The guide
Privacy: EU Data Act Guide
How eudataact.net handles data from its provider request form and newsletter: what is collected, why, how long it is kept and your GDPR rights.
Summary
This privacy notice explains which personal data eudataact.net, the EU Data Act Guide, collects through its provider request form and its newsletter, why, how long it keeps them and how you can exercise your rights under the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
eudataact.net is an independent reference on the Data Act, Regulation (EU) 2023/2854, and reading its pages requires no account and no personal data. What the EU Data Act itself requires is explained on the home page.
This notice was last updated on 5 November 2026. Questions about it go to editorial@eudataact.net.
Who Runs This Website and How to Reach the Editorial Team
eudataact.net is published by the EU Data Act Guide Editorial Team, which decides what personal data the website collects and answers every privacy question sent to editorial@eudataact.net. This email address is the single channel for privacy questions and for requests to exercise your rights.
The website names no individual person and no company as its author, and every page carries the byline of the EU Data Act Guide Editorial Team. Writing to the editorial address therefore reaches the team responsible for the personal data described in this notice.
What Personal Data This Website Collects and Why
This website collects personal data only when you fill in one of its two forms: the provider request form and the newsletter sign-up. Browsing the pages needs no form, no account and no login. Each form collects only the fields described in the two sections below, and each form serves one purpose.
Requests Sent through the Provider Request Form
The provider request form collects what you describe about your Data Act need together with your contact details, so that the request can be passed on. The form asks for your role, the Member State or States concerned, the size band of your organisation, your timing, a free-text description, your email address and your company; depending on the page, it adds one field specific to the topic, such as the service model. Please keep the free-text description to your Data Act question and leave out special categories of personal data, which the request does not need.
The form states its purpose in one line: "Describe what you need and we pass your request to independent providers who work on the Data Act." Your request is used only to pass it on to those providers and to answer your questions about it. A request does not subscribe you to the newsletter.
Newsletter Sign-Up
The newsletter sign-up collects the email address you subscribe with, and we use it only to send the newsletter. You can unsubscribe at any time by writing to editorial@eudataact.net from the address you subscribed with. Once you unsubscribe, the address is no longer kept for the newsletter. Newsletter addresses are not passed to the independent providers who receive request form data.
How Long Form Data and Newsletter Addresses Are Kept
Request form data are kept for 24 months, and newsletter addresses are kept until you unsubscribe. After these periods the data are deleted. Table 1 lists each category of personal data with the form that collects it, its purpose, its recipients and the period for which it is kept.
| Data | Collected through | Purpose | Recipients | Kept for |
|---|---|---|---|---|
| Request details (role, Member State, size band, timing, description) and contact details (email address, company) | Provider request form | Passing the request to independent providers and answering questions about it | Independent providers who work on the Data Act; hosting and content delivery network provider | 24 months |
| Email address | Newsletter sign-up | Sending the newsletter | Hosting and content delivery network provider | Until you unsubscribe |
Table 1: Personal data collected by eudataact.net, as of 5 November 2026.
Who Receives the Data
Request form data go to independent providers who work on the Data Act, and both forms run on the infrastructure of a hosting and content delivery network provider. Providers receive a request only to respond to it. The form carries this disclosure: "Requests go to independent providers. Providers cannot buy a place on eudataact.net; see our editorial policy."
The hosting and content delivery network provider processes the data of both forms, and this notice names it by its category. How providers are kept out of the content is set out in our editorial policy.
No Analytics, Advertising or Tracking Vendors
eudataact.net uses no analytics service and no advertising vendor, so no profile of your reading is built or shared. The pages are the same for every reader and are not personalised, whether or not you have used one of the two forms.
Your Rights under the GDPR and How to Exercise Them
Under the GDPR, which has applied since 25 May 2018, you can ask us at editorial@eudataact.net for access to the personal data we hold about you and, where the conditions are met, for a copy you can take elsewhere. The right of access is set out in Article 15 of Regulation (EU) 2016/679.
The right to data portability under Article 20(1) GDPR covers personal data you provided to us where the processing is based on consent or on a contract and is carried out by automated means. Where technically feasible, you can have those data transmitted directly to another controller (Article 20(2) GDPR).
The GDPR gives you these further rights, each with its own condition:
- Rectification: inaccurate personal data are corrected without undue delay (Article 16).
- Erasure: personal data are deleted where one of the grounds in Article 17(1) applies.
- Restriction: processing is restricted where one of the grounds in Article 18(1) applies.
- Objection: you can object to processing based on Article 6(1)(e) or (f) (Article 21(1)) and to processing for direct marketing (Article 21(3)).
- Withdrawal of consent: where processing is based on your consent, you can withdraw it at any time, as easily as you gave it; the withdrawal does not affect processing before it (Article 7(3)).
- Complaint: you can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Article 77(1)).
Article 12(3) GDPR requires a controller to inform you of the action taken on your request without undue delay and in any event within one month of receipt, a period that can be extended by two further months where necessary.
Changes to This Privacy Notice
We update this notice when the forms, the recipients or the retention periods change, and the date at the top shows the latest version. The current version is dated 5 November 2026.
What This Privacy Notice Does Not Cover
This notice covers only the personal data that eudataact.net itself collects; it does not explain how the Data Act treats personal data in connected products or services. Under Article 1(5) of Regulation (EU) 2023/2854, Union or national law on the protection of personal data or privacy prevails in a conflict, and how the two laws fit together is explained in the Data Act vs the GDPR.