Effective Date: January 1, 2024 | Last Updated: January 1, 2026
This EU Privacy Notice ("EU Notice") applies to individuals located in the European Union ("EU"), the European Economic Area ("EEA"), and the United Kingdom ("UK"). It supplements our general Privacy Policy and is provided in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, for UK residents, the UK GDPR as incorporated into UK law.
1. Data Controller
For the purposes of the GDPR, the data controller for personal information processed through napachronicle.com is:
Napa Chronicle
Napa, CA 94559
editor@napachronicle.com
2. Personal Data We Process
We process the following categories of personal data about EU/EEA individuals:
- Technical data: IP addresses, browser type and version, operating system, referring URLs, device type
- Usage data: Pages visited, articles clicked, time on page, navigation patterns
- Cookie data: As detailed in our Cookie Policy
- Contact data: Name and email address submitted through our contact form (if applicable)
3. Legal Bases for Processing
We process your personal data under the following legal bases as set out in Article 6 of the GDPR:
- Legitimate interests (Art. 6(1)(f)): We process technical and usage data based on our legitimate interests in operating and improving the Site, preventing fraud, and ensuring security. We have balanced these interests against your rights and freedoms and concluded that our interests do not override your fundamental rights.
- Consent (Art. 6(1)(a)): Where we use non-essential cookies or tracking technologies, we rely on your consent, which you may withdraw at any time. See our Cookie Policy.
- Contract performance (Art. 6(1)(b)): When you contact us, we process your contact information to respond to your inquiry.
- Legal obligation (Art. 6(1)(c)): Where required by applicable law.
4. International Data Transfers
Napa Chronicle is based in the United States. When you access our Site from the EU/EEA, your personal data may be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.
Where we transfer personal data to the United States, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or the UK International Data Transfer Agreement (IDTA) for UK transfers, where applicable to our service providers.
5. Data Retention
We retain personal data only for as long as necessary for the purposes outlined in this notice:
- Server log files: up to 90 days
- Contact form submissions: up to 12 months
- Cookie data: as described in our Cookie Policy
After the applicable retention period, data is securely deleted or anonymized.
6. Your Rights Under the GDPR
As an EU/EEA resident, you have the following rights regarding your personal data:
Right of Access (Art. 15)
You have the right to obtain confirmation of whether we process personal data about you and, if so, to receive a copy of that data along with information about how it is processed.
Right to Rectification (Art. 16)
You have the right to request correction of inaccurate personal data we hold about you.
Right to Erasure / "Right to Be Forgotten" (Art. 17)
You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose it was collected, or where you withdraw consent and there is no other legal basis for processing.
Right to Restriction of Processing (Art. 18)
You have the right to request that we restrict processing of your personal data in certain circumstances (e.g., while the accuracy of data is being contested).
Right to Data Portability (Art. 20)
Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object (Art. 21)
You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your rights.
Right to Withdraw Consent
Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right to Lodge a Complaint
You have the right to lodge a complaint with your national data protection authority ("DPA") if you believe we have processed your personal data in a manner inconsistent with the GDPR. For a list of EU DPAs, visit edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO).
7. How to Exercise Your Rights
To exercise any of the above rights, please contact us at editor@napachronicle.com with "GDPR Data Request" in the subject line. We will respond within 30 days of receipt of a valid request. In complex cases, we may extend this period by a further two months, and we will notify you of any extension.
We may ask you to verify your identity before processing your request. We will not charge a fee for reasonable requests.
8. Automated Decision-Making
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.
9. Updates to This Notice
We may update this EU Notice to reflect changes in our practices or applicable law. Material changes will be notified on our Site. We recommend reviewing this notice periodically.
10. Contact
For GDPR inquiries or to exercise your rights:
editor@napachronicle.com
Napa Chronicle | Napa, CA 94559