Privacy Policy

This policy explains how humphreytheodore.com(the “Site”) collects, uses, stores, and protects personal information. The Site is an independent global news publication operated by Humphrey Theodore K. Ng'ambi (“we”, “our”, “us”) and is read internationally. We aim to apply the highest standard available across the data-protection regimes that may govern our readers, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), South Africa's Protection of Personal Information Act (POPIA), and other comparable laws.

1. Data controller and contact

The data controller (and, for POPIA purposes, the responsible party and Information Officer) is Humphrey Theodore K. Ng'ambi, contactable at ht@humphreytheodore.com. Where local law requires us to designate an EU/UK representative, we will appoint one and publish their contact details on this page.

2. Information we collect

We collect only what we need to operate the publication:

• Newsletter subscribers. Email address, and optionally a name, when you subscribe. We also store the timestamp and IP address of your subscription request as a record of consent and for spam prevention.
• Comment authors. If you sign in with Google to leave a comment, we receive your display name, profile picture URL, and a unique account identifier from Google. We do not receive your password.
• Contact and correspondence. When you email us, we keep your message and contact details to respond and maintain a record of the exchange.
• Analytics and technical data. Standard server logs (IP address, user agent, pages visited, referrer, timestamps) and aggregated analytics from Google Analytics 4(with IP anonymisation enabled). Analytics cookies are only set where permitted by your jurisdiction's consent rules.
• Anti-abuse data. Submissions to forms (newsletter, contact, comments) are protected by Google reCAPTCHA, which receives limited device and interaction signals to detect bots.

We do not knowingly collect special personal information (race, health, religion, political opinion, biometrics, etc.) and do not collect information from children under the age of 18.

3. How we use your information

• To send the newsletter you subscribed to.
• To display, moderate, and respond to comments.
• To respond to your enquiries and correction requests.
• To understand which articles resonate, in aggregate, so we can improve editorial coverage.
• To detect and prevent abuse, spam, fraud, and security incidents.
• To comply with our legal obligations.

4. Legal basis for processing

Where the GDPR, UK GDPR, LGPD, POPIA, or comparable laws apply, we rely on the following lawful bases:

• Consent— for newsletter subscription and non-essential cookies.
• Contract / performance of a service— for comments and account features.
• Legitimate interest— for security, anti-abuse, basic analytics, and operating the publication.
• Legal obligation— where retention or disclosure is required by law.

For readers in the United States, we do not sell personal information and we do not share it for cross-context behavioural advertising. California, Colorado, Connecticut, Virginia, and similar state-resident readers may exercise the rights described in section 9 below.

Where we process information for journalistic purposes, we rely on the journalism exemptions recognised by applicable laws (for example, Article 85 GDPR, the equivalent UK GDPR provisions, Article 4 LGPD, and section 7 of POPIA), balanced against the rights of data subjects and the public interest in freedom of expression.

5. Cookies

The Site uses a small number of cookies and similar technologies:

• Essential— authentication and security cookies (Firebase Authentication, reCAPTCHA).
• Analytics— Google Analytics, with IP anonymisation, to measure aggregate traffic.

You can clear or block cookies in your browser settings. Doing so may affect features such as commenting.

6. Sharing and processors

We do not sell your personal information. We share limited information with the following service providers (operators), each bound by their own privacy commitments:

• Google Cloud / Firebase— hosting, database (Firestore), authentication, and storage.
• Google Analytics— aggregated traffic analytics.
• Google reCAPTCHA— spam and abuse protection.
• Email delivery providers— to send the newsletter and transactional messages.

We may also disclose information where required by law, to enforce these terms, or to protect the rights, property, or safety of the Publisher or others.

7. International transfers

Because the Site and its readers are global, personal information may be processed in countries other than your own, including the United States, the European Union, the United Kingdom, and South Africa. Where applicable law requires it, we rely on lawful transfer mechanisms such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, and the contractual safeguards required by POPIA and the LGPD. Where a service provider participates in the EU–US and UK–US Data Privacy Frameworks, we rely on those frameworks as a transfer basis.

8. Retention

• Newsletter records: until you unsubscribe, plus a short period for proof of consent.
• Comments and account data: until you ask us to delete them or your account is removed.
• Server and analytics logs: typically up to 14 months in aggregated form; raw logs for shorter operational windows.
• Correspondence: for as long as needed to handle the matter and any reasonable follow-up.

9. Your rights

Depending on where you live, you may have the following rights in relation to the personal information we hold about you. We honour these rights for all readers, regardless of jurisdiction, where it is lawful and technically feasible to do so:

• access the personal information we hold about you;
• request correction or deletion of inaccurate or excessive information;
• object to or restrict processing based on legitimate interest;
• request data portability in a machine-readable format;
• withdraw consent at any time (for example, by unsubscribing);
• opt out of any sale or sharing of personal information for cross-context behavioural advertising (we do not engage in either, but the right is reaffirmed here for U.S. state residents); and
• not be subject to solely automated decisions producing legal or similarly significant effects.

You also have the right to lodge a complaint with a competent supervisory authority. Examples include the European Data Protection Board and EU national authorities, the UK Information Commissioner's Office (ico.org.uk), the California Privacy Protection Agency (cppa.ca.gov), the South African Information Regulator (inforegulator.org.za), Brazil's ANPD (gov.br/anpd), or your local data-protection authority.

To exercise any of these rights, contact ht@humphreytheodore.com. To unsubscribe immediately, visit /unsubscribe. We will not discriminate against you for exercising your rights, and we will respond within the timeframe prescribed by your applicable law (typically 30–45 days).

Note that journalism exemptions recognised in many jurisdictions (including the GDPR, UK GDPR, LGPD, and POPIA) may limit the application of certain rights to information processed for editorial purposes, balanced against the public interest in freedom of expression.

10. Security

We use industry-standard measures to safeguard personal information, including TLS encryption in transit, access controls on backend systems, and reCAPTCHA-based abuse protection. No system is perfectly secure; in the event of a personal-data breach, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law (for example, 72 hours under the GDPR and UK GDPR, and as soon as reasonably possible under POPIA section 22 and comparable regimes).

11. Changes

We may update this policy from time to time. Material changes will be flagged on this page with an updated “Last updated” date. Continued use of the Site after changes take effect constitutes acceptance of the revised policy.

12. Contact

Privacy questions, requests, or complaints: ht@humphreytheodore.com.

Publisher / Data Controller / Information Officer: Humphrey Theodore K. Ng'ambi.