Privacy notice
This notice explains how we process the personal data you give us when you fill in a form on forms.360democracy.com, in line with the EU General Data Protection Regulation (GDPR), the Belgian Law of 30 July 2018 on data protection and Directive 2002/58/EC on privacy and electronic communications.
1. Data controller
The Democratic Society AISBL (Democratic Society), an international non-profit association under Belgian law.
BeCentral, Cantersteen 10, 1000 Brussels, Belgium
Data protection contact: domenico.ds@demsoc.eu · www.demsoc.org
2. What data we process
- The answers you type into the form. Depending on the form, these may include your name, your email address or other information you are asked for.
- The date and time of your submission.
We do not store your IP address, device or location with your answers, and you do not need an account. To prevent abuse we keep hashed technical identifiers for 24 hours (they do not reveal who you are); they are then deleted automatically.
3. Why, and on what legal basis
- For the purpose described in each form (for example registering for an event, taking part in a consultation or answering a survey). Legal basis: your consent (Art. 6(1)(a) GDPR), given by submitting the form or ticking its consent box. You can withdraw it at any time (Art. 7(3)) without affecting earlier processing.
- To email you a copy of your answers, when the form does so and you give us your address. Legal basis: your consent.
- To protect the service against automated submissions and abuse. Legal basis: our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).
We do not make automated decisions or build profiles about you (Art. 22 GDPR). We never use your data for advertising and never sell it.
4. Where your data is stored: in the European Union
- Hosting: forms and answers live on our own server in a data centre of Gandi SAS (63-65 Boulevard Masséna, 75013 Paris, France) located in France.
- Email: the copy of your answers is sent through Brevo SAS (17 rue Salneuve, 75017 Paris, France), which stores and processes data on servers in the European Union. Brevo records technical delivery and opening data for the email.
Gandi and Brevo are European companies subject to the GDPR. They act as processors, only on our instructions and under the data processing agreements required by Art. 28 GDPR that form part of their terms of service. We do not transfer your data outside the European Economic Area.
5. Who has access
Only authorised Democratic Society staff running the form, who log in with a password and two-step verification. We do not share your data with anyone else, except the processors above or where the law requires it.
6. How long we keep it
- Answers: only as long as needed for the purpose of the form. We then delete them.
- The server's daily backups are overwritten after 30 days, so deleted data also disappears from them within that time.
- Anti-abuse technical identifiers: 24 hours.
7. Cookies
We use no analytics, advertising or third-party cookies, and these pages load nothing from other servers (no fonts, scripts or statistics). We only use strictly necessary cookies, which do not require consent (Art. 5(3) of Directive 2002/58/EC):
answered_…: only when a form allows one response per browser. It remembers that you have already responded. Lasts 12 months.forms_admin: only for the staff who manage the forms. Keeps them logged in and is deleted when the browser closes.
8. Security
All connections are encrypted with HTTPS (TLS), including email delivery. Managing the forms requires a password and two-step verification, the server only accepts SSH key logins, and it is backed up daily.
9. Your rights
Under Articles 15 to 21 GDPR you can ask us, free of charge, to access your data, correct it, erase it, restrict its processing, receive it in a portable format, object to processing based on legitimate interest and withdraw your consent. Write to domenico.ds@demsoc.eu naming the form and the email address you responded with. We reply within one month (Art. 12(3) GDPR) and may ask you to confirm your identity.
10. Complaints
If you think we are not handling your data properly, you can complain to the Belgian supervisory authority, the Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be, or to the authority of the EU country where you live or work (Art. 77 GDPR).
11. Changes
If we change this notice, we will publish the new version here with its date.