Privacy Policy — The Valuation Framework

Last updated: 12-01-2026

Publication: The Valuation Framework (“TVF”)

Data Controller: The Valuation Framework, published by a natural person (the “Publisher”).

Contact (privacy/DSAR): TheValuationFramework@outlook.com

This Privacy Policy explains how we process personal data when you subscribe to or use our free newsletter and content via Substack (the “Service”).

1. What data do we process?

Depending on how you use the Service, we may process the following categories of personal data:

1. Account and contact data

• Email address (required for the newsletter)

• Name/alias (optional; depending on your Substack profile settings)

2. Subscription and interaction data

• Subscription status, (un)subscribe date

• Interactions such as opens/clicks (to the extent made available by Substack)

• Replies/comments (if you post them), and any community interactions within Substack

3. Communications with us

• The content of emails you send us (support/questions) and our replies

4. Technical data

• Limited log and device/browser information processed by Substack or other service providers to provide the Service, secure it, and prevent abuse (we typically only see limited metadata or reports)

We do not request special categories of personal data (such as health data) and ask that you do not share such information with us.

2. What do we use your data for?

We process personal data only for:

A. Delivering the newsletter and free content

• Subscribing you, sending emails, and managing (un)subscriptions

B. Support and communication

• Responding to questions, support requests, and complaints

C. Security and abuse prevention

• Securing the Service, preventing spam/fraud/abuse, and protecting our systems and community

D. Limited improvement of the Service

• Understanding at a high level what works (e.g., which topics are read), insofar as we receive such insights from Substack and this remains proportionate

3. Legal bases (why do we process your data?)

We process your personal data on the basis of:

1. Performance of a contract / at your request

• When you subscribe, we process your email address to deliver the newsletter

2. Legitimate interests

• For security, abuse prevention, and limited operational analytics/quality improvement (we always balance these interests against your privacy)

3. Consent (only where required)

• In particular for non-essential cookies/trackers on any separate website we may operate, or where law explicitly requires consent

4. With whom do we share data?

We do not sell your personal data. We share data only with parties necessary to deliver the Service.

Substack (platform service provider)

Our newsletter runs on Substack (hosting, email distribution, subscriber management). Substack processes personal data to provide the Service and may act as a processor for the Publisher and/or as a controller for certain of its own purposes (see Substack’s documentation).

Other recipients

We share data with other parties only when necessary, for example:

• IT/security service providers (only if we engage them)

• Legal obligations (e.g., upon request by competent authorities)

5. Transfers outside the EU/EEA

Substack and/or its sub-processors may process personal data outside the EU/EEA (for example, in the United States). Where applicable, appropriate safeguards are used, such as Standard Contractual Clauses and/or other mechanisms described in Substack’s contractual documentation.

6. Retention periods

We do not retain personal data longer than necessary for the purposes described in this Privacy Policy:

• Newsletter data (email + status): as long as you are subscribed. After you unsubscribe, we delete or anonymize data where reasonably possible using Substack’s tools, or limit processing to what is still technically necessary (e.g., maintaining suppression/opt-out preferences).

• Support/complaint emails: typically up to 24 months after resolution, unless a longer retention period is necessary for a specific dispute or legal obligation.

• Security logs/anti-abuse: according to Substack’s or relevant providers’ standard retention periods, insofar as we do not have direct control over them.

7. Cookies and similar technologies

On Substack

• Cookies/trackers are primarily managed by Substack in accordance with its own cookie and privacy policies.

On our own website/landing page (if applicable)

• Strictly necessary cookies may be required for basic functionality.

• For analytics/marketing cookies, we request consent where legally required.

8. Your rights (GDPR)

Subject to applicable conditions, you have the right to access, rectify, erase, restrict processing, object, and receive your data (data portability).

How to submit a request (DSAR)

Email TheValuationFramework@outlook.com from the email address you use to subscribe. We may request additional information to verify your identity (only when reasonably necessary). We generally respond within one month, subject to extension in complex cases as permitted under the GDPR.

Note: Some data and actions are handled through Substack (e.g., profile settings). As the service provider, Substack is expected to support the Publisher in fulfilling data subject rights requests.

9. Security

We take appropriate technical and organizational measures, such as:

• Restricting access to accounts/data on a “need-to-know” basis

• Using strong passwords and, where possible, two-factor authentication (2FA)

• Data minimization (we do not collect “extra” data outside Substack)

No security measure is 100% effective; we aim to apply appropriate safeguards given the nature and scope of processing.

10. Complaints

If you believe we are not handling your personal data properly, please contact us first at:

TheValuationFramework@outlook.com

You also have the right to lodge a complaint with the competent supervisory authority. In Belgium, this is the Belgian Data Protection Authority.

Gegevensbeschermingsautoriteit / Autorité de protection des données (APD/GBA).

11. Changes to this Privacy Policy

We may update this Privacy Policy. If we make material changes that significantly impact how we process data, we will announce this via the Service (e.g., through Substack) and update the “Last updated” date.