In short

• We store your email address and, for paid plans, which plan you are on, plus a short label for the page or link you signed up from (for example “x” or “this-week”). Nothing else. Buttondown keeps the free list and sends the free weekly; paid emails are sent from [email protected] through Infomaniak in Switzerland.
• Sign-up uses double opt-in: nothing is sent until you confirm the link we email you.
• Every email has an unsubscribe link.
• Payments are handled by Stripe, through its Link service, as payment processor and merchant of record (reseller) under Stripe Managed Payments; we never see your card.
• This website sets no cookies of its own and uses no analytics or advertising trackers.

1. Controller

PPMB
Operator details: see Legal notice
[email protected]

2. What we process and why

Newsletter and alerts

Email address, your plan (Free, Pro or Studio), a source label for the page or link you signed up from (UTM values such as utm_source=reddit; they tell us which channels work and are never used to profile you), the confirmation of your opt-in, and the delivery status of our emails. The sign-up form sends your email address directly to Buttondown, which also checks the IP address of the request at sign-up to block spam and bots. Paid emails (the full weekly list, instant alerts, reminders and the Studio awards report) are sent one by one from [email protected] through Infomaniak’s mail servers to the address of your paid subscription and, on Studio, to the extra recipients you give us. We keep a list of addresses that unsubscribed or bounced (stored as a one-way hash) so we never write to them again. Purpose: sending the service you asked for. Legal basis: your consent (Art. 6(1)(a) GDPR) for the free digest and performance of a contract (Art. 6(1)(b) GDPR) for paid plans; under the nFADP, processing in line with this policy.

Emails to design studios

We may write a small number of individual emails to design studios that have won public design contracts. We take the studio’s name, country and past contract awards from official award notices (TED), and the studio’s generic business address (such as info@ or hello@) from the contact page or legal notice of its own website. We never use personal addresses. Each email says who we are, links to our legal notice and offers a one-line opt-out; anyone who opts out, or asks us to, goes on our suppression list (stored as a one-way hash) and is never written to again. We do not track opens or clicks. Purpose: telling studios about a service relevant to their business. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR), and only in countries whose rules allow it. You can object at any time by replying or writing to [email protected]; we delete the record within 30 days, keeping only the hashed suppression entry.

Payments

Paid plans are sold through Stripe Managed Payments, with Stripe (through its Link service) as merchant of record and reseller. When you subscribe, Stripe collects your name, billing address, payment details and tax information, calculates any VAT due for your country and sends you the receipt. Stripe tells us that you have an active subscription and the email address it belongs to, so we can send you your paid emails. Stripe processes this data under its own privacy policy (stripe.com/privacy).

Support emails

If you write to us, we use your message to answer it and keep it for 12 months after the conversation ends, unless we need it longer to meet a legal obligation.

Website

The site is static and hosted on Cloudflare Pages. Cloudflare processes technical data such as IP addresses to deliver the site and protect it from abuse. We do not run analytics. Your light or dark theme choice is stored only in your own browser (local storage) and is never sent to us.

3. Processors

• Buttondown (email delivery and subscriber list), USA.
• Stripe (payment processor, and merchant of record and reseller through Link under Stripe Managed Payments). For the purchase itself, Stripe (via Link) acts as merchant of record and as an independent controller under its own privacy policy.
• Cloudflare (website hosting), USA.
• Infomaniak (email for [email protected], sending of paid emails over SMTP, and domain), Switzerland.

Some processors are located outside Switzerland and the EEA. Transfers rely on adequacy decisions or on standard contractual clauses.

Open and click tracking: Buttondown can record whether a free weekly email was opened or a link in it was clicked; paid emails sent through Infomaniak carry no tracking. We use this, if at all, only as overall statistics to improve the service, never to profile individual subscribers. You can prevent it by blocking remote images in your mail app.

4. Retention

We keep your email address and plan while you are subscribed and delete them within 30 days after you unsubscribe, except where we must keep a record of your consent or a payment for legal reasons.

5. Your rights

You can ask for access to your data, correction, deletion, restriction, data portability, and object to processing. You can withdraw consent at any time with the unsubscribe link in any email, or by writing to [email protected]. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the supervisory authority in your EU country.

6. Data in the alerts themselves

Our emails contain public procurement data. We deliberately leave out the personal contact names and details that some notices contain.

7. Changes

We will post changes here and, if they are material, tell subscribers by email.