1. **Overview**
[democraticownershipmatters.com](https://linkprotect.cudasvc.com/url?a=http%3a%2f%2fdemocraticownershipmatters.com&c=E,1,prhUKULgJVvpsbVOiAd2SWqinO1hSH9GAtfgRQnKg_2cBdvF35sE2DDZXV360lWO5i9a_woEzagOrqnYqrZIKy6xcrHhEFSF7MsGGuC1F0UMoi35kMIRX0Rl&typo=1) is maintained by Power to Change We have a data sharing agreement in place with Transition Network LTD and other service providers (see below) if you have any questions, need to submit a data subject request. Please fill out our [GDPR form](https://helpdesk.transition-space.org/help/2737120567) or you can obtain further details by emailing [info@thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) ,by ringing us on **020 3857 7270**, or by writing to:
Power to Change\
The Clarence Centre\
6 St George’s Circus\
London SE1 6FE
2. **Analytics**
We host our own analytics server using Matomo software. [analytics.](http://analytics.transition-space.org)[thepowertochange.org.uk](mailto:info@thepowertochange.org.uk), This is hosted on [Netcup.de](http://Netcup.de) under the terms detailed below
3. **Identity service**
We use a SSO service to access the site using Keycloak software. [Id.](http://Id.transition-space.org)[thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) This is hosted on [elest.io](https://elest.io/) under the terms detailed below
4. **Helpdesk**
We use a helpdesk service to manage support tickets [helpdesk.transition-space.org](http://helpdesk.transition-space.org). This is hosted on [Netcup.de](http://Netcup.de) under the terms detailed below
5. **Cookies**
| **Cookie** | **Domain** | **Description** | **Duration** | **Type** |
| ------ | ------ | ----------- | -------- | ---- |
| **PHPSESSID** | [thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) | **This cookie is native to PHP applications. The cookie is used to store and identify a users' unique session ID for the purpose of managing user session on the website. The cookie is a session cookies and is deleted when all the browser windows are closed.** | **1 month** | **Necessary** |
| **_csrf** | [thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) | **This cookie is essential for the security of the website and visitor. It ensures visitor browsing security by preventing cross-site request forgery.** | **Session** | **Necessary** |
| **_pk_id.3.9ba3** | [thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) | **Matamo set this cookie to store a unique user ID.** | **1 year 27 days** | **Analytics** |
| **_pk_ses.3.9ba3** | [thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) | **This cookie is used to store a unique session ID for gathering information on how the users use the website.** | **30 minutes** | **Analytics** |
6. **Power to change as a Controller**
Power to change is the controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection:
[info@thepowertochange.org.uk](mailto:info@thepowertochange.org.uk) ,by ringing us on **020 3857 7270**, or by writing to:
Power to Change\
The Clarence Centre\
6 St George’s Circus\
London SE1 6FE
Under the General Data Protection Regulation (GDPR), Power to change acts as a *controller* of your personal data in the following cases:
* if you visit the [democraticownershipmatters.com](https://democraticownershipmatters.com) website
* if you register or sign up for an account on [democraticownershipmatters.com](http://democraticownershipmatters.com) and use the service (registered users)
* if you email [info@powertochange.org.uk](mailto:info@powertochange.org.uk)
7. **Transition Network as a data processor**
Transition Network and subcontractors are data processors under contract.
**What types of personal data are processed ?**
We process the following types of personal data:
* **Registered user information:** email address, userid, password, IP address, metadata, subscriptions, and server preferences.
* **Profile information**: profile picture, bio, profile metadata (which may infer details about our users).
* **Follower and following information**: For registered users on [democraticownershipmatters.com](http://democraticownershipmatters.com), this includes information about the user’s followers and who the user is following. In some cases, this information may include the name, email/contact information (if provided), and other profile information as well as publicly-shared posts of follower/following users.
* **Content**: Posts, DMs, likes, support tickets
* **Website Visitors**: IP address, metadata.
* **Metadata**: Information about the terminal or machine used to connect to [democraticownershipmatters.com](https://democraticownershipmatters.com), your machine's operating system, display resolution, web browser and browser version, date of access to the website, and details your logged-in sessions. If you email us, we may also see email header information.
**Just to be safe, avoid sharing sensitive information via DMs. Use Signal, or some other encrypted channel.**
9. **Purposes for processing data**
Personal data noted above is processed because otherwise the service doesn't really work.
* **Registered user information** is necessary to provision and administer accounts.
* **Profile information** is provided by you and can be as much or as little as you desire. Ditto for **follower/following information** and **content**. If you include special category data in your profile information, such as details about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or health information, or details about your sexual orientation or sex life, you are, *legally-speaking*, making this information ‘manifestly public’, which is a very lawyerly way of saying “it’s on you.”
* **IP address and other machine identifiers** are collected by default in the service for the purposes of allowing us block/disable access to problematic users or bots, to render the site properly on different devices, and because that is how the internet generally works.
Some information (such as user access, registration, errors, etc.) are also stored in separate Linux system logs (SystemD), which are also maintained on [Netcup.de](http://netcup.de). These logs serve the purpose of maintenance and security of the server, and are rotated every 14 days.
Backups are further retained for 90 days on Scaleaway
10. **Legal basis for processing data**
Power to change relies on **consent** for processing follower information, posts, DMs, likes..
We rely on your consent if you create an account, update your profile, follow users, post, contact us via our email address, or open a support ticket at [helpdesk.transition-space.org](http://helpdesk.transition-space.org)
In the unlikely event that you do something dodgy on the site (like violate our [Terms or Community Guidelines](https://vive.transitiontogether.org.uk/legal/page/view?pageKey=terms)), Power to change relies on legitimate interests for subsequent processing (i.e., account suspension, deletion, or if necessary, reporting to authorities). If we are served with a legal order requiring us to provide information relating to you in connection with suspected or alleged misuse of the service, and we comply with that order, the lawful basis will be **necessity to comply with a legal obligation**. Please don't let it come to that.
Power to change rely on **contractual necessity** and **legitimate interests** to host this website and deal with emails. Power to change have agreements in place with Transition [Network.org](http://Network.org) for service management They have agreements in place for hosting, We backup data to Scaleaway. We have agreements with [Mailgun ](https://www.mailgun.com/gdpr/)for delivery of email
11. **Retaining your data**
Using our [GDPR form](https://vive.transitiontogether.org.uk/s/transition-together/survey/show/single?id=11) you can request deletion your account and data
The [democraticownershipmatters.com](https://democraticownershipmatters.com) server attempts to delete content stored in logs automatically after 14 days, to make optimal use of server space. At the moment, we disable accounts after a period of inactivity, so if you create an account here, it will remain on our server until:
* You choose to delete it;
* You do not access the service for 770 days
* We delete the account manually;
* We delete the service;
* Something really bad happens (thermonuclear war, the heat death of the universe, etc.)
12. **Exercising your rights**
You have the right to request access to and rectification or erasure of personal data. You can also ask us to restrict processing or object to processing (to the extent that's possible).
To contact us, including to exercise your rights, please [fill out this GDPR form ](https://helpdesk.transition-space.org/help/2737120567)or alternatively send an email to [info@powertochange.org.uk](mailto:info@powertochange.org.uk)
You can also change your profile information directly at any time by going to Settings -> Profile and making changes there.
In terms of the right of portability, you can request your data at any time using this [GDPR form](https://helpdesk.transition-space.org/help/2737120567)
You also have the right to lodge a complaint with a Supervisory Authority. As a controller, the Lead Supervisory Authority for Power to change is the information commissioner's office in the UK. You can find more information about lodging a complaint with the ICO by going to [https://ico.org.uk/make-a-complaint/](https://ico.org.uk/make-a-complaint/)
13. **Security**
Except where you make data 'manifestly public’ (see point 9. above) Personal data processed by [democraticownershipmatters.com](https://democraticownershipmatters.com) is accessible only to the Power to change admin team and those under contract to Power to change. In addition to limited access, the following additional security measures are in place:
* Strong, robust identity management & authentication, including 2FA for our servers;
* Reasonable security hardening of the server itself;
* Daily, redundant backups of instance data;
* Encryption in transit (TLS 1.3, via LetsEncrypt);
* Encryption at rest on Scaleaway;
* Data processing agreements in place with our subprocessors.
We rely on assurances provided by Netcup, [Elest.io](http://Elest.io) Scaleaway and SINCH AB regarding their own technical and organisational measures. Details on Sub-processor controls can be found below:
Transition Network c/o Darnells, 30 Fore Street, Totnes, Devon, TQ9 5RP. UK +44 (0)1803 865 669 [https://transitionnetwork.org/privacy-policy/](https://transitionnetwork.org/privacy-policy/)
Elestio 66 Fitzwilliam Square Dublin, 2 D02 AT27 Ireland, Europe [https://docs.elest.io/books/legal-compliance/page/elestio-data-processing-agreement](https://docs.elest.io/books/legal-compliance/page/elestio-data-processing-agreement)
SCALEWAY S.A.S, BP 438, F-75366 Paris Cedex 08 (Backup) [https://www.scaleway.com/en/privacy-policy/](https://www.scaleway.com/en/privacy-policy/)
NETCUP GmbH Daimlerstraße 25 76185 Karlsruhe (SSO system, ID system, Analytics) [https://www.netcup.eu/kontakt/datenschutzerklaerung.php](https://www.netcup.eu/kontakt/datenschutzerklaerung.php)
SINCH AB Lindhagensgatan 74 Stockholm, 112 18 Sweden (email delivery) [https://www.mailgun.com/legal/dpa/](https://www.mailgun.com/legal/dpa/)
14. **Transfers Outside of the EU**
This service uses hosting based in the EU & relies on sub-processors considered adequate by the EU.
Of course, by posting, your profile information and your content is available globally, so please think twice before posting anything personal, and do not post the personal data of anyone else!