Privacy policy

Introduction

Associació de Software Lliure Decidim ("Decidim" or “we/us”) is the owner of this website, available through the web domain https://decidim.org/ (hereinafter, the "Website"), and acts as data controller for the processing of personal data of all users of the Website (“You/r”, the “User”).

Decidim is committed to protecting the privacy of all Users of the Website, its associate members and members of the Decidim community. This Privacy Policy explains our practices regarding the use of personal data collected through the Website, including the demo of our free open-source participatory democracy platform, as well as the processing of data of individuals associated with Decidim and the management of the Decidim community, either on this Website or on other platforms managed by Decidim.

This Privacy Policy is part of our Legal Texts together with the Legal Notice.

Personal data we collect about you and how we use it

a. Data collected from surfing the Website

When using our website, Decidim uses the services of Plausible analysis software. Its is software that, when tracking user data, this data is kept fully and securely encrypted. The purpose of Plausible Analytics is to track general traffic trends on your website and not individual visitors. Each HTTP request sends the IP address and user agent to the server, so that's what they use, generating an identifier that changes daily using the visitor's IP address and user agent. To anonymise this data, it is passed through a hash function with a rotating salt. This generates a random string of letters and numbers that is used to calculate the number of unique visitors for the day. The IP address of the raw data and the user agent are never stored in the logs, databases or anywhere on Plausible analytics disk. Older salts are deleted every 24 hours to avoid the possibility of linking visitor information from one day to the next. In this way, no personal user data is collected while browsing our website, for more information about the data processing by Plausible Analytics, you can visit their website at https://plausible.io/privacy-focused-web-analytics

b. Data collected from our Demo

The access to the Decidim platform demo, available through the Website in the URL https://try.decidim.org/ is anonymous, since it is done through generic credentials for testing and knowledge of the operation, features and capabilities of the Decidim platform by the users.

Only a session cookie ("Session_id") is activated, whose purpose is to obtain or establish the session id for the current session. This cookie is strictly necessary for the technical functionality of detecting the session in the Website in order to ensure the connection through http protocols and to keep the User's session and Web Site services available, and are exempted from User consent in accordance with Opinion 4/2012 on the exemption from the cookie consent requirement issued by the European Data Protection Authority.

c. Data collected from contact forms, emails or other communication means

When people contact Us by the contact form, email or similar communication means, we will automatically collect the following information: name, entity, email address and the content of the User message in order to attend your comments, requests, suggestions, etc.

Additionally, we may process this data for statistical studies through pseudonymization and even anonymization techniques, such as data aggregation, preventing this subsequent processing from identifying Users individually.

d. Data collected from Decidim community

Decidim uses other platforms linked to this Website for the management of the Decidim community generated around our technology, as a meeting point for the Decidim community and where most of the activities and communications between users and Decidim take place. These platforms, such as https://meta.decidim.org/ or GitHub (https://github.com/decidim/decidim) are governed by their own terms of use and privacy policies.

Notwithstanding, Decidim may process User's personal data collected from these platforms for the management of the community projects developed in those platforms respectively, in particular these personal data may consist in connection data to these platforms, User profile on the platform, and the content of the comments and remarks that the User may contribute to the Decidim projects from time to time. Please note that this information may be public and, consequently, accessible and visible to other Users.

e. Data collected from our associate members

Any person or organization that wants to participate freely in the Decidim community, attending debates, collaborating in the organization of events, promoting a working group or community days, as well as contributing to the code or documentation of our free open-source participatory democracy platform, management of instances, etc., can choose to become a member of Decidim, as long as they have demonstrated sufficient commitment to the community through the realization of any of the above activities. To do so, you must complete a form to submit your application, which will be evaluated by the Decidim Coordination Committee.

The processing of Decidim members' personal data is carried out for the purpose of managing the aforementioned projects and activities in which the associate member participates, accounting management of membership fees and, in general, the governance of projects and activities of Decidim, in order to ensure compliance with the Decidim's principles and values as well as the associates' duties and rights.

Legal basis

The legal basis of our processing of personal data are the following:

• The processing of Users and associate data is necessary to perform the contract, consisting in the Users acceptance of the Legal Text of the Website, in order to provide them all the information about Decidim and its technology, projects and activities, as well as to allow them participating in the projects and activities carried out by Decidim.
• We may also process your personal data when you give us express consent to make publications about Decidim projects and activities in which you have participated, press releases or other forms of communication and dissemination of Decidim's activities, as well as to receive particular information on a regular basis and/or when you contact us through the website contact form or by e-mail.
• Additionally, we may process your data on our legitimate interest to perform statistical studies or other knowledge generation techniques, implementing pseudonymization and, if possible, anonymization measures, such as data aggregation, in order to protect the privacy of Users, in accordance with art. 89 GDPR.

In certain circumstances, we may process your data in accordance with this policy to comply with a legal or regulatory obligation to which we are subject.

Data disclosure

We process your personal data confidentially in accordance with the applicable legislation. Unless stated otherwise, your personal data will not be provided to third parties.

Specifically, we disclose your data as follows:

• We can give access to your personal data to our IT service providers under contracts for the provision of services in favour of Decidim. Among the others, Netlify, Inc., an American entity who provide to Us web hosting services. Decidim has subscribed with Netlify a Data Processing Agreement, including the Standard Contractual Clauses currently approved by the European Commission, in order to ensure that your personal data are processed with all adequate guarantees. More information about how Netlify use your personal data may be consulted here: https://www.netlify.com/gdpr-ccpa.
• We can make the data available to the public administration or authorities to investigate suspicions of fraud, harassment or other violations of any law, rule or regulation, or the policies of the website.

For more information about our service providers who make international transfers, please contact us at privacy@decidim.org.

Data retention

We only keep your personal data for as long as it is necessary to fulfil the purposes for which we have collected them, even to comply with legal, accounting or information requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data, if we can achieve those purposes through other means and the applicable legal requirements.

Security measures

We implement security measures and personal data protection schemes as required by law to maintain the confidentiality and integrity of your data and protection against unauthorised access, modification or destruction.

Your rights

You have rights under data protection laws in relation to your personal data. Specifically, you have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party (right to data portability). We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

The aforementioned rights may be effective by contacting us at privacy@decidim.org.

You also have the right to make any complaint to the competent authority, in this case the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/. Jorge Juan, 6, 28001 Madrid, Spain.

General

We reserve the right to amend the terms of this Privacy Policy and will notify you by providing a clear notice of these changes by email or on our Website, and in this Privacy Policy. If you continue to use our services after such update, you will be deemed to accept the new terms. If you do not accept the update, please terminate your account or notify us and we will terminate your Account and remove any of your personal data (except as required to be maintained for legal purposes), and you will not be able to continue to use our services.

Unless a specific local regulation sets forth to the contrary, the Privacy Policy is governed by the laws of Spain.

Last update: February 2022.