Privacy policy.

Last updated: 5 August 2026

The short version

We collect one thing: the details you type into the form when you download a report. We use them to send you the report and, occasionally, to tell you when new research is published. We do not sell them, we do not share them for advertising, and we do not use tracking cookies. You can ask us to delete everything at any time and we will.

Who is responsible

Trustwashing.com is an independent public-interest initiative operated by Emir Ramic, who is the data controller for the purposes of the General Data Protection Regulation (EU) 2016/679.

What we collect, and why

When you register to download a report

The form asks for your name, email address, whether you are reading as a brand or as a consumer, and optionally your company, role and country. We also record the date and time of the registration.

• Why: to give you access to the report you asked for, and to understand in general terms who the research reaches.
• Legal basis: performance of a contract under Article 6(1)(b), since you asked us to send you something and we cannot do that without an email address. The optional fields rest on legitimate interests under Article 6(1)(f), namely understanding the audience for public-interest research. Leaving them blank has no effect on your access.
• Kept for: up to 24 months from your last interaction, then deleted.

When you ask for a new link because yours expired

Report links stay valid for 30 minutes. If yours expires and you request a fresh one, we generate a six digit code, store a one-way cryptographic hash of it alongside your email address, and email you the code.

• Why: to confirm that the person asking is the person who registered.
• Legal basis: performance of a contract under Article 6(1)(b).
• Kept for: 24 hours, then deleted automatically. We never store the code itself, only its hash.

When you simply read the site

We use Vercel Web Analytics and Speed Insights, which count page views and measure loading performance. These are cookieless and aggregate: they do not build a profile of you, do not follow you to other sites, and do not store your full IP address. Our hosting provider also keeps standard server logs for security and troubleshooting.

• Legal basis: legitimate interests under Article 6(1)(f), namely knowing whether the research is being read and keeping the site working.
• Kept for: aggregate statistics only, with no identification of individual visitors.

Contact form

When you contact us through the contact form, we process your name, email address, selected contact reason and message for the purpose of receiving and responding to your enquiry. The legal basis is Article 6(1)(a) GDPR where you provide consent and, where applicable, Article 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

Messages are delivered using Resend. The information is retained only for as long as necessary to respond to the enquiry and handle any related correspondence, unless a longer statutory retention period applies. Contact-form information is not used for advertising and is not added to a mailing list.

Cookies

This site sets no advertising cookies, no social media pixels and no cross-site trackers. That is why you are not being asked to dismiss a consent banner. Your browser may store small technical items needed for the page to function, and our analytics operates without cookies entirely.

Fonts and assets. All typefaces and images are served from this site's own domain. No fonts, scripts or images are loaded from third-party servers, so viewing a page does not disclose your IP address to any outside company.

Who else touches your data

We use a small number of service providers, each handling data only on our instructions:

• Supabase stores the registration records and the report files. Data is held in the European Union.
• Resend sends the access code emails. Sending is handled in the EU region.
• Vercel hosts the website and provides the cookieless analytics.

Some of these companies are established in the United States. Where personal data is transferred outside the European Economic Area, it is protected by Standard Contractual Clauses approved by the European Commission, and by their certification under the EU-US Data Privacy Framework where applicable.

We do not sell personal data. We do not share it with advertisers, data brokers or partners for their own marketing. No employer, client or third party receives the registration list.

Automated decisions and AI

Your personal data is not used to train AI models, and no automated system makes decisions about you that produce legal or similarly significant effects. The news tracker on this site collects public headlines by machine and involves no personal data of visitors.

Your rights

Under the GDPR you can ask us to do any of the following, free of charge:

• Access a copy of the personal data we hold about you.
• Correct anything inaccurate or incomplete.
• Delete your data. We will remove your registration record entirely.
• Restrict or object to processing based on legitimate interests.
• Port your data, receiving it in a machine-readable format.
• Withdraw consent where processing rests on it, without affecting anything done beforehand.

Email privacy@trustwashing.com and we will respond within 30 days. We may ask you to confirm the email address you registered with, so that we do not disclose someone else's data to the wrong person.

If you believe we have handled your data improperly, you have the right to complain to a supervisory authority. In Germany that is the data protection authority of the relevant federal state; in other EU countries, your national authority. You may complain in the country where you live or work.

If you are in the United States or Canada

Much of our audience is in North America. We apply the standards described above to everyone, not only to EU residents, because maintaining two standards would be worse for you and harder for us. Residents of California, Canada and other jurisdictions with their own privacy laws can exercise the same rights at the same address. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act.

Children

This site is intended for adults and for professional audiences. We do not knowingly collect personal data from anyone under 16. If you believe a child has registered, tell us and we will delete the record.

Security

Registration records are held in a database table that cannot be read through the site's public key. Report files sit in a private storage bucket and are served only through time-limited signed links. Access codes are stored as one-way hashes, never as readable codes. Traffic is encrypted in transit. No system is perfect, but we have designed this one to hold as little as possible for as short a time as possible.

Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. Material changes affecting people already registered will be communicated by email.

This policy describes actual practice on this site and is provided for transparency. It is not legal advice, and it is not a substitute for review by a qualified data protection professional if you are adapting it for your own use.