BIRN Hub is committed to safeguarding the privacy of the users of the website www.bird.tools. This Privacy Policy statement explains the data processing practices of Balkan Investigative Regional Reporting Network (hereinafter: “BIRN Hub” or “we”).
PRIVACY NOTICE
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – GDPR, regulates all important aspects of the data processing activities of the Data Controllers and Data Processors in the EU, as well as for data processing activities of the Data Controllers and Data Processors in non-EU countries when data processing operations are related to:
- the offering of goods or services to the data subjects in EU, irrespective of whether a payment of the data subject is required (e.g. e-commerce services, touristic services etc.);
- the monitoring of behaviour of data subjects in EU as far as their behaviour takes place within the Union.
BIRN Hub, with the registered address at Branilaca Sarajeva 14/1, Sarajevo Bosnia and Herzegovina, collects, processes and uses particular data from the data subjects, as the Data Controller within the meaning of Article 4 Paragraph 1 Point 7 of the GDPR, in order to send them media content produced by BIRN Hub and its affiliates and transfer organisations.
TYPE OF PERSONAL DATA THAT ARE PROCESSING
BIRN Hub collects, uses and in other manner processes the following personal data of the data subjects:
● Name and surname;
● E-mail of the data subject;
● Username and password of the data subject;
● Images uploaded by BIRD Community’s members;
● Data imported to BIRD Source from open source datasets;
● Data enabled though FOI requests;
● Data provided to BIRD Community[1] though the BIRD Source[2] registration form;
● Data from the Forum and Bulletin Board sections;
● The data that is relevant depending on the concrete GET HELP section
In addition to the above, BIRN Hub collects, uses and, in other manners, processes the following personal data of the data subjects for the purposes of maintaining the BIRD Directory:
- Phone number of the data subject;
- Field of expertise of the data subject;
- Profession/affiliation of the data subject.
All uploaded information is protected each step of the way. However, BIRN Hub keeps the right to manage (deny/approve) datasets that you upload to BIRD Source.
Legal basis for the processing of the above mentioned data is mainly performance of a contract to which the data subject is a party to or in order to take steps at the request of the data subject prior to entering into a contract (the concrete rights and obligations will depend on the concrete GET HELP section and member’s activity on BIRD Community), pursuant to Article 6 Paragraph 1 Point b) of the GDPR.
Legal basis for the processing of data for the purposes of maintaining BIRD Directory is Article 85 Paragraph 2 of the GDPR, which defines journalistic exemption or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.
LEGAL BASIS OF DATA PROCESSING AND PURPOSE OF PROCESSING
BIRN Hub also collects and uses the personal data of the data subject for the purpose of sending the Newsletter, other media content produced by BIRN Hub or its affiliates and partners, and for the purpose of monitoring incidents and assisting data subject via the GET HELP section on the www.bird.tools website. Additionally, BIRN Hub collects the data given through www.birdcommunity.tools and source.bird.tools, these data are only being used for the purpose of the platforms’ functionality.
DATA PROCESSING ACTIVITIES
BIRN Hub performs the following data processing activities:
- collection;
- recording;
- organisation;
- structuring;
- storage;
- adaptation or alteration;
- retrieval;
- consultation;
- use;
- disclosure by transmission, dissemination or otherwise making available to the authorized persons;
- alignment or combination;
- restriction;
- erasure or destruction;
- other processing activities which are necessary for the purpose defined in Point 2 of this Privacy Notice.
CATEGORIES OF SUBJECTS THAT HAS ACCESS TO PERSONAL DATA
Beside BIRN Hub, the following categories of subjects have access to personal data:
● BIRN Network members;
● BIRD Community members[3];
● BIRN partner Share Foundation;
● Companies that install and maintain the ICT system of BIRN Hub;
● Companies that perform the security services to BIRN Hub;
The above mentioned subjects have access and, in another manner, process the data only within the purpose described in Point 3 of this Privacy Notice, and are not authorised to process data in the manner that exceeds such purposes.
BIRD Community members are strictly prohibited from copying, distributing, performing, displaying the BIRD Directory data in commercial or any other way that is not envisioned by the purpose of the BIRD Directory.
BIRN Hub keeps the right to manage membership requests (deny/approve) and remove profiles that misuse the platform or violate BIRN’s code of ethics.
Members who conduct one of the following actions (non-exhausting list) will be removed from the BIRD Community:
- Insulting or discriminating other platform members;
- Unauthorised processing of the information or content from the platform;
- Use of the platform for illegal actions;
- Distribution and copying of the contacts from BIRD Directory;
- Harassment and share of hateful or discriminatory content.
The above mentioned subjects will be obliged to implement the data protection standards and requirements of GDPR. BIRN Hub concluded the data processing agreements (DPA) in order to ensure compliance with such requirements.
The above mentioned subjects will be obliged to implement the encryption or pseudonymisation measures whenever it is technically feasible.
DATA SUBJECTS RIGHTS
The data subject has the following rights in relation to the above processing activities:
● Right to access personal data: data subject can at any time request information from BIRN Hub whether or not his/her personal data are being processed, and for what purpose. In the case of such request, BIRN Hub will deliver the required information and a copy of the personal data which is processed in an electronic form and free of charge, if such request for a copy is made by the data subject;
● Right to rectification: the data subject can at any time obtain the rectification of his/her inaccurate personal data without undue delay, in cases when his/her personal data is inaccurate;
● Right to be forgotten: the data subject can at any time request the erasure of the personal data if certain conditions are met, i.e, personal data is no longer necessary for achieving its purpose or when the data subject withdraws his/her consent on data processing.
● Right to restriction of processing: the data subject has the right to request the restriction of processing if specific conditions are met e.g, BIRN Hub does not need the data subject’s personal data anymore, but they are required by the data subject for the establishment, exercise or defence of legal claims regarding the GET HELP section;
● Right on data portability: the data subject has the right to request to receive his/her personal data, which he/she has provided to BIRN Hub, in a structured, commonly used and machine-readable format, as well as the right to transmit those data to another controller, if specific conditions are met;
● Right to object: the data subject has the right to object at any time to the processing of his/her personal data based on legitimate interest. In case of objection, BIRN Hub as a data controller shall no longer process the data subject’s personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims;
● Rights in relation to the automated individual decision-making, including profiling: the data subject has the right not to be subject to a decision based solely on automatic processing;
● Right to be informed in case of a data breach: the data subject has the right to be informed about a data breach with no further delay, if specific conditions are met;
● Right to address the data protection authority.
PROTECTION MEASURES
BIRN Hub within its organisation implements all the necessary organisational, technical and personnel measures in order to ensure the highest possible protection of personal data, including but not limited to:
● Technical measures of protection;
● Control of the physical access to the system where personal data is stored;
● Control of data transfer;
● Control of personal data entry;
● Personal data access control;
● Applicable information security measures;
● All other measures necessary to ensure adequate levels of data protection.
For the sake of clarity, the subjects from Point 4 of this Privacy Notice are also obliged to implement the above-mentioned measures.
STORAGE TIME
BIRN Hub stores personal data, as long as they are needed in order to fulfil the purpose from the Point 3 of this Privacy Notice.
If the data subject no longer wants to receive the Newsletter and other media content materials, he/she can send a notice via the following email address: support@birn.eu.com. After cancellation, BIRN Hub will erase all the stored personal data of the data subject, as soon as possible but not later than 10 days from the day of cancellation.
Personal data, which is processed in the context of the agreement with BIRN Hub, including for the purpose of provision of the services under the GET HELP section, will be stored until the agreement is enforced, and after its determination, BIRN Hub has the right to keep personal data which can be useful in case of legal disputes, taking into account applicable statutes of limitation but with observance on obsolescence deadlines.
Personal data which is collected during the monitoring of digital rights and freedoms in the targeted countries will be stored for five years.
CONTACTS
For all additional questions, comments and information in relation to the exercising of the data subjects’ rights you may address BIRN Hub via telephone at +387 33 266 615, or via the following email address: support@birn.eu.com.
This Privacy Notice shall enter into force on March 1, 2020.
[1] BIRD Community is a networking platform where our alumni and journalists reporting on Southeastern and Central Europe can meet colleagues from different countries and interact to exchange ideas, data and information, collaborate on existing projects, or start new ones.
In order to become a member of the BIRD Community, the user needs to register by filling out the registration form. BIRN Hub is approving the membership status of the users.The user can delete its account at any time.
[2] BIRD Source is a comprehensive database of documents the BIRN team scraped and obtained through FOI laws, and collected from sources.
After you register on BIRD Community, you will receive an email inviting you to create your profile to access BIRD Source. When you create your profile, you will be given free access to search all BIRD Source databases, upload your own documents and leaks and sketch a diagram to summarise your investigative findings.
[3] Registered BIRD Community members have access to the BIRD Directory which represents a database of expert contacts.