1. Introduction
This Privacy Policy (“Policy”) describes how Underlying Inflation LLC (“Underlying Inflation”, “we”, “us”, “our”) collects, uses, stores, and discloses personal data when you visit underlyinginflation.com (the “Website”) or engage with our research services.
We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR) and any applicable national implementing legislation.
Please read this Policy carefully. By using the Website you acknowledge that you have read and understood its contents.
For our use of cookies and similar technologies, please see the separate Cookie Policy also available on this Website.
2. Data controller
Underlying Inflation LLC
For all privacy-related enquiries, contact: research@underlyinginflation.com
3. Scope
This Policy applies to:
— visitors to the Website, including the public and restricted areas;
— individuals who submit enquiries via the contact form or by email;
— institutional clients and their authorised representatives who have been granted access to the restricted research area;
— individuals who correspond with us in connection with a research engagement.
It does not apply to third-party websites or services linked from the Website.
4. Personal data we collect
4.1 Data you provide directly
When you contact us, request research access, or engage our services:
— name and professional title;
— business email address and telephone number;
— employer or institution name;
— content of your enquiries and correspondence.
4.2 Data collected automatically
When you visit the Website, our hosting infrastructure and analytics services automatically collect:
— IP address (anonymised);
— browser type, version, and operating system;
— referring URL and pages visited;
— date, time, and duration of visit;
— device type and screen resolution.
This data is collected via Google Analytics 4. For full details of the cookies used, see the separate Cookie Policy.
4.3 Restricted area — registered users
For users granted access to the restricted research area, we additionally collect:
— login credentials (email address and hashed password — passwords are never stored in plain text);
— session tokens and login timestamps;
— records of which research documents have been accessed and when.
Access to the restricted area is granted manually by Underlying Inflation and is not open to public self-registration.
4.4 Data we do not collect
We do not collect special categories of personal data as defined in Article 9 GDPR, and we do not knowingly collect data relating to minors. The Website is directed exclusively at institutional professionals.
5. Legal basis for processing
We process personal data on the following legal bases under Article 6 GDPR:
— Legitimate interests (Art. 6(1)(f)): responding to professional enquiries, managing research access, ensuring security of the restricted area, and operating website analytics to improve performance.
— Performance of a contract (Art. 6(1)(b)): processing data of clients and their representatives in connection with research engagements.
— Consent (Art. 6(1)(a)): placing non-essential analytics cookies — only after you have given freely given, specific, informed, and unambiguous consent via the cookie banner.
— Legal obligation (Art. 6(1)(c)): where applicable law requires us to retain records.
6. How we use personal data
We use personal data to:
— respond to enquiries and manage research engagement requests;
— grant and manage access to the restricted research area;
— deliver research, analysis, and related communications to clients;
— maintain the security and integrity of the Website and restricted area;
— analyse Website usage to improve performance and user experience (subject to your analytics consent);
— comply with applicable legal and contractual obligations.
We do not use personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.
7. Disclosure of personal data
We do not sell, rent, or trade personal data. We may share data with:
— Hosting and infrastructure providers: we use third-party hosting to operate the Website.
— Google LLC: analytics data is processed by Google LLC via Google Analytics 4. Google is certified under the EU–US Data Privacy Framework. A Data Processing Amendment with Google is in place.
— Professional advisers: legal, accounting, or compliance advisers, where required and subject to professional confidentiality.
— Competent authorities: where required by law or a binding legal order.
All data processors are subject to written data processing agreements and are permitted to process data only on our documented instructions.
8. International data transfers
Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including:
— Standard Contractual Clauses adopted by the European Commission;
— adequacy decisions (e.g. the EU–US Data Privacy Framework for certified US entities such as Google LLC);
— other mechanisms permitted under GDPR Chapter V.
9. Data retention
We retain personal data only for as long as necessary for the purposes set out in this Policy or as required by law:
— Contact enquiries: up to 24 months from last correspondence, unless an engagement follows.
— Client engagement data: for the duration of the engagement and 5 years thereafter, in accordance with standard commercial record-keeping practice.
— Restricted area access logs: 12 months from the date of the access event.
— Analytics data: 14 months (Google Analytics 4 retention setting — we recommend configuring this to the shortest period available in the GA4 property settings).
— Cookie consent records: 13 months from the date of consent.
When data is no longer required, it is securely deleted or irreversibly anonymised.
10. Your rights
Subject to applicable law, you have the following rights in relation to your personal data:
— Access (Art. 15): to request a copy of the data we hold about you.
— Rectification (Art. 16): to request correction of inaccurate or incomplete data.
— Erasure (Art. 17): to request deletion of your data where no legal basis for retention remains.
— Restriction (Art. 18): to request that we restrict processing in certain circumstances.
— Portability (Art. 20): to receive your data in a structured, machine-readable format where processing is based on consent or contract.
— Objection (Art. 21): to object to processing based on legitimate interests.
— Withdrawal of consent (Art. 7(3)): to withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@underlyinginflation.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.
You also have the right to lodge a complaint with the supervisory authority competent for your place of residence or the place of the alleged infringement.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. These include:
— HTTPS encryption for all Website traffic;
— hashed storage of user passwords (plain-text passwords are never stored or transmitted);
— access controls limiting data access to authorised personnel;
— regular review of security practices.
No method of transmission over the internet is entirely secure. While we take all reasonable precautions, we cannot guarantee absolute security.
12. Third-party links
The Website may contain links to external websites, publications, or platforms (including Substack). This Policy does not apply to those sites. We encourage you to review the privacy policies of any external services you access.
13. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the effective date at the top of this document. Where changes are material, registered users will be notified by email. We encourage you to review this page periodically.
14. Contact
Underlying Inflation LLC
Privacy enquiries: research@underlyinginflation.com