Privacy Policy

GlobalCostData.com — Last updated: 28 April 2026 — Applies to EU/EEA users under GDPR (Regulation (EU) 2016/679)

1. Who We Are (Data Controller)

GlobalCostData.com is operated as an independent editorial platform. The data controller for the purposes of the GDPR is:

Henri Bousquet
Toulouse, France
Email: contact@globalcostdata.com

This website is a static informational site. It does not maintain its own user account system or proprietary database of registered users.

2. Data We Collect

We collect only the minimum data necessary to operate this service:

Category	Data collected	Source
Server logs	IP address (anonymised after 30 days), browser user-agent, page URL, referrer, HTTP status code, timestamp	Hosting provider (Namecheap) — automatic
Lead capture form	Email address submitted voluntarily to receive the free Expat Budget Calculator guide	User-submitted via the newsletter form on country pages
Analytics	See section 3 below	Third-party tool (if active — currently none)

We do not collect: names, postal addresses, payment data, government identification numbers, location data beyond country level, or sensitive personal data within the meaning of Art. 9 GDPR.

3. Analytics & Cookies

3.1 Current state

At the time of writing, this website does not deploy any third-party tracking or advertising cookies. No Google Analytics, Facebook Pixel, or similar tracking scripts are currently active. If this changes, this policy will be updated and a cookie consent banner will be displayed before any non-essential cookie is set, in accordance with Art. 7 GDPR and the ePrivacy Directive (2002/58/EC).

3.2 Strictly necessary cookies

The site may set session-scoped technical cookies essential to page delivery and security (e.g. Cloudflare bot-management token __cf_bm). These do not require consent under Art. 5(3) ePrivacy Directive as they are strictly necessary for a service explicitly requested by the user.

3.3 Future analytics deployment

If we introduce an analytics solution, we will favour privacy-preserving, cookieless tools (e.g. Plausible Analytics). Should any tool require consent, a clearly dismissible banner will appear on first visit, consent will be timestamped and logged, and refusal will be as easy as acceptance.

4. Legal Basis for Processing

Processing activity	Legal basis (GDPR Art.)
Server log data (IP address, user-agent, URL)	Art. 6(1)(f) — Legitimate interest (security monitoring, abuse prevention, uptime)
Email address from lead-capture form	Art. 6(1)(a) — Consent (freely given, specific, informed, unambiguous tick or submission action)
Analytics cookies (if deployed in future)	Art. 6(1)(a) — Consent via banner, obtained before any cookie is placed

5. Data Retention

• Server logs: retained for 30 days by the hosting provider for security and debugging, then automatically purged.
• Email addresses: retained until the subscriber unsubscribes or requests deletion. No email is retained beyond 3 years of inactivity without re-confirmation of consent.
• Analytics data: if collected, aggregated data retained up to 24 months; no individual-level event records retained beyond 12 months.

6. Data Sharing & Third-Party Transfers

We do not sell personal data. Data may be processed by the following sub-processors under appropriate contractual safeguards:

Sub-processor	Purpose	Transfer basis
Namecheap Inc. (US)	Web hosting and server log retention	Standard Contractual Clauses (SCCs)
Cloudflare Inc. (US)	DDoS protection, CDN, TLS termination	SCCs + Cloudflare DPA
Email delivery provider (if active)	Delivering the Expat Budget Calculator guide to subscribers	DPA in place; SCCs for non-EU processors

No personal data is transferred to countries outside the EEA without an adequate transfer mechanism (SCCs, adequacy decision, or Binding Corporate Rules) per Chapter V GDPR.

7. Your Rights Under GDPR

If you are located in the EU/EEA, you hold the following rights under Regulation (EU) 2016/679:

• Right of access (Art. 15) — obtain confirmation of whether we process your data and receive a copy.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure / right to be forgotten (Art. 17) — request deletion of your personal data.
• Right to restriction of processing (Art. 18) — limit how we use your data pending a dispute.
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest or to direct marketing.
• Right to withdraw consent (Art. 7(3)) — withdraw at any time without affecting lawfulness of prior processing.

To exercise any right, contact us at contact@globalcostdata.com. We will respond within 30 calendar days per Art. 12 GDPR. Identity verification may be required before disclosure of personal data.

8. Children's Privacy

This website is not directed at children under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, contact us immediately and we will delete it without delay.

9. Changes to this Policy

We may update this Privacy Policy when our practices change or when required by applicable law. Material changes will be notified via a prominent notice on the homepage for at least 30 days prior to taking effect. The "Last updated" date at the top of this page reflects the current version in force.

10. Contact & Supervisory Authority Complaints

You have the right to lodge a complaint with your national data protection supervisory authority. For France (place of establishment): CNIL — Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, 75007 Paris — www.cnil.fr. For other EU member states, contact your local DPA.