Privacy policy
We collect as little personal data as possible, and never sell it. This page explains what we hold, why, and your rights under the GDPR.
Last updated: 6 July 2026
ExtremeScan collects as little personal data as possible. We do not sell personal data, use advertising trackers, or build behavioural profiles for commercial advertising.
This Privacy Policy explains what personal data we collect through this website, why we collect it, who processes it for us, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR).
1. Who we are
ExtremeScan is an independent, unincorporated research group — researchers, economists, academics, analysts and practitioners — and not a registered company or association. We operate without a legal entity or registered address by deliberate design: it protects our network and guarantees the anonymity of vulnerable contributors and research participants.
Responsibility for personal data processed through this website rests with the administrators of ExtremeScan — a distributed team residing in the European Union — who act jointly as the data controller within the meaning of the GDPR. Although we have no formal establishment, we apply the principles and requirements of the GDPR and other applicable EU regulations to all processing described in this policy.
“ExtremeScan”, “we”, “us” and “our” refer to this research group and its administrators.
The single point of contact for all privacy matters is privacy@extremescan.eu. We have not appointed a Data Protection Officer.
2. What personal data we collect
2.1 Newsletter subscription
If you subscribe to receive new ExtremeScan analysis by email, we collect:
- your email address;
- your preferred language, if selected or inferred from the page used to subscribe;
- subscription status, including confirmation, unsubscribe and suppression records;
- basic email-delivery metadata needed to send and manage the newsletter.
We use this data to send you ExtremeScan publications and updates. Subscription is double opt-in: nothing is stored until you confirm via the link we email you.
Legal basis: your consent.
You can unsubscribe at any time using the unsubscribe link in any newsletter or by contacting us at privacy@extremescan.eu.
2.2 Website security and hosting logs
When you visit the website, our hosting and security providers may process technical information such as:
- IP address;
- request time;
- requested URL;
- browser and device information;
- security events and error logs.
We use this information to keep the website available, secure and reliable.
Legal basis: our legitimate interest in operating and protecting the website.
2.3 Analytics
We use Google Analytics only if you accept analytics cookies in the cookie banner.
If accepted, Google Analytics may process information such as:
- pages visited;
- approximate location derived from IP address;
- browser and device information;
- interactions with the website;
- cookie identifiers used for analytics.
We use analytics to understand how the website is used and to improve the structure, accessibility and relevance of our publications.
Legal basis: your consent.
You can refuse analytics cookies or withdraw your consent at any time by changing your cookie choice or clearing cookies in your browser.
2.4 Contact by email
If you contact us by email, we process your email address and the contents of your message in order to respond.
Legal basis: our legitimate interest in responding to enquiries, unless the communication relates to a contract or pre-contractual request, in which case the legal basis may be performance of a contract or steps prior to entering into a contract.
3. Research data and published datasets
ExtremeScan publishes public-opinion research, articles, methodology notes and anonymised datasets.
This website is not used to collect survey responses directly from visitors. Where we publish open datasets, we aim to publish them in anonymised or aggregated form so that individuals are not identified.
If a publication links to external open-data repositories, those repositories may have their own terms and privacy practices.
4. Who processes personal data for us
We use a small number of service providers that process personal data on our behalf or in connection with the website:
- Cloudflare — hosting, CDN, security, serverless/database infrastructure and technical logs;
- Resend — newsletter and transactional email delivery;
- Google Analytics — website analytics, only after consent;
- GitHub — hosting of public open-data materials, where applicable.
These providers may process data in the EU/EEA, the United States or other locations. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, Data Processing Addenda, and, where applicable, recognised transfer frameworks.
5. How long we keep personal data
We keep personal data only for as long as needed for the purposes described above.
- Newsletter subscription data is kept until you unsubscribe or ask us to delete it, subject to maintaining minimal suppression records so that we do not email you again by mistake.
- Hosting and security logs are kept for a limited period by our hosting/security providers and then deleted or aggregated according to their operational retention settings.
- Google Analytics data is retained according to the configured Google Analytics retention setting.
- Email correspondence is kept for as long as reasonably necessary to respond to the enquiry and maintain appropriate records.
6. Cookies
We use essential/functional cookies to operate the website and remember your language and consent choices.
Analytics cookies are used only if you accept them.
For more information, see our Cookie Policy.
7. Your rights
Depending on your location and the applicable law, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate personal data;
- ask us to delete your personal data;
- restrict processing;
- object to processing based on legitimate interests;
- receive a copy of your data in a portable format;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with a supervisory authority.
To exercise your rights, email privacy@extremescan.eu.
We may need to verify your identity before responding to certain requests.
8. Supervisory authority
You have the right to lodge a complaint with a data protection authority — in particular the supervisory authority of the EU/EEA country where you live or work, or where you believe an infringement of the GDPR occurred.
Because ExtremeScan has no single country of establishment, we do not designate one lead authority; the authority of your habitual residence is the natural first port of call. We will cooperate with any competent supervisory authority that contacts us.
9. Children
This website is intended for a general audience interested in public-opinion research. It is not directed at children, and we do not knowingly collect personal data from children through this website.
10. Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be published on this page with a new “Last updated” date.