Privacy Notice

We have written this NewsLabs Personal Data Processing Notice (the Notice) to be as clear and easy to read as possible. If anything is unclear, the Rules of Interpretation section may help.

Our Terms of Use and our Terms of Service refer to this Notice as the Privacy Notice. Both names mean this document. The Terms of Use are published on the Website. The Terms of Service are the commercial terms we agree with each Customer, given to that Customer directly, and are not published here.

Some terms in this Notice begin with a capital letter or are used repeatedly. The Glossary section explains the key terms used throughout the Notice.

This Notice explains how we process Personal data in connection with:

1. The NewsLabs website at https://newslabs.io/ (the Website).
2. The NewsLabs application at https://app.newslabs.io/ (the Platform).

In this Notice, the Website and the Platform are together referred to as the Services.

This Notice applies to You if You are a natural person and a Data subject under Applicable laws. It applies whether You visit the Website as a member of the public, contact us through it, subscribe to our newsletter, or use the Platform as an authorised user of one of our Customers.

By using the Services, You confirm that You are at least 16 years old. The Services are intended for professional use by newsrooms, journalists and editors. They are not directed at children, and we do not knowingly collect Personal data from anyone under 16.

This Notice does not apply to:

1. Editorial content that our Customers and their authorised users create, upload or generate through the Platform. We process this content on behalf of the Customer as a Data Processor. The Editorial content and AI-assisted workflows section explains this in more detail and tells You whom to contact.
2. Third-party websites, platforms and services that You may access through the Services, including embedded or linked content from Facebook, X, Instagram, LinkedIn, TikTok, YouTube and Reddit. These providers act as separate controllers under their own privacy policies.

This Notice is for information only. It is not a contract and does not replace the Terms of Use, which govern Your use of the Services, or the agreement between us and our Customers.

Adria Analytics d.o.o., with its seat at Nova cesta 137, 10000 Zagreb, Croatia, personal identification number (OIB): 37753715742, operating under the brand name NewsLabs, is the Data Controller for the Personal data processed as described in this Notice, except where this section states otherwise.

Questions about this Notice and requests concerning Your rights can be sent to info@newslabs.io or info@adria-analytics.com, or by post to the address in the Contact section.

We act as a Data Processor, rather than a Data Controller, for Editorial content processed through the Platform. In that case, our Customer, the media organisation or other entity that holds the account, is the Data Controller and decides what Personal data is entered into the Platform and why. The Editorial content and AI-assisted workflows section explains this division of responsibilities and what it means for You.

If You access third-party websites or platforms through links or embedded content on the Services, those providers process Your Personal data as separate controllers, under their own privacy policies and on their own responsibility.

Our lead supervisory authority is the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia.

We collect Your Personal data:

1. Automatically, when You visit the Website or use the Platform.
2. Directly from You, when You book a demo, subscribe to our newsletter, log in, or use the features of the Platform.
3. From our Customer, when the Customer's administrator creates or invites Your Platform account. Platform accounts are created by administrators or by invitation; there is no public self-service registration.
4. From publicly accessible sources, when the Platform retrieves source material selected or subscribed to by an authorised user. This processing is described in the Editorial content and AI-assisted workflows section and is carried out on behalf of our Customer.

The categories of Personal data we process are set out below.

Editorial content is handled differently from every other category in this table, because we process it as a Data Processor. The Editorial content and AI-assisted workflows section explains how.

Our legitimate interest under Article 6(1)(f) GDPR, for:

1. Making the Website and the Platform available and keeping them working correctly, using technical and usage data and account data. Our interest is in operating the Services and providing them reliably to users authorised by our Customers.
2. Security, troubleshooting, abuse prevention and incident response, using account identifiers, IP addresses, device data, and server and error logs. Our interest is in protecting the Services, our Customers' data and our own infrastructure against unauthorised access, misuse and failure.
3. Providing and administering Platform accounts, roles and access, using account data. Our interest is in providing the Platform to the Customer that authorised Your account and managing access to it.
4. Responding to demo requests and managing business enquiries, using demo booking data. Our interest is in responding to an enquiry You made and managing any resulting business relationship.
5. Storing and reading the necessary cookies listed in Schedule 1, which support authentication, session integrity and the correct operation of the Services, and applying the preference values You set.
6. Understanding how the Services are used and where they fail, using technical and usage data and product analytics and diagnostics data. On the Website this uses Umami Cloud, which does not store anything on Your device. On the Platform this uses PostHog, which You can switch off at any time as described under Cookies and similar technologies, together with Vercel Web Analytics and Vercel Speed Insights, which count page views and measure loading performance and store nothing on Your device. Our interest is in maintaining and improving the Services. Where the law requires Your Consent for storing or reading information on Your device for this purpose, we rely on that Consent instead, as explained under Cookies and similar technologies.
7. Anonymising usage data and generated output so that it can be used to maintain, improve and develop the Services, as described under Editorial content and AI-assisted workflows. Our interest is in developing the Services on the basis of data that no longer identifies anyone.
8. Establishing, exercising or defending legal claims, using only the Personal data that is necessary for that purpose.

Before relying on our legitimate interest, we balance it against Your interests, rights and freedoms. You have the right to object to processing based on our legitimate interest, as explained under Your right to object.

Performance of a contract under Article 6(1)(b) GDPR, where You contract with us in Your own name rather than through an organisation and, where You approach us on Your own behalf, for steps taken at Your request before entering into a contract.

Your Consent under Article 6(1)(a) GDPR, together with Your consent to storing or accessing information on Your device where cookies or equivalent technologies are involved, for:

1. Sending You our blog newsletter, using Your newsletter data.
2. Sending You web push notifications about completed processing tasks, using Your notification data. This Consent is given through Your browser permission.
3. Storing and reading analytics cookies and similar values on Your device, where the law requires Consent for this. The Cookies and similar technologies section explains which analytics each of the Services uses and how You can switch analytics on the Platform off.

You may withdraw Your Consent at any time, as easily as You gave it. Withdrawal does not affect the lawfulness of processing carried out before Your Consent was withdrawn.

Compliance with a legal obligation under Article 6(1)(c) GDPR, where we must respond to a lawful request from a court or other competent authority, or where the law otherwise requires us to process or retain data.

Processing on behalf of our Customer under Article 28 GDPR, for Editorial content and AI-assisted editorial workflows. We are not the Data Controller for this processing. The Customer determines the purposes and legal basis. The Editorial content and AI-assisted workflows section explains this in more detail.

You are under no statutory obligation to provide us with Your Personal data. Whether You need to provide it, and what happens if You do not, depends on what You want to do.

We process the Personal data described above for the following purposes:

1. Providing the Website and the Platform and making their features available to You.
2. Creating, administering and securing Platform accounts, roles and permissions.
3. Keeping the Services secure by detecting, investigating and responding to security incidents, abuse and technical faults.
4. Responding to Your demo requests, enquiries and complaints. To respond, we need information such as Your name and email address so that we can contact You.
5. Sending You our blog newsletter, if You have subscribed to it.
6. Sending You web push notifications about background processing tasks You have requested, if You have enabled them.
7. Understanding how the Services are used so that we can maintain, improve and develop them.
8. Providing editorial and AI-assisted workflows to our Customers in the capacity described under Editorial content and AI-assisted workflows.
9. Complying with our legal obligations and establishing, exercising or defending legal claims.
10. Other purposes, but only with Your Consent.

The Platform is a professional tool used by our clients. It involves two types of processing, which are handled differently:

1. Your account and Your use of the Platform. We decide what account data is needed, how access is secured, how long logs are kept, and what analytics we run. For this processing, we are the Data Controller, and the parts of this Notice from how we collect Your Personal data to why we process Your Personal data, and from whether we share Your Personal data to how to exercise Your rights, apply.
2. What You put into the Platform. Topics, instructions, drafts, uploaded files, media, transcripts and retrieved source material are Editorial content. Our Customer decides what is uploaded, why it is uploaded, and what happens to it. For this processing, the Customer is the Data Controller and we act as a Data Processor on its documented instructions, under a data processing agreement concluded pursuant to Article 28 GDPR.

If You are an authorised user of a Customer, the Customer, not us, is responsible for the Editorial content You handle. If You are an individual who appears in Editorial content, You should address Your request to the newsroom or other organisation that processes the content. If You send such a request to us, we will pass it to the responsible Customer without undue delay and assist that Customer in responding, as required by Article 28(3)(e) GDPR.

The Platform uses third-party artificial intelligence services to support editorial work, including drafting, analysis, research and transcription. Depending on the workflow, prompts, Editorial content, source text, files, media and generated output are sent to the following providers, which act as our sub-processors for that content:

1. OpenAI Ireland Limited (Ireland).
2. Google Cloud EMEA Limited and Google LLC (Ireland and the United States), for Gemini and Vertex AI.
3. Anthropic Ireland, Limited (Ireland), for Claude.
4. SpaceXAI LLC, formerly X.AI LLC (United States), for Grok.
5. Mistral AI SAS (France), for text extraction from uploaded documents.
6. Speechmatics Limited (United Kingdom), for audio and video transcription.
7. Amazon Web Services EMEA SARL (Luxembourg), for audio and video transcription through Amazon Transcribe.

For this processing:

1. No Personal data is used to train the providers' models.
2. We may use aggregated or anonymised usage data and anonymised generated output to maintain, improve and develop the Services, such as by simplifying a workflow or refining the instructions we give to the models. Anonymised data no longer relates to an identifiable person and is not Personal data. The anonymisation step itself is based on our legitimate interest, as explained under Legal bases for processing Your Personal data. We do not use identifiable Editorial content or other identifiable Personal data for this purpose.
3. Nothing is published automatically. Journalists control the source material and context, review and approve all inputs and outputs, and verify their suitability before anything is published.
4. There is no automated decision-making within the meaning of Article 22(1) GDPR. No decision that produces legal effects concerning You, or similarly significantly affects You, is made by automated means through the Platform.
5. Mistral, Speechmatics and Amazon Transcribe process the data within the European Union. OpenAI, Google (Gemini and Vertex AI), Anthropic (Claude) and xAI (Grok) process it outside the EEA under Standard Contractual Clauses, as explained under Transfers outside the EEA.
6. Schedule 2 explains what each provider does, where it processes the data, and which transfer safeguard applies.

When an authorised user selects or subscribes to a source, the Platform retrieves publicly available content from third-party websites and platforms, including Instagram, Facebook, LinkedIn, X, TikTok, Reddit, YouTube, online news websites, RSS feeds and web-search results. Depending on the source, this content may include author or profile names, usernames, profile URLs and images, article or post content, comments, media, and information about individuals mentioned in the content.

We retrieve this material on the Customer's instruction and as part of the service we provide to it. The Customer is the Data Controller for that content and its use in editorial work, including the application of any rules on processing for journalistic purposes under Article 85 GDPR and Croatian implementing law.

Editorial content may contain special categories of Personal data within the meaning of Article 9 GDPR and information relating to criminal offences within the meaning of Article 10 GDPR, because editorial work may cover these subjects.

We do not collect this data for our own purposes, use it to profile or identify anyone, or analyse it beyond carrying out the workflow run by the authorised user.

The Customer controls the source material and reviews all inputs and outputs.

We share Personal data only when necessary and on a need-to-know basis with:

1. Hosting and infrastructure providers: Amazon Web Services and Vercel, which host the Services, database, storage, logs and backups.
2. Analytics providers: Umami Cloud for the Website, and PostHog and Vercel for the Platform.
3. Customer relationship and marketing providers: HubSpot, for demo scheduling, the CRM record of Your enquiry, and delivery of the blog newsletter.
4. Email providers: Zoho Mail, for transactional and outbound email.
5. Artificial intelligence and transcription providers listed in the Editorial content and AI-assisted workflows section, for Editorial content only.
6. Professional advisers, where necessary for legal advice and only to the extent required.
7. Competent authorities and courts, if we are ordered by a court or other competent authority, or otherwise required by law, to disclose the data.

Schedule 2 identifies each provider, the legal entity behind it, what it does, and where it processes the data.

Providers that process Personal data on our behalf act as our Data Processors.

They process the data only on our documented instructions, under written data processing terms concluded in accordance with Article 28 GDPR, and are bound by confidentiality. A copy of the terms we have concluded with a given provider is available on request at info@newslabs.io.

We do not sell Your Personal data.

We do not use Your Personal data for advertising, retargeting or behavioural profiling, and we do not use advertising or retargeting platforms on the Services.

We do not use advertising, retargeting or profiling cookies. The Cookies and similar technologies section describes the cookies we do use.

We do not train artificial intelligence models on identifiable Editorial content or on any other identifiable Personal data. The Editorial content and AI-assisted workflows section describes the anonymised data we may use to improve the Services.

We do not allow the artificial intelligence providers listed in the Editorial content and AI-assisted workflows section to train their models on the data sent to them.

We do not make decisions about You by automated means alone within the meaning of Article 22(1) GDPR.

We host and store data within the European Economic Area. Some of our providers, however, process Personal data outside the EEA. Where this happens, the transfer takes place under Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) GDPR, as follows:

We keep Personal data only for as long as needed for the purpose for which it was collected, unless a longer period is required by law or for the establishment, exercise or defence of legal claims. The periods and criteria we apply are set out below.

We apply technical and organisational measures appropriate to the risk, including:

No security measure is absolute. The Risks when using the Services section explains what this means for You.

Sending data over the internet is never entirely risk-free, and we cannot guarantee the security of data while it is being transmitted to us. Once we receive it, we protect it using the measures described under how we protect Your Personal data.

You can also help reduce the risk:

1. Keep Your account credentials confidential and do not share Your account.
2. Use the Services on devices You control and log out on shared devices.
3. Be alert to phishing. We will never ask You for Your password by email.
4. Remember that content You open from third-party platforms embedded in or linked from the Services is governed by those providers' own terms and privacy policies.

If You believe Your account has been compromised, contact us immediately using the details in the Contact section.

You have the following rights in relation to Personal data for which we are the Data Controller:

Where we process Your Personal data on the basis of our legitimate interest, You have the right to object at any time on grounds relating to Your particular situation. If You object, we will stop processing unless we can demonstrate compelling legitimate grounds that override Your interests, rights and freedoms, or unless the processing is needed for legal claims.

Where Personal data is processed for direct marketing, You have the right to object at any time, and we will stop that processing without exception.

Send Your request to info@newslabs.io or info@adria-analytics.com, or by post to the address in the Contact section.

We will respond without undue delay and, in any event, within one month of receiving Your request. This period may be extended by two further months if the request is complex or we receive a number of requests. If we extend the period, we will inform You within one month and explain why.

If we have reasonable doubts about the identity of the person making the request, we may ask for additional information needed to confirm Your identity.

Exercising Your rights is free of charge. If a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act on it, and we will explain why.

Automated decision-making. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning You or similarly significantly affect You within the meaning of Article 22(1) GDPR.

Requests concerning Editorial content. Where we act as a Data Processor, as described under Editorial content and AI-assisted workflows, we cannot decide on Your request ourselves. We will forward it to the responsible Customer without undue delay and assist that Customer in responding.

You can reach us about this Notice, about Your Personal data or about Your rights in any of the following ways.

We have not appointed a Data Protection Officer. Privacy enquiries are handled by our management, at the addresses above.

Headings and section titles are included for convenience only and do not affect the meaning of this Notice.

A reference to a section means a section of this Notice, and a reference to a Schedule means a Schedule to this Notice. The Schedules form an integral part of the Notice.

Words in the singular include the plural and vice versa.

A reference to a regulation, law or other legal act includes any later amendments and any act that replaces it.

The words “including”, “in particular” and “for example” introduce examples and do not limit the meaning of the words that come before them.

Where a period is stated in days or months, it starts on the day after the event that triggers it.

A reference to a third-party product or service means that product or service as provided by the legal entity identified in Schedule 2.