Privacy Policy

This document is a template and must be reviewed by legal counsel before publication.

Introduction

The IEDDC Foundation (the Foundation, we, us) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect through this website, why we collect it, how long we keep it and what rights you have. It has been prepared in line with the General Data Protection Regulation (GDPR).

This website has been designed to collect as little personal data as possible. Personal data is collected only when you choose to submit the contact form.

Data controller

The controller responsible for the processing of your personal data is:

[Legal name and registered address of the Foundation — to be completed]

Contact for data protection requests

For any question about this policy or to exercise your rights, please contact us at:

[Contact email for privacy requests — to be completed]

[Details of a data protection officer, if appointed — to be completed]

Personal data we collect

We collect personal data only through the contact form on this website. When you submit the form, we process the following data:

your name;
your email address;
the name of your organisation (optional);
the subject of your enquiry;
the category of your enquiry you select;
the content of your message;
the date and time at which you gave your consent;
your IP address, which is not stored in readable form but only as a salted, pseudonymised hash used for abuse prevention;
the user agent of your browser (information about your browser type and version).

Please do not include sensitive personal data (such as information about health, political opinions or religious beliefs) in your message.

Purposes of processing

We process this data for the following purposes:

to receive, read and respond to your enquiry and to handle any follow-up correspondence;
to protect the contact form and our systems against spam, misuse and abuse.

We do not use your data for marketing, profiling or automated decision-making, and we do not sell it.

Legal basis for processing

Consent (Art. 6(1)(a) GDPR): we process the data you submit through the contact form on the basis of the consent you give when submitting it.
Legitimate interest (Art. 6(1)(f) GDPR): we process the pseudonymised IP address hash and browser user agent on the basis of our legitimate interest in preventing abuse of the contact form and keeping our website secure.

Retention period

Contact form submissions are deleted automatically after a configurable retention period, which is set by default to 12 months from the date of submission. Data may be deleted earlier if it is no longer needed or if you request erasure, unless we are legally required to keep it.

Recipients of personal data

Your personal data is accessible only to authorised staff of the Foundation who need it to handle your enquiry. Our website is operated on infrastructure provided by a hosting provider that acts as a data processor on our behalf, under a data processing agreement:

[Name and location of the hosting provider — to be completed]

We do not share your personal data with any other third party unless required by law.

Transfers outside the European Economic Area

We do not transfer your personal data outside the European Economic Area (EEA) unless stated below. If any such transfer becomes necessary, it will take place only with appropriate safeguards in accordance with the GDPR.

[Details of any transfers outside the EEA and applicable safeguards — to be completed, or confirm that none take place]

Your rights

Under the GDPR, you have the following rights regarding your personal data:

Right of access — to obtain confirmation of whether we process your data and a copy of it;
Right to rectification — to have inaccurate or incomplete data corrected;
Right to erasure — to have your data deleted;
Right to restriction of processing — to limit how we use your data in certain circumstances;
Right to data portability — to receive the data you provided in a structured, commonly used and machine-readable format;
Right to object — to object to processing based on our legitimate interests;
Right to withdraw consent — to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us using the details above. We will respond within the time limits set by the GDPR.

Right to lodge a complaint

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority competent for the Foundation is:

[Competent supervisory authority — to be completed]

No tracking, analytics or third-party content

This website does not use tracking or advertising cookies.
No analytics tools are enabled by default. Should analytics be introduced in the future, they will be loaded only after you have given your explicit opt-in consent, and this policy will be updated beforehand.
The website does not include third-party embeds such as social media plugins, video players or maps.
Fonts and other resources are self-hosted, so your browser does not connect to third-party servers when you visit the website.

For more information, please see our Cookie Policy.

Security

We apply appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encrypted connections, access restricted to authorised staff, pseudonymisation of IP addresses and automatic deletion of data after the retention period.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The current version is always available on this page, and the date of the latest update is indicated below.

Last updated: [Date of last update — to be completed]