Who we are
Graphic Design Collective (GDC) is operated by Çağıl Aygen. GDC is a project and public brand, not a separate registered company.
Controller and privacy contact:
Çağıl Aygen
Graphic Design Collective / GDC
Via Cappuccio, 18, Milan, Italy
hello@graphicdesigncollective.com
Commercial enquiries are received at partnership@graphicdesigncollective.com. Editorial correspondence is received at editorial@graphicdesigncollective.com.
What this policy covers
This policy explains how GDC handles information when you visit the website, subscribe to the newsletter, send a commercial enquiry or submit an editorial proposal. These activities are separate. An enquiry or editorial submission does not subscribe you to the newsletter.
Website operation and security
When you use the site, our hosting and security systems receive technical information needed to deliver and protect it, such as your IP address, request time, requested URL, browser information and error or security records. We use this information to provide the site, prevent abuse, investigate faults and maintain backups. Our legal basis is our legitimate interest in operating and protecting GDC, and compliance with legal obligations where applicable.
Server backups are retained for up to 14 days for restoration. Exceptional incident or rollback copies are removed when their purpose ends, unless a legal obligation or claim requires longer retention.
Your website privacy choices
The “Privacy choices” control in the footer lets you manage two independent optional purposes. Both start off. Your choice is stored on your device for six calendar months and is not renewed merely because you revisit the site. You can change or withdraw it at any time.
- Website analytics: helps us understand how people use GDC so we can improve the site.
- Discovery insights: helps us understand how people discover GDC before subscribing.
The legal basis for these optional purposes is your consent. Rejecting either purpose does not prevent you from reading the site, using forms or subscribing to the newsletter. A later acceptance does not send activity that happened before your choice.
Browser storage
| Item | What it does | How long it lasts | Technical name |
|---|---|---|---|
| Privacy choices | Remembers the two independent optional choices, when they were saved and when they expire | Six calendar months from the choice | gdc_privacy_choices (localStorage) |
| Analytics preference | Tells supported website tools whether Website analytics is allowed | Up to the same six-calendar-month choice period; a session denial may be used before a choice | wp_consent_statistics (first-party cookie) |
| Google Analytics identifiers | Distinguishes consented browsers and sessions for optional Website analytics | Google’s default first-party analytics cookies can last up to two years; GDC removes known Google Analytics cookies when Website analytics is withdrawn | _ga and _ga_... (first-party cookies) |
| Discovery insights | Temporarily remembers allowed campaign details and the referring website before a newsletter signup | Current browser tab/session; removed on withdrawal or successful signup | gdc_newsletter_attribution (sessionStorage) |
| Article-depth deduplication | Avoids repeating article depth milestones on a same-tab reload | Current browser tab/session | gdc_reading_depth_{articleId} (sessionStorage) |
| Internal article source | Carries one recognised same-site article-card source to the destination article | Used once or removed after 30 minutes | gdc_internal_article_source (sessionStorage) |
The six-month choice period is not the retention period for provider or reporting datasets.
Website measurement
Limited aggregate article counters
GDC keeps daily aggregate totals showing how many eligible article visits reached 25%, 50%, 75% and 100% of the measured article body, and which recognised internal GDC page led to an article within a short same-tab window. These figures show depth reached, not that a person read, understood or uniquely viewed an article.
The request contains the article and depth milestone or recognised internal source. These aggregate tables do not contain a durable visitor identifier, email address, IP address or user agent. They are not combined with newsletter, sponsor or optional website-analytics profiles. Ordinary hosting logs still receive technical request information. GDC uses these limited first-party statistics for editorial layout and discovery analysis on the basis of its legitimate interest in improving the publication. Aggregate series are reviewed annually and removed when their editorial purpose ends; genuinely anonymous summaries may be kept longer.
Optional website analytics
If you allow Website analytics, GDC uses Burst Statistics Pro in the WordPress environment and Google Analytics 4, provided by Google, to understand and improve the site. These systems can process pages viewed, page paths and parameters, time spent, scroll activity, general traffic sources, search terms, device and browser information, approximate location and outbound link activity. Burst uses a rotating daily identifier derived from technical signals. Google Analytics uses first-party identifiers to distinguish consented browsers and sessions. Google states that it uses IP addresses at collection time for service security and approximate location, then discards them before the address is logged in Analytics.
Burst information is stored in GDC’s WordPress environment; Google Analytics information is processed by Google and available to authorised GDC administrators through the GDC Analytics property. The Website analytics choice controls both systems. Neither starts before permission. Withdrawing Website analytics stops future site-generated measurement and removes known Google Analytics first-party cookies from the browser; it cannot erase information already transmitted. The legal basis is your consent.
GDC reviews Burst raw and session records quarterly and deletes them when they are no longer needed for an active comparison, a documented incident or a specific legal need. The Google Analytics property currently retains event-level data associated with identifiers for two months and user-level data for 14 months, with the user period reset by new activity. Google notes that these controls do not limit its standard aggregated reports in the same way.
Newsletter
When you subscribe, GDC processes your email address and subscription status to create and manage the subscription, deliver the newsletter and standard Welcome email, prevent abuse and honour unsubscribe or deletion requests. GDC uses Beehiiv to manage and deliver the newsletter. The legal basis for delivery is your requested subscription and, where electronic-marketing law requires it, your consent.
If you separately allow Discovery insights on the GDC website, available campaign details and the referring website are sent with the signup request. If you do not allow it, the signup still works without those optional source details. This website choice does not control engagement measurement inside newsletter emails.
Newsletter engagement, including opens and clicks, is measured, and these engagement records can be linked to a subscriber profile. GDC has not verified a supported control on its current setup that lets someone remain subscribed while disabling only this measurement across every type of email. You can unsubscribe using the link in an email or contact GDC. Unsubscribing stops future newsletter delivery but does not by itself erase earlier engagement records. You may separately request access, object or ask for deletion as described below.
The newsletter provider is based in the United States. Its Data Protection Addendum incorporates the European Commission’s Standard Contractual Clauses for relevant international transfers. Subscriber records are kept while a subscription is active. After unsubscribe, invalid status or a verified deletion request, GDC keeps only the minimum suppression, consent or legal record needed to prevent unwanted re-mailing or meet an obligation, and removes remaining profile information when it is no longer needed.
Commercial enquiries
The Advertising enquiry form collects the name, organisation, role, email address, website, area of interest and message supplied by the sender. It routes enquiries to partnership@graphicdesigncollective.com through authenticated email. We use the details to respond, assess a possible collaboration, protect the form from abuse and keep necessary correspondence.
Our legal bases are steps requested before a possible agreement and our legitimate interest in responding to and managing commercial enquiries. Sending an enquiry does not subscribe you to the newsletter. Enquiries are kept while active. Closed enquiries are reviewed quarterly and deleted unless needed for a contract, accounting, a legal obligation or a documented claim.
Editorial proposals
GDC uses the information submitted with an editorial proposal to review the idea and get back to the sender. A proposal may include contact details, text, links, files and other information you choose to provide. Submitting a proposal does not subscribe you to the newsletter and is not, by itself, permission to publish supplied work.
Our legal bases are the steps you ask us to take and our legitimate interest in running GDC’s editorial process and protecting the form. Rejected or inactive proposals are deleted after the decision and necessary follow-up. Accepted or published material is retained only as needed for attribution, agreed permission, rights management and the editorial record.
Service providers
GDC uses external providers only where needed to run the publication and the relevant services:
- Website hosting and email infrastructure: Namecheap / EasyWP.
- Newsletter delivery: Beehiiv.
- Optional website analytics: Google Analytics 4 (Google), only after Website analytics permission.
- Editorial submissions: Tally.
- Form security: security and anti-abuse services used where presented.
Information is available only to people who need it for GDC’s operation and to providers used for the relevant purpose. Providers may use subprocessors under their terms. GDC does not sell subscriber, enquiry or proposal records to sponsors.
The editorial-submission provider is based in Belgium and states that form data is stored in Europe. Its service providers may process information where necessary for hosting, security and delivery under its documented safeguards. Google and some other providers may process information outside the European Economic Area. Google provides contractual data-processing terms and transfer safeguards for Analytics customers, including applicable Standard Contractual Clauses. Where required, GDC relies on the provider’s applicable contractual safeguards. Contact us for more information.
Your rights
Depending on the applicable law, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.
To exercise a right, contact hello@graphicdesigncollective.com. We may need enough information to verify the request without collecting unnecessary data. You may also complain to the competent data-protection authority, including the Italian Garante per la protezione dei dati personali.
Changes to this policy
We will update this policy when our services or data practices materially change.
Last updated: 31 October 2026