Commitment

At NextGen Privacy, protecting your personal privacy, defending data autonomy, and safeguarding the digital rights of emerging generations is our primary institutional mission. As an independent digital publication and policy research initiative dedicated to auditing surveillance technologies and child data exploitation, we hold our own operations to the highest global standards of privacy by design and statutory compliance under the Children’s Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the ePrivacy Directive.

This Privacy Policy explains with complete transparency how we handle information when you visit our website (https://nextgenprivacy.org/), subscribe to our publications, interact with our research desks, or participate in our events. We practice strict data minimization, deploy zero behavioral tracking technologies, and never sell, rent, or commercialize your personal information.

Who Is Responsible

The data controller responsible for the processing of personal data on this platform is the designated legal publishing entity of NextGen Privacy, as identified on our Publisher and Legal Information page.

We have appointed an independent Data Protection Officer (DPO) to oversee our ongoing compliance with international data privacy laws. You may contact our DPO directly regarding any privacy inquiries or data subject rights requests via privacy@nextgenprivacy.org.

Scope

This Privacy Policy applies to all processing of personal data carried out through our website, mobile interfaces, email newsletters, reader surveys, event registrations, and administrative correspondence.

It also outlines the special statutory legal frameworks governing our processing of personal data for journalistic and investigative purposes under press freedom protections.

Personal Information

We process personal data only when strictly necessary to fulfill specific, documented purposes. Depending on your interactions with NextGen Privacy, this may include: Technical access logs (truncated IP address, browser user-agent, access timestamps); Contact details (name, email address, school or institutional role) when you subscribe to newsletters or submit research inquiries; Billing information when purchasing memberships (processed securely by PCI-DSS certified payment processors); and Professional biographical details for contributing authors.

Sources of Information

We collect personal data primarily directly from you when you provide it via web forms or email correspondence. In limited circumstances, our journalists collect personal data from publicly accessible registries, regulatory filings, corporate procurement databases, and official publications in the course of legitimate investigative reporting.

Purposes

We process your data exclusively for lawful purposes: Providing access to our journalistic reporting, research trackers, and website functionality; Delivering email newsletters and editorial alerts you requested; Processing digital membership transactions; Responding to correspondence, correction requests, and formal complaints; Ensuring platform cybersecurity and preventing malicious cyberattacks; and Fulfilling statutory legal, tax, and regulatory compliance obligations.

Lawful Basis

Our processing is grounded strictly upon recognized legal bases under applicable privacy statutes: Consent for optional newsletter subscriptions and non-essential cookies; Contractual Necessity for managing reader memberships and event registrations; Legal Obligation for statutory accounting, tax, and regulatory compliance; and Legitimate Interests for securing our IT infrastructure, preventing fraud, and defending legal claims, balanced against your fundamental rights.

Editorial and Journalistic Processing

Under applicable constitutional press freedom protections and statutory media exemptions (such as GDPR Article 85), the processing of personal data carried out exclusively for journalistic purposes and freedom of expression is subject to specialized exemptions from certain data subject provisions (such as the right to erasure of published historical reporting).

This exemption ensures that investigative journalism can hold powerful public and corporate figures accountable without facing prior restraint or censorship. However, our newsroom adheres strictly to our published Editorial Ethics and data minimization standards.

Sensitive Information

NextGen Privacy does not solicit or process sensitive categories of personal data—such as biometric data, health records, religious beliefs, or precise geolocation—from website readers. In our investigative journalism, sensitive data is processed only when strictly necessary and justified by an overwhelming public interest.

Children

Protecting children’s online privacy is our core institutional mission. Our digital platform is designed to be completely safe for users of all ages: we do not collect personal data from children under 13 without verified parental consent in accordance with COPPA, nor do we profile young users. We deploy zero behavioral advertising or tracking pixels that target youth.

Website Technical Data

When you access https://nextgenprivacy.org/, our web servers temporarily record technical server telemetry (including IP addresses, requesting URL, HTTP status codes, and user-agent strings). This data is processed under our legitimate interest to deliver web pages, ensure server load balancing, and defend against denial-of-service (DDoS) attacks. Raw IP logs are automatically truncated or deleted within 14 days.

Cookies and Similar Technologies

We adhere to strict privacy-by-design principles: we deploy only essential session cookies required for core website functionality and security. We do not deploy third-party advertising cookies, cross-site tracking scripts, or device fingerprinting. Full details are set forth in our Cookie Policy.

Correspondence

When you contact our newsroom or administrative desks via email, we process your contact information and message content solely to evaluate, investigate, and respond to your inquiry. Correspondence is retained in our secure communications archive.

Corrections, Complaints and Rights of Reply

Personal data submitted in connection with formal correction requests, editorial complaints, or rights of reply is processed to investigate the claim, verify evidence, and maintain institutional records. Such records are retained for seven years to support legal compliance and accountability.

Authors and Contributors

Personal information, contracts, and banking details of contributing authors and freelance journalists are processed for contract execution, payment administration, tax reporting, and byline attribution.

Newsletters

If you opt in to our email newsletters, we process your email address to deliver our editorial roundups. You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link present in every newsletter.

Commercial Enquiries

Inquiries regarding institutional sponsorships, display advertising, or research syndication are processed exclusively by our business division to negotiate and manage agreements.

Security and Accessibility Reports

Communications received via security@nextgenprivacy.org or accessibility@nextgenprivacy.org are processed to remediate technical vulnerabilities and accessibility barriers, and are retained until resolution.

Public Sources and Social Media

Our journalists may consult publicly available professional profiles to verify expert sources. We do not scrape social media profiles for automated profiling.

Sharing

NextGen Privacy never sells, leases, or trades personal data to third parties. We share data only with trusted technical service providers (such as hosting infrastructure and secure email gateways) operating under strict data processing agreements, or when required by binding court orders.

International Processing

Our primary hosting infrastructure is located in enterprise-grade data centers adhering to high security and privacy standards. If technical service providers process data internationally, we ensure appropriate legal safeguards are implemented, including Standard Contractual Clauses and encryption in transit and at rest.

Retention

Personal data is retained only for as long as necessary to fulfill the documented processing purpose or comply with statutory retention mandates. Server access logs are erased within 14 days.

Security and Incidents

We employ enterprise-grade technical and organizational security measures—including TLS 1.3 encryption, access controls, multi-factor authentication, and intrusion detection systems—to protect personal data against unauthorized access, loss, or alteration.

In the event of a security breach involving personal data, we will notify competent regulatory authorities and affected individuals in accordance with applicable statutory breach notification laws.

Rights

Under applicable privacy legislation (including GDPR, CCPA/CPRA, and state consumer laws), you possess fundamental data subject rights, including: Right to Access your data; Right to Rectification; Right to Deletion / Erasure; Right to Restrict Processing; Right to Data Portability; Right to Opt-Out of Sales/Sharing (we do not sell data); and the Right to Withdraw Consent at any time.

Exercising Rights

You may exercise your privacy rights free of charge by contacting our Data Protection Officer at privacy@nextgenprivacy.org. We respond to verified requests within thirty days, as required by law.

Deletion and Published Journalism

Please note that under established jurisprudence and press freedom statutes, rights of erasure do not apply to personal data legitimately published as part of lawful public-interest journalism, preserving historical archives and freedom of expression.

Direct Marketing and Automated Decisions

We do not engage in unsolicited direct marketing, telemarketing, or automated decision-making and profiling that produces legal effects concerning you.

External Links and Policy Changes

Our website contains hyperlinks to external legal registries and news sources. We are not responsible for the privacy practices of external websites. We review and update this Privacy Policy periodically, publishing changes with a revised effective date.

Contact and Complaints

For all privacy inquiries, or if you believe your data protection rights have been infringed, please contact our DPO: Data Protection Officer: privacy@nextgenprivacy.org
Legal Department: legal@nextgenprivacy.org
General Inquiries: contact@nextgenprivacy.org
You also have the statutory right to lodge a formal complaint with the competent privacy or data protection authority in your jurisdiction.