Privacy Policy

The controller responsible for the processing described in this Privacy Policy is:

Open Internet Discourse Foundation
Email: privacy@cultuur.social

References to “cultuur.social”, “we”, “us”, or “our” in this Privacy Policy refer to Open Internet Discourse Foundation in connection with the operation of the cultuur.social website and newsletter.

We have not appointed a Data Protection Officer. Privacy-related questions and requests may be sent to privacy@cultuur.social.

This Privacy Policy applies to the processing of personal data when you:

• visit the cultuur.social website;
• subscribe to the cultuur.social newsletter;
• receive newsletter communications from us;
• contact us using the contact details published on the website.

The website is intended to provide information about cultuur.social, Fediverse-related events, journalism, digital autonomy, social media, and the Fediverse. It does not provide user accounts or public user profiles.

3.1 Newsletter subscription data

When you subscribe to the newsletter, we process the information required to manage and deliver that subscription. This may include:

• first name;
• last name;
• email address;
• subscription status;
• unsubscribe or suppression status;
• email delivery metadata, where generated by our email provider.

3.2 Correspondence data

If you contact us by email, we process the personal data contained in or associated with that correspondence. This may include your email address, your name, the content of your message, and any other information you choose to provide.

We ask that you do not include sensitive personal data in correspondence unless it is relevant and necessary for the matter you are contacting us about.

3.3 Technical, log, and security data

When the website is accessed, technical information may be processed by our hosting, infrastructure, and security providers. This may include:

• IP address;
• browser and device information;
• operating system information;
• referring page or URL;
• requested pages and resources;
• date and time of requests;
• approximate location derived from network information;
• request, diagnostic, fraud-prevention, and security metadata.

This information is processed to make the website available, maintain service reliability, investigate technical issues, protect against misuse, and support the security of the website and related infrastructure.

We do not seek to collect special-category personal data through the website or newsletter subscription process.

Special-category personal data includes, for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, health data, and data concerning a person’s sex life or sexual orientation.

If special-category personal data is submitted to us without being requested, we will handle it appropriately and delete it where there is no lawful reason to retain it.

The website is not designed to use analytics tools, advertising pixels, behavioural tracking cookies, fingerprinting, or similar technologies for measuring, advertising, profiling, or cross-site tracking.

We do not intentionally set non-essential cookies for analytics or advertising purposes.

The website is proxied through Cloudflare. Depending on the security and delivery features active at a given time, Cloudflare may use strictly necessary technical mechanisms, including security cookies, to provide the service, distinguish legitimate traffic from abusive traffic, mitigate attacks, or support website availability.

We process personal data only where a legal basis applies under the General Data Protection Regulation.

Our legitimate interests include operating a reliable website, protecting our services and infrastructure, preventing misuse, responding to legitimate enquiries, maintaining appropriate records, and ensuring that newsletter preferences are respected.

Newsletter subscriptions are based on consent. You may be asked to confirm your subscription before newsletter emails are sent.

You may withdraw your consent at any time. The easiest way to do this is to use the unsubscribe link included in newsletter emails. You may also contact us at privacy@cultuur.social.

Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.

If you unsubscribe, we will stop sending newsletter emails to the relevant email address. We may retain limited information where necessary to record your preference and prevent further newsletter messages from being sent to you.

We use selected third-party service providers to host the website, provide security and delivery infrastructure, and send newsletter communications.

These providers process personal data on our behalf where they provide services to us. They may also process some information for their own independent purposes, such as account administration, billing, compliance, abuse prevention, service security, or internal operations.

We do not sell personal data.

Some service providers used in connection with the website and newsletter are established outside the European Economic Area or may process personal data in countries outside the European Economic Area, including the United States.

Where personal data is transferred outside the European Economic Area, we rely on appropriate transfer mechanisms where required. These may include an adequacy decision, participation in the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission, or other safeguards permitted by applicable data protection law.

The applicable transfer mechanism may vary depending on the provider, the service, and the processing context.

We retain personal data only for as long as necessary for the purposes for which it is processed, unless a longer period is required or permitted by law.

We may retain information for a longer period where necessary to comply with legal obligations, resolve disputes, investigate security issues, or establish, exercise, or defend legal claims.

Subject to the conditions and limitations in applicable law, you may have the following rights in relation to your personal data:

• the right to request access to your personal data;
• the right to request correction of inaccurate or incomplete data;
• the right to request erasure of your personal data;
• the right to request restriction of processing;
• the right to object to processing based on legitimate interests;
• the right to receive certain data in a portable format;
• the right to withdraw consent where processing is based on consent;
• the right not to be subject to certain decisions based solely on automated processing that produce legal or similarly significant effects.

Requests may be sent to privacy@cultuur.social.

You can unsubscribe from newsletter emails directly by using the unsubscribe link included in those emails.

We do not require additional identity verification for a straightforward unsubscribe request. For other privacy rights requests, we may request information reasonably necessary to confirm your identity and protect personal data from unauthorised disclosure.

If you have concerns about how your personal data is handled, you may contact us at privacy@cultuur.social.

You also have the right to lodge a complaint with a data protection supervisory authority. As TK is established in the Netherlands, the relevant authority is generally:

Autoriteit Persoonsgegevens
Dutch Data Protection Authority

The website and newsletter are not directed at children. We do not knowingly collect personal data from children.

If you believe that a child has provided personal data to us, please contact us at privacy@cultuur.social so that we can review the matter and take appropriate action.

We do not use personal data collected through the website or newsletter for profiling or for decisions based solely on automated processing that produce legal or similarly significant effects.

We do not use personal data submitted through the website or newsletter for AI-based processing.

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration, and disclosure.

These measures may include HTTPS/TLS encryption in transit, access controls for infrastructure, least-privilege access, backups, logging, monitoring, vulnerability management, and security controls provided by our hosting, infrastructure, and email service providers.

No system can be guaranteed to be completely secure. We therefore apply reasonable safeguards appropriate to the nature of the processing and the risks involved.

If a personal data breach occurs, we will assess its nature, scope, and likely impact. Where legally required, we will notify the Autoriteit Persoonsgegevens and/or affected individuals.

We may update this Privacy Policy when there are material changes to the website, newsletter process, service providers, categories of personal data, purposes of processing, legal bases, retention approach, contact details, or applicable legal requirements.

The date at the top of this Privacy Policy indicates when it was last updated.

Questions, requests, or concerns about this Privacy Policy or the processing of personal data may be sent to:

TK

privacy@cultuur.social