Privacy Policy

Saffa Media Ltd, trading as The Saffa Brief (“we”, “us”, “our”), is the publisher of The Saffa Brief newsletter. We are an independent UK media company registered in England and Wales.

Our registered address is: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Company registration number: [CH-TBD]

ICO registration number: [ICO-TBD]

For any questions about this policy or how we handle your data, please contact us at editor@thesaffabrief.com.

This policy explains what personal data we collect about you, why we collect it, how we use it, who we share it with, and what your rights are under UK data protection law (UK GDPR and the Data Protection Act 2018).

This policy applies to data collected through The Saffa Brief website at thesaffabrief.com and the newsletter subscription process.

We collect the following personal data:

Subscription data

• Your email address, provided when you subscribe to the newsletter
• Your subscription status and preferences

Technical and usage data

• Anonymised page view and interaction data collected via PostHog (cookie-free, EU-hosted)
• Email engagement data (opens, clicks) collected by Brevo as part of newsletter delivery

We collect personal data in the following ways:

• Directly from you when you enter your email address into the subscribe form on our website
• Automatically through PostHog analytics when you visit our website (cookie-free, no personally identifiable information stored)
• Through Brevo when you interact with our newsletter emails (opens, clicks)

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on consent (Article 6(1)(a) UK GDPR) for all processing activities:

You have the right to withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us at editor@thesaffabrief.com.

We do not sell your personal data. We share it only with the following processors, all under strict data processing agreements:

• Brevo (Sendinblue SA) - our email service provider, EU-hosted servers, GDPR-compliant. Processes your email address for newsletter delivery and manages double opt-in confirmation.
• Vercel Inc - our website hosting provider, US-based with Standard Contractual Clauses (SCCs) in place. Hosts the thesaffabrief.com website.
• PostHog Inc - our analytics provider, EU-hosted (Frankfurt). Collects anonymised, cookie-free usage data only.

Your email address is processed by Brevo on EU servers. Website hosting is provided by Vercel (US), with appropriate safeguards in place including Standard Contractual Clauses approved by the ICO. PostHog analytics data is processed in the EU (Frankfurt).

• Subscriber data (email address) - retained until you unsubscribe or request deletion
• Analytics data - retained per PostHog defaults (anonymised, typically 12 months)
• Email engagement data - retained by Brevo for the duration of your subscription

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access - to request a copy of the personal data we hold about you
• Right to rectification - to ask us to correct inaccurate or incomplete data
• Right to erasure - to request deletion of your data
• Right to restriction - to ask us to limit how we use your data
• Right to data portability - to receive your data in a structured, machine-readable format
• Right to object - to object to processing of your data
• Right to withdraw consent - to withdraw consent at any time by unsubscribing or contacting us

To exercise any of these rights, please contact us at editor@thesaffabrief.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

We do not use cookies on thesaffabrief.com. Our analytics provider, PostHog, operates in cookie-free mode. There are no tracking cookies, no advertising cookies, and no cookie consent banner is required.

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it. All data is transmitted over encrypted HTTPS connections. Our processors (Brevo, Vercel, PostHog) maintain industry-standard security certifications.

We may update this policy from time to time. The version number and date at the top of this page will reflect any changes.

For any questions about this Privacy Policy or to exercise your data rights, please contact us: