Privacy Policy

Last reviewed: 28 May 2026.

Written and maintained by Kestutis Balciunas, operator of Financial Expert Class, with 11+ years of self-directed ETF and dividend investing experience as an EU retail investor. Not a regulated financial adviser. See About Me and Editorial Process.

This Privacy Policy explains how Aurum Digital Marketing LTD (trading as Financial Expert Class) collects, uses, stores, shares and protects your personal data when you visit https://financialexpertclass.com/ or interact with our paid newsletter at https://getdividends.net/. We have written this in plain English, but it is still legally complete. It covers the UK GDPR, the UK Data Protection Act 2018 and the EU GDPR (Regulation (EU) 2016/679).

Important note on financial content. Financial Expert Class publishes educational material about ETFs, dividend investing and personal finance from a European retail investor’s perspective. Nothing on this site is personalised financial advice. We are not authorised by the FCA (UK), CySEC (Cyprus), BaFin (Germany), KNF (Poland) or any other regulator to provide regulated advice. Please read our Affiliate Disclosure, Editorial Process and Terms and Conditions, and consult a licensed adviser in your jurisdiction before making investment decisions.

1. Summary (in plain English)

One-line summary: We are Aurum Digital Marketing LTD, a UK company, and this policy explains exactly what data we collect from you, why, what we do with it, and your rights to control it under UK GDPR and EU GDPR.

If you only read one section, read this one. In short:

• When you read an article, Google Analytics 4 (via Google Site Kit) records a shortened IP address, your device type, the pages you view, and the link that brought you in. This only happens if you accept analytics cookies in our consent banner.
• If you subscribe to the free newsletter, post a comment, or send us a message via the contact form, we store the name and email address you give us so we can reply or deliver the emails you asked for.
• If you subscribe to the paid Substack getdividends.net, Substack and Stripe handle your payment and account; we only see the subscriber list Substack shows us.
• If you click an affiliate link to a broker (Freedom24, Interactive Brokers, XTB, Nexo or Trade Republic), the broker — not us — collects whatever data you give them when you sign up. We may receive a notification that someone referred from our site signed up, without your personal identifiers.
• We do not sell your data. We do not use it for automated decision-making or profiling. You can unsubscribe, request access, deletion or correction at any time by emailing [email protected].

2. Who We Are and Who Controls Your Data

One-line summary: The data controller is Aurum Digital Marketing LTD, a UK company; you can contact us about anything in this policy by emailing the address below.

A “data controller” is the company that decides why and how your personal data is used (defined in Article 4(7) of the UK and EU GDPR). For this website that company is:

• Legal entity: Aurum Digital Marketing LTD
• Trading as: Financial Expert Class
• Registered office: Flat 18 Block N Peabody Buildings, Wild Street, London, England, WC2B 4BX. Registered in England & Wales. You can verify this free of charge at the UK Companies House register at https://find-and-update.company-information.service.gov.uk/company/15203665.
• Companies House number: 15203665 (incorporated 11 October 2023; status: Active). You can verify free of charge on the UK Companies House register at https://find-and-update.company-information.service.gov.uk/company/15203665.
• Jurisdiction of incorporation: England and Wales, United Kingdom
• ICO registration: Our ICO data-protection fee status is reviewed annually. Where Aurum is exempt under the Data Protection (Charges and Information) Regulations 2018 we will say so; where we are required to pay the fee, the registration number is searchable in the ICO public register at https://ico.org.uk/ESDWebPages/Search. You can request our current status by email.
• Email for privacy enquiries: [email protected]
• Primary author and editor: Kestutis Balciunas (see About Me)

A statutory Data Protection Officer is not required under Article 37 UK GDPR because we are not a public authority, our core activities do not consist of large-scale, regular and systematic monitoring of data subjects, and we do not engage in large-scale processing of special-category or criminal-conviction data. The owner of the business is the point of contact for any UK GDPR or EU GDPR request.

EU representative (Article 27 EU GDPR). Aurum Digital Marketing LTD is established in the United Kingdom and offers content and services to EU data subjects. We are reviewing whether the criteria in EU GDPR Article 27 trigger a duty to appoint an EU-based representative, and will appoint one and list them here if so. Please email [email protected] if you wish to be informed when this section is next updated.

3. Scope of This Policy

One-line summary: This policy covers the website and our limited view of the paid Substack subscriber list; Substack itself controls everything that happens inside the Substack platform.

This Privacy Policy applies to personal data we collect through:

• The website https://financialexpertclass.com/, including all subdomains, articles, comments, the contact form and any newsletter signup forms.
• The subscriber record we receive from Substack for our paid newsletter at https://getdividends.net/ (i.e. the email address and subscription status of paying readers).
• Email replies you send us, and any direct messages we receive via the public profiles listed in section 17.

It does not apply to:

• The Substack platform itself when you read posts, comment or manage your subscription there — Substack Inc. is the independent data controller for that platform. Please refer to https://substack.com/privacy.
• External sites we link to (including brokers, regulators, publications). Once you leave our site, the destination site’s own privacy policy governs your data.
• Social platforms (Medium, LinkedIn, X) where our author maintains profiles. Each of those platforms is an independent controller for activity on its own service.

4. What Personal Data We Collect

One-line summary: We collect a small amount of technical and analytics data automatically, plus the contact details and message body you choose to give us when you subscribe, comment or write to us.

We group the personal data we handle by source, because the lawful basis and processor differ for each.

4.1 Collected automatically when you visit the site

IP address

Your IP address is used transiently by Google Analytics 4 to derive approximate geolocation and is not stored by GA4 in our reports. Where any logging occurs at the hosting layer, IPs are kept only in short-lived server logs (see retention table in section 10).

User-agent string

A short text your browser sends to identify itself — browser type and version, operating system and device category (desktop, mobile, tablet). Used to debug rendering issues and inform design choices.

Pages viewed, referrer, time on page, scroll depth

The “referrer” is the previous page that linked you here. “Scroll depth” is how far down a page you read. Used to understand which articles are useful and which load too slowly, via GA4 inside Google Site Kit.

Approximate geolocation (country level)

Derived from your IP by Google. Used for editorial planning (most readers are EU retail investors) and not for individual targeting.

Search queries that brought you here

Aggregated query data from Google Search Console (only what Google chooses to share), accessed via Site Kit. Never tied to an individual.

4.2 Provided directly by you

Name and email address — newsletter

When you subscribe to any email list we operate, we store the email address (and name, if you provide it) so we can send you the newsletter you asked for. The list itself is hosted on Substack (see section 8); if a different email service provider is ever introduced for a separate free list, this policy will be updated to name it.

Name, email, comment body, IP address and user-agent — blog comments

WordPress stores these against the post you commented on. Your name appears publicly with the comment; your email does not. WordPress also stores the IP address from which the comment was submitted and the browser user-agent string, both used for spam detection by Really Simple Security and Akismet-style filters. If Gravatar avatars are enabled in the Discussion settings, WordPress sends an MD5 hash of your email address to Gravatar (operated by Automattic Inc., United States) so the platform can return your public avatar image if you have one. You can avoid the Gravatar lookup by commenting with an email address that is not registered at Gravatar; you can also request that we disable Gravatar avatars for your specific comment by emailing us.

Name, email and message body — Contact Form 7

Sent to [email protected] so we can reply. A copy is retained per section 10.

Payment data — paid Substack

We do not see or store card details. Substack uses Stripe to process payments. We see only your email address, the subscription tier you chose, and whether your subscription is active, paused or cancelled.

4.3 Generated when you click an affiliate link

When you click an affiliate link to one of the five brokers we currently work with — Freedom24 (CySEC-regulated), Interactive Brokers / IBKR (multi-jurisdictional, including SEC and FCA oversight), XTB (KNF-regulated), Nexo (multi-jurisdictional crypto), or Trade Republic (BaFin-regulated) — your browser is redirected to the broker with a tracking parameter (for example a partner ID or referral code).

From that moment on, the broker processes your data as an independent controller (meaning the broker, not us, decides what to do with your data) under its own privacy policy. We do not see your name, email, identity-verification documents, deposits or trades. In practice, the affiliate dashboards we have personally checked across these five partner accounts show us a referral identifier, a date, the broker’s country, and a conversion status (for example “registered”, “funded” or “qualified”). They do not show us your full name, your email address, your ID document, your deposit amount or your trading history. Where any broker displays a masked email fragment or country code on its dashboard, we treat that as personal data of the partner network rather than data we have collected from you, and we do not export or process it further. Please read our Affiliate Disclosure for the full commercial relationship.

5. Lawful Bases for Processing (UK and EU GDPR Article 6)

One-line summary: For each category of data we name the legal reason we are allowed to process it; consent for analytics and newsletters, contract for the paid Substack, legitimate interests for security and contact replies.

Article 6 of the UK GDPR and EU GDPR requires a lawful basis for every act of processing. Ours are as follows:

• Analytics cookies and similar tracking technologies. Consent under Article 6(1)(a), collected via our cookie consent banner before any non-essential cookies fire. You can withdraw consent at any time via the banner’s preference centre.
• Newsletter delivery (free list). Consent under Article 6(1)(a), combined with regulation 22 of the UK Privacy and Electronic Communications Regulations (PECR — the UK rulebook for electronic marketing) and the equivalent EU ePrivacy rules. We only email people who actively opted in, and every email includes a one-click unsubscribe link.
• Paid Substack subscription record. Contract performance under Article 6(1)(b) for the duration of your subscription, because we need your email to deliver the service you paid for.
• Comment moderation and storage. Legitimate interests under Article 6(1)(f) in maintaining a constructive, spam-free comment section, balanced against your reasonable expectation that visible comments remain visible.
• Replying to contact-form messages. Legitimate interests under Article 6(1)(f), or pre-contractual steps under Article 6(1)(b) if your message concerns a possible paid service.
• Security and abuse prevention. Legitimate interests under Article 6(1)(f) in protecting the site, our hosting provider’s infrastructure and other readers from spam, brute-force login attempts and malicious bots.
• Affiliate click-through attribution. Legitimate interests under Article 6(1)(f), necessary for the basic commercial viability of a site that publishes its broker reviews and methodology openly. The data we receive is minimal and does not identify you.
• Compliance with our legal obligations. Legal obligation under Article 6(1)(c) where, for example, we must retain limited records to respond to a regulator or court.

For each legitimate-interests basis above we maintain a written three-part Legitimate Interests Assessment (purpose, necessity and balancing). We will share the assessment for any specific processing activity on request to [email protected].

6. Special Category Data

One-line summary: We do not knowingly collect sensitive personal data such as health, religion or political opinions; please do not include any in messages to us.

We do not knowingly collect “special category” personal data within the meaning of Article 9 UK GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a person’s sex life or sexual orientation). We also do not seek information about criminal offences or convictions under Article 10.

Please do not include special category data in any comment, contact-form message or email to us. If you do, we will delete it on detection unless we are legally required to retain it.

7. Cookies and Similar Technologies

One-line summary: We use a small set of cookies — strictly necessary for the site to work, plus analytics cookies that only fire after you consent.

A cookie is a small text file stored on your device by your browser. We use the following categories:

• Strictly necessary. WordPress core session cookies and security cookies set by the Really Simple Security plugin. These are exempt from consent under regulation 6(4) of the UK PECR because they are essential to deliver the service you requested. Typical persistence: session, or up to a few hours.
• Functional. WP Fastest Cache cache-bypass cookies for logged-in users so they see uncached pages while editing. Persistence: session.
• Analytics. Google Analytics 4 cookies (_ga and _ga_<container-id>) set via Google Site Kit. GA4 no longer sets the legacy _gid cookie that older Universal Analytics used. Cookie lifetime in your browser is set by Google (typically up to 2 years for _ga) and is separate from how long we retain the resulting analytics data inside GA4 itself, which we have shortened to 14 months (see section 10). Analytics cookies only fire after you accept analytics in the consent banner.
• Marketing. None set by us at this time. If you click an affiliate link to a broker, that broker may set its own cookies on its own domain; those are governed by the broker’s privacy policy, not ours.

Our cookie consent banner is configured via the WordPress consent management plugin currently installed on the site. You can reopen the preference centre at any time by clicking the “Cookie preferences” link in the site footer. If you cannot see a preference centre or are unsure whether analytics is enabled, please email [email protected] and we will confirm and reset your preferences. Analytics and other non-essential cookies will not fire on your device until you grant consent.

For background on EU cookie law and consent, see the European Data Protection Board guidelines at https://edpb.europa.eu/. The UK Information Commissioner’s Office also publishes plain-English guidance on cookies at https://ico.org.uk/.

8. Third-Party Processors and Sub-Processors

One-line summary: We use a short list of named processors — hosting, analytics, search performance, paid newsletter platform — each with its own privacy policy and transfer safeguards.

To keep this section readable, two definitions first. A processor is a company that handles personal data on our instructions. A controller is a company that decides on its own why and how the data is used.

We work with the following processors and sub-processors. Each is bound by a data processing agreement or equivalent terms under Article 28 UK GDPR.

• Interneto Vizija UAB — WordPress hosting. Role: storage and processing of all site content, including comments and contact-form submissions. Location: Lithuania (EEA). No transfer outside the EEA. See https://www.iv.lt/en/.
• Google LLC and Google Ireland Limited — Google Site Kit, Google Analytics 4, Google Search Console. Role: analytics and search-query reporting. Location: United States and EEA. Transfer mechanism: EU-US Data Privacy Framework plus the UK Extension (Google is self-certified) and Standard Contractual Clauses as a backstop. Privacy policy: https://policies.google.com/privacy.
• Google Fonts. Our GeneratePress theme is configured, where supported, to serve fonts locally to avoid transmitting visitor IP addresses to Google’s font servers. If any page does load a font from fonts.googleapis.com directly, that request is treated as a non-essential resource and is gated by the cookie/consent banner. You can email us if you spot an exception.
• Substack Inc. — Paid newsletter platform at getdividends.net. Substack Inc. is the independent data controller for everything that happens inside the Substack platform (account, payments, in-app activity). Aurum Digital Marketing LTD is the controller only of the limited subscriber list (email address, subscription tier and status) that Substack exports back to us as publisher. We are not joint controllers. Location: United States. Transfer mechanism: Standard Contractual Clauses and the UK International Data Transfer Addendum (UK IDTA). Privacy policy: https://substack.com/privacy.
• Stripe Inc. — Sub-processor of Substack for card payments. Aurum has no direct contract with Stripe and never sees your card data. Listed here for transparency only. Location: United States and Ireland. Transfer mechanism: SCCs and UK IDTA. Privacy policy: https://stripe.com/privacy.
• Automattic Inc. (Gravatar). Where Gravatar avatars are enabled in the WordPress Discussion settings, an MD5 hash of a commenter’s email is sent to Gravatar to fetch the avatar image. Location: United States. Transfer mechanism: SCCs and UK IDTA. Privacy policy: https://automattic.com/privacy/.
• WordPress plugin vendors. Yoast SEO, Site Kit by Google, LinkBoss and WP Fastest Cache Premium are installed on the site to support SEO, analytics integration, internal-linking and caching. To the best of our knowledge none of these plugins transmits visitor personal data to its vendor in the course of normal operation; where any plugin does (for example a licence check sending the site URL), this does not include visitor personal data. If you would like to know the current plugin inventory and what each one does with data, please email us.
• Affiliate brokers — independent data controllers, not processors for us. We currently work with the following five only:
  • Freedom24 (regulated by CySEC) — https://freedom24.com/
  • Interactive Brokers (multi-jurisdictional) — https://www.interactivebrokers.com/
  • XTB (regulated by the Polish KNF) — https://www.xtb.com/
  • Nexo (multi-jurisdictional crypto) — https://nexo.com/
  • Trade Republic (regulated by BaFin) — https://traderepublic.com/

We do not currently route the website through Cloudflare or any equivalent reverse-proxy CDN. If we ever introduce one, this policy will be updated to name the provider, its role, location and transfer mechanism before that change goes live.

We do not engage any further processors without updating this list. We do not sell, rent or trade your personal data to anyone, ever.

9. International Data Transfers

One-line summary: Most of your data stays in the EEA; where it travels to the US it is covered by approved transfer mechanisms such as SCCs and the UK IDTA.

The personal data we hold travels internationally only in these limited situations:

• UK and EEA. The UK government’s adequacy determination for the EEA, and the European Commission’s adequacy decision for the UK, mean transfers in either direction are currently treated as transfers within an adequate jurisdiction. These adequacy positions are reviewed periodically by the UK government and the European Commission; we monitor changes and will update this policy if a redetermination requires new safeguards.
• UK or EEA to United States. When data goes from the UK or EEA to the US (for Google, Substack, Stripe and Automattic/Gravatar), we rely on approved safeguards. The main one is the EU-US Data Privacy Framework, plus the UK Extension. As a backup we use Standard Contractual Clauses (SCCs — pre-approved legal terms) together with the UK International Data Transfer Addendum (UK IDTA).

The per-recipient picture, verified at the date of this review, is:

• Google: EU-US Data Privacy Framework (self-certified) plus SCCs as a backstop.
• Substack: SCCs plus UK IDTA. We will update if Substack later self-certifies under the DPF.
• Stripe (via Substack): DPF self-certification plus SCCs and UK IDTA.
• Automattic / Gravatar: SCCs plus UK IDTA.

For reference, see the EU-US Data Privacy Framework list at https://www.dataprivacyframework.gov/ and the ICO guidance on international transfers at ICO international data transfers.

If you would like a copy of the relevant transfer mechanism for a specific processor, email [email protected] and we will provide it.

10. Retention Periods

One-line summary: We keep data only as long as needed — analytics for 14 months, contact messages for 24 months, comments until you ask us to remove them.

After the retention period, data is deleted or fully anonymised so that it can no longer be linked to you.

11. Your Rights Under UK GDPR and EU GDPR

One-line summary: You have the right to see, correct, delete, restrict, port, object to and withdraw consent for our use of your data — and we will respond within one calendar month (around 30 days), extendable by up to a further 60 days where the request is complex.

Subject to the conditions in the UK GDPR and EU GDPR, you have the following rights. To exercise any of them, please email [email protected] and tell us which right you wish to exercise.

• Right of access (Article 15). Ask for a copy of the personal data we hold about you, together with information about how and why we use it.
• Right to rectification (Article 16). Ask us to correct inaccurate data or complete data that is incomplete.
• Right to erasure / “right to be forgotten” (Article 17). Ask us to delete your personal data where one of the grounds in Article 17 applies (for example you withdraw consent, or the data is no longer needed).
• Right to restriction of processing (Article 18). Ask us to pause processing while a dispute (for example over accuracy) is resolved.
• Right to data portability (Article 20). You can ask for a copy of your data in a common file format that you can reuse elsewhere. We usually provide CSV (a spreadsheet file) or JSON (a structured text file).
• Right to object (Article 21). Object to processing based on legitimate interests, including direct marketing. We will stop unless we can show compelling legitimate grounds that override your interests.
• Right to withdraw consent at any time (Article 7(3)). Withdraw consent for analytics cookies via the consent banner; withdraw newsletter consent via the unsubscribe link in every email.
• Right not to be subject to automated decision-making (Article 22). We do not perform any automated decision-making or profiling that produces legal or similarly significant effects, so this right is preserved by default.

We will ask for proportionate proof of identity before responding to a rights request, which may include emailing us from the address we have on file or providing other reasonable evidence. We will only request what is necessary to verify your identity, and we will not refuse a request simply because you cannot use a specific email address.

We will respond within one calendar month (approximately 30 days) of receiving a verifiable request, extendable by up to a further two months (approximately 60 days) if the request is complex or numerous. We will tell you within the first month if an extension applies, with reasons. There is no fee for a reasonable request.

12. Children’s Privacy

One-line summary: The site is aimed at adults; we do not knowingly collect data from anyone under 16.

Financial Expert Class is aimed at adult retail investors. The content, and the brokers we link to, require adult capacity to use. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please email [email protected] and we will delete it as soon as we have verified the request.

13. Security Measures

One-line summary: TLS-encrypted site, EU-based hosting, hardened WordPress, two-factor authentication on admin accounts, and the principle of least privilege.

We take “appropriate technical and organisational measures” under Article 32 UK GDPR. These include:

• HTTPS / TLS encryption sitewide, with HSTS enabled and modern cipher suites only.
• Hosting at Interneto Vizija UAB’s data centre in the European Economic Area.
• WordPress hardening via the Really Simple Security plugin, with brute-force protection and additional hardening modules enabled per our internal security baseline.
• Two-factor authentication on the primary administrator account, and required on any additional admin accounts before they are granted access.
• Strong, unique passwords stored in a reputable password manager; no shared logins.
• Principle of least privilege: only the operator has full admin access. Contributors, if any, have the lowest role consistent with their task.
• Regular WordPress core, theme and plugin updates, and a documented rollback plan.
• Encrypted, off-site backups retained on a 30-day rolling basis.
• An incident-response checklist and an internal log of any data-protection-relevant events.

We work hard to protect your data, but no system is 100% secure. We cannot guarantee absolute security. Please choose a strong password for any account you create with us or with a service we link to.

14. Data Breach Notification

One-line summary: If a breach occurs that puts your rights at risk, we will notify the ICO within 72 hours and notify you without undue delay where the risk is high.

If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the UK Information Commissioner’s Office within 72 hours of becoming aware, in line with Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly, in plain English, without undue delay, and tell you what we are doing about it and what you can do to protect yourself (Article 34 UK GDPR).

If you are based in the EEA and a breach affects you, we will also work with the main EU data protection authority for the case. This is called the “lead supervisory authority” under the EU one-stop-shop process.

15. How to Complain

One-line summary: You can complain to the UK ICO or to your local EEA supervisory authority — and we’d appreciate the chance to fix things first.

We would always prefer to address your concerns directly. Please email [email protected] first and give us a reasonable chance to investigate and respond. If you remain unsatisfied, you have the right to lodge a complaint with a supervisory authority:

• UK readers: Information Commissioner’s Office (ICO) — https://ico.org.uk/. The ICO operates a helpline and an online complaint form.
• EEA readers: Your national data protection authority. A full list is maintained by the European Data Protection Board at https://edpb.europa.eu/about-edpb/about-edpb/members_en. Common examples include the CNIL (France), the BfDI / state authorities (Germany), the Garante (Italy), the AEPD (Spain), the State Data Protection Inspectorate (Lithuania) and the DPC (Ireland).

16. Changes to This Policy

One-line summary: We will tell you about material changes in advance; minor edits just update the “Last reviewed” date.

We may update this Privacy Policy from time to time. Where a change is material — for example, adding a new processor that handles your personal data, changing the lawful basis for an activity, or extending a retention period — we will:

• Display a banner or notice at the top of this page for at least 30 days; and
• Email all active newsletter subscribers a plain-English summary of what is changing and when it takes effect.

Where the change is minor — for example, a clarification of wording, an updated link, or a corrected typo — we simply update the “Last reviewed” date at the top of this page. The full version history is retained internally and can be requested by email.

17. Contact for Privacy Matters

One-line summary: One email address, one author, typically a reply within one to three UK working days for general enquiries and within one calendar month for formal rights requests.

For any privacy or data-protection question — a rights request, a correction, an unsubscribe, or a concern — please email:

[email protected]

We typically acknowledge privacy enquiries within 1-3 UK working days, and complete formal UK GDPR or EU GDPR rights requests within the statutory one calendar month (see section 11). Please mention “Privacy” in the subject line so we can prioritise it. You can also reach Kestutis Balciunas, the author and editor, via the public profiles listed on the About Me page and on the Contacts page, but please use the email address above for any formal UK GDPR or EU GDPR request so that we can log and track it correctly.

For wider context on how we operate, please also see our Editorial Process, Affiliate Disclosure, Terms and Conditions, Help / FAQ, and the paid newsletter at https://getdividends.net/.

18. Document Control and Review Schedule

One-line summary: This page is reviewed at least every six months, and any material change is logged with a date and a short note of what was updated.

• Document owner: Aurum Digital Marketing LTD. Maintained by Kestutis Balciunas as operator (see About Me and Editorial Process).
• Last reviewed: 28 May 2026.
• Next scheduled review: 28 November 2026 (every 6 months, plus an out-of-cycle review on any material change in processing, processors, or applicable law).
• Change log (recent): 28 May 2026 — full rewrite to align with current UK GDPR and EU GDPR guidance, named processors (including Automattic/Gravatar and the Substack/Stripe sub-processor chain), corrected lawful basis for newsletter delivery to consent under Article 6(1)(a) + PECR, accurate description of GA4 IP handling, dedicated breach-notification and complaints sections, retention table, Article 27 EU representative status note, and cross-links to our other governance pages.

This Privacy Policy should be read together with our Terms and Conditions, Affiliate Disclosure and Editorial Process. For background reading on data protection itself we recommend the ICO’s “Guide to UK GDPR” at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/ and the European Data Protection Board’s guidelines at https://edpb.europa.eu/.

Selected research from Financial Expert Class

In-depth guides our readers are using right now:

• JustETF: How to Actually Use Europe’s ETF Database Like a Professional
• Best Global ETFs for European Investors
• Small Cap ETF Strategies for European Investors
• ETF Fund Size & AUM Analysis
• Amundi vs iShares