produces legal effects concerning you or similarly significantly affects you, you may ask for the decision to be reviewed by a person, express your point of view and contest the decision, by contacting us.

11. Children

11.1 The Service is not directed to individuals under the age of 16, and individuals under that age must not create an account. We do not knowingly collect personal information from individuals under 16. If we become aware that we hold personal information of an individual under 16, we may close the account and delete that information.

12. Your rights

12.1 Subject to Data Protection Laws, you may request access to, or correction of, the personal information we hold about you. You can view your name and email address on Your details and change your profile information on your Profile. Further rights available under particular laws are set out in sections 14 to 16.

12.2 To make a request, contact us at hello@mxa.com.au. We will need to verify your identity before acting on a request, ordinarily by confirming that you control the email address associated with your account. We may decline a request where Data Protection Laws permit us to do so, and will give you our reasons.

13. Right to object

13.1 If the GDPR or the UK GDPR applies to you, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal information that is based on our legitimate interests, including profiling based on those interests. If you object, we will no longer process the information for that purpose unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims. To object, contact us at hello@mxa.com.au.

14. Australia

14.1 We handle personal information in accordance with the Australian Privacy Principles. You may request access to and correction of your personal information as described in section 12.

14.2 If you believe we have breached the Australian Privacy Principles, please first make a written complaint to us at hello@mxa.com.au. We will acknowledge the complaint, consider it, and respond to you in writing within a reasonable period. If you are not satisfied with our response, you may complain to the Australian Information Commissioner.

14.3 We are likely to disclose personal information to overseas recipients, as described in section 5. The countries in which those recipients are likely to be located include the United States.

15. European Economic Area and United Kingdom

15.1 The controller is MXA Consulting Services Pty Ltd, contactable at hello@mxa.com.au.

15.2 We rely on the following legal bases:

• performance of a contract: to provide the Service to you, including your account, authentication, publication and display of Content and profiles, selection of Content, company confirmation, service communications and, when introduced, payments;
• legitimate interests: to protect the security and integrity of the Service, prevent fraud and misuse, enforce our terms, analyse and improve the Service, conduct research and produce statistics, comply with laws outside the European Union and the United Kingdom that apply to us, establish, exercise or defend legal claims, and carry out business transactions described in clause 3.1. Our legitimate interests are operating a secure and reliable service, maintaining the integrity of marks and Content, understanding and developing our business, and complying with the law;
• legal obligation: where processing is necessary to comply with a legal obligation under the law of the European Union, a Member State or the United Kingdom to which we are subject; and
• consent: to keep you signed in beyond the end of your browser session, where you select that option. You may withdraw consent at any time by signing out, without affecting the lawfulness of processing before withdrawal.

15.3 You have the right to request access to, rectification or erasure of your personal information, restriction of its processing, and to receive it in a portable form, and the right to object described in section 13.

15.4 If you are in the European Economic Area, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. If you are in the United Kingdom, you may make a complaint to us, and you may make a complaint to the Information Commission.

16. United States

16.1 This section applies to residents of California and other US states whose laws apply to the Company.

16.2 In the preceding 12 months we have collected the following categories of personal information:

• identifiers, such as name, email address, IP address and account identifier;
• professional or employment-related information, such as job title and employer;
• internet or other electronic network activity information, such as your interactions with the Service;
• visual information, such as images you upload; and
• inferences drawn from the above, such as the Content likely to be of interest to you.

16.3 We collect this information from you, from your device, and from our Service Providers, for the business and commercial purposes described in section 3. We retain each category for the periods described in section 6. In the preceding 12 months we have disclosed each category for a business purpose to the Service Providers described in clause 4.1.

16.4 We do not sell or share personal information, and have not sold or shared personal information in the preceding 12 months. In this section, “share” means disclosure for cross-context behavioural advertising. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

16.5 California residents have the right to request that we disclose the categories and specific pieces of personal information we have collected about them, the categories of sources, the purposes of collection, and the categories of third parties to whom we disclose it; the right to request deletion of personal information we have collected from them; the right to request correction of inaccurate personal information; and the right not to be discriminated against for exercising these rights. Residents of other states may have rights under the laws of their state. To exercise a right, contact us at hello@mxa.com.au. If we decline a request, we will tell you why and, where your state’s law provides a right of appeal, how to appeal.

17. Changes to this Policy

17.1 We may amend this Policy from time to time. We will publish the amended Policy on the Service with its effective date. Where an amendment materially affects how we handle your personal information, we will take reasonable steps to notify you, which may include notice by email or on the Service.

18. Contact

18.1 Questions, requests and complaints about this Policy or our handling of personal information should be sent to MXA Consulting Services Pty Ltd at hello@mxa.com.au.