Privacy Policy - Central Press Desk
Version dated 13 September 2026
1. Purpose of this policy
This policy explains how LEGIVAL LTD, which operates the Central Press Desk brand and services, collects and uses personal data when you consult centralpressdesk.com, use its subdomains, including app.centralpressdesk.com, create an account, order a service, submit a press release, use a journalist area or contact our team.
It also sets out the source of professional data relating to journalists and other media contacts, how it is used and the rights available to data subjects.
This policy applies to the websites, applications, forms, professional areas, communications and services operated by Central Press Desk (together, the "Platform").
2. Data controller and contact
The controller for the processing described in this policy is:
LEGIVAL LTD, a private limited company governed by Cypriot law, with its registered office in Limassol, Cyprus.
Contact: contact form
In this policy, "Central Press Desk", "we", "us" or "our" means LEGIVAL LTD.
3. Respective roles of Central Press Desk and its clients
Central Press Desk acts as controller for the data it determines and uses in order to:
- manage the Platform, accounts and orders
- invoice and provide services
- compile, verify and keep up to date its professional database of journalists and media outlets
- target and route press releases
- operate the public newsroom
- provide support, security, fraud prevention and audience measurement
- manage its business relationships and comply with its legal obligations
The Client is responsible for the personal data that it chooses to include in a press release or in the materials it sends to us. In particular, it is responsible for having a legal basis, informing the individuals concerned where required, and verifying that it may publish their names, positions, contact details, quotations, images or other information.
If a particular service leads us to process data solely on a Client’s documented instructions, Central Press Desk then acts as a processor and an agreement compliant with Article 28 of the GDPR is concluded where necessary.
4. Data we process
Depending on your relationship with Central Press Desk, we may process the following categories of data.
4.1 Platform visitors
- IP address and connection information
- device type, operating system, browser and language
- pages viewed, date, time, approximate duration and browsing path
- referring URL, technical events and errors
- cookie preferences and other trackers
- information necessary for security, abuse prevention and session operation
4.2 Prospects and people using the contact form
- first and last name
- company or organization
- email address and, if provided, phone number
- subject and content of the request
- page from which the request is submitted
- history of exchanges and follow-up actions
- anti-fraud or anti-spam technical data associated with the submission
4.3 Clients, distributors and authorized users
- company name, contact name, position and professional contact details
- billing address, country, registration number and VAT number
- result and data necessary to verify the VAT number via VIES
- Account identifiers and password stored in hashed form
- roles, permissions and affiliated organization
- orders, selected options, amounts, taxes, invoices and payment status
- transaction reference and limited information returned by the payment provider
- history of requests, approvals, corrections, complaints and exchanges with support
- login logs, actions performed in the Account and security information
We are not intended to receive or retain complete card payment data. They are processed directly by Stripe / Revolut under its own documentation.
4.4 Press releases and editorial content
- title, summary, text and file of the press release
- language, type of announcement, categories and selected media sections
- possible embargo date and time
- possible stock tickers or symbols
- names, titles, quotations, photographs, press contact details and other data contained in the content
- successive versions, comments, corrections and final approval
- publication, indexing, routing and media coverage tracking data
A press release may become publicly accessible in the newsroom and be transmitted to journalists, media, partners, search engines, aggregators or other channels included in the offer. The Client must therefore not include confidential, excessive or unrelated data.
4.5 Journalists and other media professionals
We may process:
- surname, first name and professional title
- media outlet, publication, agency, programme or parent organisation
- role, section, topics covered, areas of expertise and professional interests
- professional email address and, where relevant, professional phone number
- geographic area, working languages and desired content formats
- chosen sending frequency and channel
- preferences, opt-outs, correction requests and registration status
- information enabling journalistic or media activity to be verified
- technical deliverability data, including delivered, rejected or marked as spam messages
- open and click data relating to received press releases
- history of requests or topics published on the Platform and interactions with our services
We do not share our media contacts database with Clients. Mailings are carried out by Central Press Desk according to the relevant categories and recipients’ preferences.
4.6 Candidates, suppliers and partners
- identity, role and professional contact details
- résumé and application information, where applicable
- parent company, contract, invoices, banking and tax information
- exchanges, professional evaluations and data necessary for the relationship
4.7 Sensitive data
We do not seek to collect special categories of data within the meaning of the GDPR, such as health data, political opinions, religious beliefs, biometric data or information relating to sexual life.
However, a press release may deal with a sensitive subject or mention such information. The Client must limit such data to what is strictly necessary and ensure that a condition under Article 9 of the GDPR or another applicable rule permits its processing and publication. Central Press Desk may refuse or remove content presenting excessive risk.
5. Source of the data
We obtain data:
- directly from you when you create an Account, fill out a form, place an order, submit a press release, set your preferences or communicate with us
- from your employer, your organisation or an authorised user who creates or administers your access
- from Clients who include information in their content
- automatically when using the Platform
- from the payment service provider, VIES and other providers necessary for the order
- from publicly accessible professional sources, such as official media websites, team pages, mastheads, article bylines, publicly available professional profiles, press releases or professional directories
- from media outlets, journalists, agencies, partners or data providers authorised to transmit them to us
- from corrections, preferences and requests directly communicated by journalists
Where a journalist’s data was not obtained directly from them, Central Press Desk retains, insofar as reasonably possible, the source and date of collection or last verification. Information compliant with Article 14 of the GDPR is provided within the applicable time limits, in particular no later than at the first communication, except where a legal exception applies.
6. Purposes, legal bases and retention periods
The durations indicated below are recommended maximum periods. They must be aligned with the settings and procedures actually applied before publication of this policy.
| Purpose | Main data | Legal basis | Proposed maximum retention period |
|---|---|---|---|
| Provide the site and essential functions | Technical data, session, security | Legitimate interest in providing and securing the Platform; contract for logged-in users | Technical logs: 12 months; session cookies: duration of the session or the period indicated in Article 13 |
| Create and administer Client Accounts | Identity, contact details, login credentials, roles, Account activity | Performance of the contract; legitimate interest for administrators and users of a legal entity | Duration of the Account then 3 years after closure, unless data are kept longer for evidentiary purposes |
| Process orders and provide the Services | Contact details, order, press release, options, targeting, exchanges | Performance of the contract | Duration of the service then 6 years for contractual evidence |
| Invoice, process payments and manage accounting | Identity, company, address, VAT, invoices, payment references | Contract and legal accounting and tax obligations | Applicable legal retention period, proposed at 6 years after the end of the relevant financial year |
| Verify the VAT number | VAT number, country, VIES result | Legal obligation and legitimate interest in applying VAT correctly | With the billing file for the applicable legal retention period |
| To ensure editorial control and prevent unlawful content | Content, publisher identity, supporting documents, decisions | Performance of the contract; legitimate interest; legal obligations | For the duration of the service, then 6 years for the defence of rights; sensitive supporting documents deleted earlier when no longer necessary |
| To publish and archive press releases in the newsroom | Validated content, metadata and press contact details | Performance of the contract for the Client’s data; legitimate interest in informing and maintaining a public archive for other persons mentioned | As long as the press release remains relevant and lawful; reviewed upon a request for removal, objection or update |
| To distribute press releases to media professionals | Media profile, preferences, content, deliverability data | Legitimate interest of Central Press Desk, its Clients and journalists in receiving relevant professional information | Until objection, loss of professional relevance, or 3 years after the last conclusive check, with periodic verification |
| To manage journalists’ Accounts and preferences | Profile, media outlet, topics, regions, languages, frequency, preferences | Performance of the requested service; legitimate interest | Duration of the Account then 3 years of inactivity, subject to maintaining a minimal suppression list |
| To process unsubscribes and objections | Address, possible reason, date and scope of the objection | Legal obligation and legitimate interest in permanently respecting the choice | For as long as necessary to avoid further contact, in the form of a minimized suppression list |
| To measure deliverability and protect sender reputation | Delivery statuses, bounces, complaints, technical events | Legitimate interest in ensuring the operation and security of distributions | 13 months, aggregated data may be kept longer |
| To respond to contact and support requests | Identity, contact details, message, exchanges | Pre-contractual measures, contract or legitimate interest in responding | Duration of processing then 3 years after the last exchange; longer if necessary for a dispute |
| To send commercial information about our own services | Contact details and preferences | Consent where required; otherwise legitimate interest within the limits permitted for professional contacts | Until consent is withdrawn or objection is raised; at the latest 3 years after the last active contact |
| To measure audience and improve the Platform | Tracker identifiers, device, browsing, events | Consent where trackers are not strictly necessary |
| To prevent fraud, secure the Platform and defend our rights | IP, logs, Account, orders, alerts, supporting documents | Legitimate interest; legal obligations | Logs: 12 months; fraud or dispute files: duration of the proceedings and appeal periods |
| To comply with authority requests and regulatory obligations | Relevant data depending on the request | Legal obligation or applicable public interest | Duration required by the rule or necessary to process the request |
| To manage suppliers and partners | Contacts, contracts, invoices and exchanges | Contract, legal obligations and legitimate interest | Duration of the relationship then applicable legal or litigation period |
At the end of these periods, the data are deleted, irreversibly anonymized or archived with restricted access where a legal obligation or the defence of a right so requires.
7. Our legitimate interest regarding media contacts
Central Press Desk’s business is to enable the targeted transmission of company information to journalists who may consider it relevant to their work.
When we rely on legitimate interest to build the professional database, keep contact details up to date and send targeted press releases, we pursue in particular the following interests:
- to enable organizations to bring official information to the attention of the relevant media
- to enable journalists to receive information corresponding to their sections, areas, languages and preferences
- to preserve the quality, relevance and deliverability of communications
- to avoid undifferentiated mailings and protect journalists against excessive solicitations.
We limit the data to the professional sphere, favour contact details published for this purpose or lawfully obtained, apply thematic targeting, do not disclose the database to Clients and offer a simple way to correct information, change preferences or object to mailings at any time.
You may obtain additional information about the balancing test carried out or exercise your right to object via the website contact form.
8. Targeting, profiling and automated decisions
The Platform may match the topic, category, language, geographical area or keywords of a press release with the editorial sections and professional preferences associated with media contacts. This segmentation is intended to limit mailings to recipients that are reasonably relevant.
We may also use automated rules or tools to detect spam, malicious files, login anomalies, fraud risks and deliverability issues.
Central Press Desk does not, solely on the basis of automated processing of personal data, make decisions producing legal effects or similarly significantly affecting a person.
9. Data recipients
Depending on the purpose and within the limits of what is necessary, the data may be accessible to:
- authorized members of the Central Press Desk team
- Clients and authorized users of the same organization, for their own accounts, orders and content
- journalists, editorial teams, agencies, media outlets, aggregators, distribution partners and other recipients included in the ordered service
- visitors to the newsroom, search engines, archiving services and automated systems likely to index public content
- our hosting, storage, maintenance, messaging, email distribution, support, payment, invoicing, audience measurement, cybersecurity, backup and fraud prevention providers
- our professional advisers, accountants, auditors, insurers and financial institutions
- authorities, courts or other persons where required by law or where necessary to protect our rights or those of third parties
- a potential purchaser, investor or successor in the context of a reorganization, subject to appropriate confidentiality safeguards
Our subcontractors act on our instructions, are subject to contractual confidentiality and security obligations, and may use data for their own purposes only where permitted by law and where they inform you in their capacity as separate controllers.
10. Publication and international distribution of press releases
The purpose of the Service is to make a press release accessible and to transmit it to professional recipients. Depending on the targeting chosen, these recipients may be located in the European Economic Area or in other countries.
The Client must take this distribution into account when deciding which personal data to include. Once a press release has been published or transmitted, it may be reproduced, quoted, archived or indexed by independent third parties. Central Press Desk may request the removal of content it controls, but cannot guarantee the deletion of copies, archives, search results or publications made by third parties.
11. Transfers of data outside the European Economic Area
Some service providers or recipients may be located outside the European Economic Area ("EEA") or access data from a third country.
Where Central Press Desk organises such a transfer, it uses a mechanism recognised under the GDPR, as applicable:
- an adequacy decision of the European Commission
- the European Commission's standard contractual clauses
- binding corporate rules
- an applicable legal derogation for a specific situation
- other recognised safeguards, supplemented where necessary by technical and organisational measures.
Where the Client expressly orders an international distribution, the transmission of the press contact details contained in the press release to the selected recipients is necessary for the performance of this service. The Client is invited to publish only the information intended for this communication.
You may request information on the countries and safeguards applicable via the website contact form.
12. Electronic communications
12.1 Service communications
We send the messages necessary for the operation of the Account and for the performance of an order: address verification, security, payment, invoice, press release status, correction requests, support and essential developments of the Service. These messages are not optional commercial communications.
12.2 Commercial information
We may send information about our services to business contacts where the law allows it and where this information is relevant to their activity. You may object at any time using the link provided in the message or by contacting us.
12.3 Press releases sent to journalists
Each Journalist may modify their topics, regions, languages, frequency or channel of receipt and may object to all or part of the mailings. The unsubscribe or preference-management link in the messages must remain accessible and functional.
An objection to receiving press releases does not prevent the sending of messages strictly necessary for the security or administration of an active Journalist Account. Closing the Account may also be requested.
13. Cookies and similar technologies
13.1 What is a cookie?
A cookie is a small file or identifier stored or read on your device when you visit an online service. Similar technologies may be used to maintain a session, remember a choice, measure audience traffic or protect the Service.
13.2 Strictly necessary cookies
These cookies are essential for browsing, authentication, payment, security, load balancing or remembering your privacy choices. They are used without consent when they meet the applicable legal conditions.
13.3 Audience measurement cookies and other optional cookies
Audience measurement cookies or third-party service cookies that are not strictly necessary are only placed after your consent, unless they effectively meet all the conditions for a legal exemption.
13.4 Manage your choices
Access to this site is subject to acceptance of cookies. If you refuse the use of cookies you must not use this site.
14. Security
Central Press Desk implements technical and organisational measures proportionate to the risks, including as applicable:
- encryption of communications
- password hashing
- access controls by function
- logging of sensitive operations
- backups and restoration procedures
- security updates, testing and monitoring
- contractual oversight and assessment of service providers
- incident management procedures and data breach procedures
No transmission or storage is entirely risk-free. If you suspect a breach of your Account or your data, contact our team immediately using the site contact form.
In the event of a data breach presenting a risk to individuals, Central Press Desk notifies the competent authority and, where the risk is high, the individuals concerned, in accordance with the applicable rules.
15. Your rights
Subject to the conditions and exceptions provided for by the GDPR, you may exercise:
- the right to obtain information about the processing of your data
- the right to access your data and receive a copy of it
- the right to have inaccurate or incomplete data rectified
- the right to request the erasure of your data
- the right to obtain the temporary restriction of processing
- the right to object to processing based on legitimate interest, on grounds relating to your particular situation
- the right to object at any time to direct marketing
- the right to data portability for data provided, where the processing is based on consent or a contract and is automated
- the right to withdraw your consent at any time, without affecting the lawfulness of prior processing
- the right not to be subject to a decision based solely on automated processing producing legal effects or similarly significant effects, in the cases provided for by law
- the right to lodge a complaint with a data protection authority
How to exercise your rights
Submit your request using the contact form. Specify the right concerned and the information enabling the relevant data to be identified.
We may request additional information only when necessary to confirm your identity. We avoid asking for a copy of an identity document when a less intrusive method is sufficient.
We generally respond within one month. This period may be extended by two months when the request is complex or numerous; in that case, you will be informed within the first month. A request that is manifestly unfounded or excessive may be refused or subject to reasonable fees under the conditions provided for by the GDPR.
Objection or rectification concerning a journalist profile
A journalist may, at any time:
- ask for the source of the data held about them
- correct their media outlet, sections, contact details or preferences
- reduce the frequency or scope of the press releases
- object to any sending and request the removal of their active profile
Minimal information, such as a hashed address or the professional address and the date of objection, may be retained on an exclusion list to ensure that the objection continues to be respected.
16. Complaint to an authority
You may lodge a complaint with the data protection authority of your habitual residence, your place of work or the place where the alleged breach would have been committed.
The supervisory authority of LEGIVAL LTD’s establishment is: Office of the Commissioner for Personal Data Protection - Cyprus.
Without limiting your rights, we invite you to contact us first so that we can review and resolve your request.
17. Minors
The Platform and the Professional Services are not intended for minors. We do not knowingly collect data directly from a minor in order to provide them with a Professional Account.
If a Client wishes to publish information concerning a minor, they must ensure that such publication is lawful, proportionate and respectful of the minor’s best interests, and obtain the necessary authorisations. Central Press Desk may request supporting documents or refuse such publication.
18. Links and third-party services
The Platform may contain links to media sites, partners, service providers or other third parties. These third parties determine their own processing activities and policies. We invite you to consult their privacy information before transmitting data to them.
19. Changes to the policy
We may amend this policy to reflect changes to the Platform, our practices, our service providers or the applicable rules.
The date of the last update appears at the top of the document. In the event of a material change, we provide appropriate information, for example on the Platform or by email to Account holders. Where consent is required for new processing, it is requested before implementation.
20. Contact us
For any question regarding this policy or the use of your personal data, you can contact us via the contact form.