Cross-Border Magazine (CBM)

Version: April 2026 

1. Introduction

Cross-Border Magazine ("Cross-Border Magazine", "CBM", "we", "us" or "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store and otherwise process your personal data when you visit www.cross-border-magazine.com (the "Website"), download our magazine, subscribe to our newsletter, or contact us through the Website.

This policy has been updated to reflect the requirements of Regulation (EU) 2016/679 (the "GDPR") and the supervisory guidance issued by the European Data Protection Board (EDPB) up to and including the 2026 coordinated enforcement action on transparency obligations under Articles 12-14 GDPR. It also takes into account the European Commission's Digital Omnibus proposals of November 2025, which may further amend the GDPR; we will update this policy if and when those proposals enter into force.

The Website is not intended for children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

2. Data controller and contact details

The controller responsible for your personal data is:

• Legal entity: Cross-Border Magazine, a publication of Salesupply B.V.
• Registered address: Kerkenbos 1047, 6546 BB Nijmegen, the Netherlands
• Chamber of Commerce (KvK): 69807361
• Privacy contact (data privacy manager): [email protected]
• General contact: [email protected]

We have appointed a data privacy manager who oversees compliance with this privacy policy. If you have any questions, complaints or requests in relation to this policy or the processing of your personal data, please contact us using the details above.

3. Personal data we collect and why

The categories of personal data we process, the purposes for which we use them, and the legal basis under Article 6 GDPR on which we rely, are summarised in the table below.

Processing activity	Personal data	Purpose	Legal basis (Art. 6 GDPR)
Magazine download	Email address (mandatory); first name, company, country (optional, if requested in the form)	To deliver the magazine, send the requested issue and confirm the download. We may follow up once with a related issue or relevant content.	Performance of a contract / pre-contractual measures (Art. 6(1)(b)).
Newsletter subscription	Email address; subscription preferences; technical metadata (open/click events).	To send you our newsletter and related editorial content you have signed up for.	Consent (Art. 6(1)(a)). You can withdraw consent at any time via the unsubscribe link in every email.
Contact form / direct enquiries	Name, email address, company (if provided), the content of your message, and any attachments.	To respond to your question, request, partnership enquiry or complaint.	Performance of pre-contractual measures (Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)).
Website analytics	IP address (truncated where supported), device and browser information, referrer, pages viewed, time on page, approximate location.	To measure and improve Website performance, content quality and audience engagement, and to detect and prevent fraud or misuse.	Consent for non-essential analytics cookies (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). Legitimate interest (Art. 6(1)(f)) for strictly necessary technical logs.
Cookie consent management	Your cookie choices, timestamp, version of the consent banner.	To demonstrate compliance with consent requirements and to honour your preferences.	Legal obligation (Art. 6(1)(c)).
Security and fraud prevention	Server logs, IP address, request metadata.	To protect the Website and its users against attacks, abuse and unauthorised access.	Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where applicable.

We do not process special categories of personal data (e.g. health, religion, ethnic origin, sexual orientation, biometric or genetic data) and we do not process personal data relating to criminal convictions or offences. We do not engage in solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

4. How we collect your personal data

• Directly from you, when you fill in a form on the Website (for example to download the magazine, subscribe to the newsletter, or contact us), correspond with us by email, attend a webinar or interact with us at events.
• Automatically, when you interact with the Website, through cookies, server logs and similar technologies (see section 8 on cookies).
• From third parties, such as analytics providers (e.g. Google Analytics), event partners and publicly available business sources, where this is necessary and lawful.

5. Recipients and disclosures of your personal data

We share personal data only with the categories of recipients set out below, and only to the extent necessary for the purposes described in section 3:

• Group companies of Salesupply that provide IT, hosting, marketing and administrative support, under intra-group data processing arrangements.
• IT service providers and processors, including hosting providers, email service providers (e.g. for newsletters and download confirmations), CRM providers, analytics providers and cookie consent platforms. These parties act as processors and are bound by data processing agreements (Art. 28 GDPR).
• Professional advisers, such as lawyers, auditors and insurers, where reasonably necessary.
• Public authorities, regulators or law-enforcement bodies, where required by law or to defend our legal rights.
• A successor entity, in the context of a merger, acquisition, restructuring or sale of assets; in such a case the recipient will be required to honour this privacy policy.

We do not sell your personal data to third parties, and we do not share it with third parties for their own marketing purposes without your explicit prior consent.

6. International transfers

Some of our service providers are established outside the European Economic Area (EEA), including in the United States. When we transfer personal data outside the EEA, we ensure an adequate level of protection by relying on one of the transfer mechanisms recognised under Chapter V of the GDPR, in particular:

• European Commission adequacy decisions (such as the EU-US Data Privacy Framework for certified U.S. recipients);
• Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented where necessary with additional technical, contractual and organisational measures based on a transfer impact assessment;
• Other appropriate safeguards under Articles 46-49 GDPR.

You can request a copy of the safeguards in place by contacting us using the details in section 2.

7. Data retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting or reporting requirements. The retention periods we apply are, as a general rule:

• Magazine download data: up to 24 months from the last interaction, after which the email address is deleted or anonymised, unless you have separately subscribed to the newsletter.
• Newsletter data: until you unsubscribe, and a further 12 months thereafter for evidence of consent and to prevent re-subscription errors.
• Contact form / enquiry data: up to 24 months after our last contact, unless a longer period is required (e.g. for partner contracts or legal claims).
• Cookie consent records: 12 months, in line with the cookie banner re-prompt cycle.
• Server and security logs: a maximum of 12 months, unless a longer period is needed to investigate a security incident.
• Financial and tax-related records: 7 years, in accordance with Dutch fiscal law (Article 52 General State Taxes Act).

We may retain anonymised data, which can no longer be associated with you, for statistical and editorial purposes for an indefinite period.

8. Cookies and similar technologies

The Website uses cookies and similar technologies to function correctly, to remember your preferences and, with your consent, to measure how the Website is used and to improve our content.

Strictly necessary cookies (for example for session management, security and to remember your cookie choices) are placed without your consent, on the basis of Article 5(3) of the ePrivacy Directive.

Analytics, functional and marketing cookies, including Google Analytics and any social media or remarketing pixels, are placed only after you have given your specific, freely given, informed and unambiguous consent through our cookie banner. Refusing or withdrawing consent is as easy as giving it: you can do so at any time via the cookie settings link in the footer of the Website. The "Reject all" option in the banner is presented with equal prominence to the "Accept all" option, in line with EDPB guidance.

A detailed list of the cookies we use, their purpose, provider and retention period is available in our separate Cookie Policy at https://cross-border-magazine.com/cookie-policy/.

9. Data security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access, in line with Article 32 GDPR. These include encryption in transit (TLS), access controls based on the principle of least privilege, secure hosting in EU-located data centres where reasonably possible, logging and monitoring, regular back-ups, vendor due diligence, and staff awareness training.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Article 33 GDPR). Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay (Article 34 GDPR).

10. Your rights under the GDPR

Subject to the conditions and exceptions set out in the GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15): to obtain confirmation of whether we process your personal data, and if so, to receive a copy.
• Right to rectification (Art. 16): to have inaccurate or incomplete personal data corrected.
• Right to erasure / "right to be forgotten" (Art. 17): to have your personal data deleted in certain circumstances.
• Right to restrict processing (Art. 18): to ask us to limit how we use your data in certain situations.
• Right to data portability (Art. 20): to receive the personal data you provided to us, where processing is based on consent or contract and is carried out by automated means, in a structured, commonly used and machine-readable format.
• Right to object (Art. 21): to object, on grounds relating to your particular situation, to processing based on our legitimate interests; and to object at any time to processing of your personal data for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to solely automated decisions (Art. 22): we do not take such decisions concerning you, but you have the right to obtain human intervention, express your point of view and contest the decision should this ever change.

To exercise any of these rights, please contact us at [email protected]. We may need to verify your identity before fulfilling your request, in order to protect your data. We will respond to your request without undue delay and in any event within one month of receipt, although this period may be extended by a further two months where necessary, taking into account the complexity and number of requests, in which case we will inform you within one month of receipt.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for the controller is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), https://autoriteitpersoonsgegevens.nl. You may alternatively contact the supervisory authority of your usual place of residence or place of the alleged infringement.

11. Marketing communications

We will only send you marketing emails (such as our newsletter or related editorial offers) on the basis of your prior consent or, where permitted, on the basis of an existing customer relationship for similar products and services in line with Article 13(3) of the ePrivacy Directive ("soft opt-in") and Dutch implementing law.

Every marketing email contains a clearly visible unsubscribe link. You can also opt out at any time by contacting us at [email protected]. Opting out of marketing communications does not affect transactional communications, such as a confirmation that you have downloaded the magazine.

12. Third-party websites and services

The Website may contain links to third-party websites, plug-ins, advertisements and applications (for example to LinkedIn, X/Twitter, YouTube or partner websites). Clicking on these links or enabling these connections may allow third parties to collect or share data about you. We do not control these third-party websites and we are not responsible for their privacy or cookie practices. We encourage you to read the privacy policy of every website you visit.

13. Changes to this privacy policy

We keep this privacy policy under regular review. Any updates will be published on this page with an updated version date at the top. Where the changes are material, we will notify you by a notice on the Website or, where appropriate, by email. We encourage you to review this policy periodically.

14. How to contact us

If you have any questions about this privacy policy, our privacy practices, or you wish to exercise any of your rights, please contact us:

• Email: [email protected]
• Post: Cross-Border Magazine (Salesupply B.V.), Kerkenbos 1047, 6546 BB Nijmegen, the Netherlands