EOOH PRIVACY NOTICE

1: Who are we?

We are Textgain, a company with limited liability organized and existing under the laws of Belgium, having its registered address at Lodewijk Van Berckenlaan 180/2, 2140 Antwerp, Belgium and registered under company number 0643.751.089 (hereinafter “Textgain”, “we”, “us”, “our”).

Together with other consortium members (see https://eooh.eu/about-us), Textgain has developed and deployed an online platform called EOOH in the context of research on hate speech and the combat thereof. To this end, EOOH, through an AI-based monitoring tool, collects publicly available information, from, amongst other sources, social media platforms. EOOH is a project supported by the European Commission’s Rights, Equality and Citizenship Programme (DG Justice). 

2: What does this Privacy Notice cover?

This Privacy Notice describes and explains how we (as consortium leader) collect, use and share any information that, used alone or in combination with other information, relates to you (your “personal data”) in the context of EOOH. 

We value your right to privacy and strive to protect your personal data in accordance with the applicable data protection legislation, including the General Data Protection Regulation 2016/679 (“GDPR”) and its Belgian implementing laws, such as the Framework Act of 30 July 2018. We will only collect and use your personal data in the manner and for the purposes as described in this document and that are consistent with our obligations and your rights under the applicable legislation and regulations.  

This Privacy Notice therefore describes and explains in particular:

• what personal data we collect;

• for what purposes and how we may use/process such personal data;

• on what legal basis we may process your personal data;

• how we store the personal data;

• for what period we store the personal data; and

• what your rights are under the applicable data protection and privacy legislation.

From time to time, we may need to update this Privacy Notice. This may be necessary, for example, if the law changes or if we change our business in a way that affects the way we process personal data. The most recent version of this Privacy Notice will always be available on our website https://eooh.eu/privacy-policy●. You may also ask us to send you a copy of the most recent version of this Privacy Notice. If we have your contact details, any amendments will moreover be brought to your personal attention.

Please also note that, in relation to direct marketing, i.e. when you subscribe to receive our mailings with news and updates, you have a right to opt-out (unsubscribe) at any time, by clicking the “unsubscribe” button in our e-mails or by contacting us as indicated in Section 11 of this document.

3: What role do we play in the processing of your personal data?

Pursuant to applicable data protection and privacy legislation, we qualify as the controller with respect to the processing of your personal data.

Where we collect and process your personal data for research & development purposes, i.e. testing and improving the EOOH platform and tool, we qualify as joint controller together with the experts we carefully selected to this end. Such experts include, amongst others, research organizations, universities, NGOs, police- and security services, social media, policy makers and journalists. We have concluded joint controller agreements with them in accordance with the GDPR, in which we have made arrangements about our joint responsibilities with regard to the processing of your personal data.

Where we collect and process your personal data for the purpose of sending you our newsletter, we qualify as joint controllers with our consortium partners, i.e. Dare To Be Grey, PDCS and University of Applied Sciences Utrecht. We have concluded joint controller agreements with them in accordance with the GDPR, in which we have made arrangements about our joint responsibilities with regard to the processing of your personal data.

As we are managing EOOH, we have in particular agreed that Textgain will take the lead for handling and responding to any questions or concerns you may have and for making available this Privacy Notice. For more information regarding the joint controllership and the arrangements made in this respect you may contact us via the contact details indicated in Section 11 of this document.

4: Whose personal data do we collect?

This Privacy Notice is relevant for anyone whose personal data we may process in the context of EOOH, which includes individuals using publicly available features of social media platforms, such as Twitter, Facebook, Instagram and 4Chan to write comments or to post tweets or other content.  

Additionally, we also collect personal data of subscribers to our electronic mailings and, where applicable, personal data of EOOH users.

5: How do we collect your personal data?
We may collect information about you by browsing through publicly available information on social media platforms, such as Facebook, Instagram, Twitter and 4Chan. 

We may also collect your personal data because you are a user of EOOH or because you have subscribed to our electronic mailings.

6: What personal data do we collect and for what purposes do we use them?

(a)

In the context of EOOH, and only to the extent such information is made publicly available by you, we might process the following personal data relating to you: 

• Your name and surname;

• Your profile picture;

• Your comments, posts and tweets;

• Your age and gender;

• Your (approximate) location.

The processing of your personal data is necessary for our legitimate interests (Article 6, par. 1, (f) GDPR) of testing the EOOH platform, on its usefulness for providing insights relevant for policy making, for combatting crime and information delivery in the context of hate speech. Being tasked by the European Commission with conducting a two-year investigation into and reporting on the fundamental nature of the dynamics of online hate, how hate manifests itself, the connections between the perpetrators and their influence as well as disinformation strategies, these interests outweigh the personal interests of individuals choosing to make personal information about themselves publicly available on social media.

Based on the content of your comments, posts and tweets, we may incidentally also process special categories of personal data (so-called “sensitive data”) such as race, political affiliation, religious/philosophical beliefs, sexual life and preferences, etc. We will only do so to the extent this information is manifestly made public by yourself on social media (Article 9, par. 2, (e) GDPR).

We do not undertake any automated decision making.

(b)

If you are a user of the EOOH tool, your identification data (name, surname, job-title) and contact details (e-mail address) will be processed by us, based on the execution of our contractual relationship with you when you register as a user (Article 6, par. 1, (b) GDPR) or, when you are an employee or contractor of a EOOH user, based on our legitimate interest to execute our contractual relationship with your employer, the EOOH user (Article 6, par 1, (f) GDPR). Based on your affiliation with a certain expert organisation (e.g. a political party), we may incidentally also process special categories of personal data (so-called “sensitive data”) such as political affiliation or religious/philosophical beliefs. We will only do so to the extent this information is manifestly made public by yourself (Article 9, par. 2, (e) GDPR).

(c)

If you sign up to receive our electronic mailings, your identification data and contact details will be processed by us in order to send you e-mails with relevant news and updates, based on your opt-in consent (Article 6, par. 1, (a) GDPR).

(d) 

If you visit our website, certain personal data relating to you will be collected and further processed. To learn more about what personal data is collected and for what purposes, please refer to our Cookie Statement on our website, that you can find here.

7: How long will we keep your personal data?

We will not store or keep your personal data for a longer period than is necessary in light of the purposes for which we process them (we refer to the purposes as listed above in Section 6). In any case, as touched upon in Section 8 below, we deploy pseudonymization and/or anonymisation upon collection of data via social media platforms. This has as a result that the data retained for the operation of the EOOH tool does not contain your specific identifiers and can in principle only be used to re-identify you to the extent your comment, post or tweet is still publicly available and consultable on the relevant social media platform and linked to your social media account. 

8: How do we protect your personal data?

We use appropriate technical and organizational measures to protect the personal data we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal data. We protect your personal data against destruction, loss, alteration, unauthorized disclosure of or access to personal data transmitted, stored or otherwise processed. More specifically, we have taken the following measures: restriction of access, security passwords, confidentiality agreements with our employees, professional anti-virus software, firewalls, locks on cupboards, offices and buildings, restrictions on the use of internet, the timely execution of software updates, periodically making backups and camera surveillance. We also use data pseudonymization and encryption, as well as anonymisation techniques, where appropriate (notably, upon collection of personal data from public sources).

Further, we seek to ensure that we keep personal data accurate and up to date. 

9: With whom do we share your personal data?

In the context of the purposes as listed above, we may share your personal data with third parties. The third parties to which we can communicate some of your personal data are the following:

• The experts who test the EOOH Platform. These experts will only see pseudonymized and/or anonymised data (as explained above). The experts will be jointly responsible with us for the processing of your personal data in the context of the EOOH platform. We entered into a joint controllership agreement with such actors;

• Our third-party suppliers, service providers and partners who provide a data processing service to us, or who process personal data for purposes described in this Privacy Notice, or who are notified to you at the time of collection of your personal data. This may include communications to our partners to support us in areas such as IT platform management or support services, infrastructure or application services;

• Any appropriate law enforcement agency, regulator, government agency, court, or other third party, when such disclosure is necessary (i) under applicable laws, (ii) to exercise, establish, or defend our rights, or (iii) to protect your vital interests or those of any other person.

Where relevant, we will implement safeguards to ensure the protection of your personal data when disclosing your personal data to a third party. For example, we will enter into data processing agreements with relevant parties, providing for restrictions on the use of your personal data and obligations with respect to the protection and security of your personal data, and will only disclose your personal data to recipients we trust.

The parties to whom we may disclose your personal data (e.g. the experts with whom we work or out service providers) may be located in countries outside the European Economic Area (EEA), which countries may offer a lower level of data protection than in the country in which we are established.  In such case, measures are taken to ensure adequate protection of your personal data in accordance with the applicable data protection legislation. Generally, we will enter into Standard Contractual Clauses (as approved by the European Commission) with the recipient of your personal data. You may contact us by sending an email or a letter to the contact details indicated below, if you wish to obtain a copy of the Standard Contractual Clauses entered into or insight into other adequate measures taken.

10: What are your rights and how can you exercise them?

You have the following statutory rights under GDPR, subject to the conditions and restrictions set out in Articles 12-22 of the GDPR:

Right to information and right to access your personal data

You may at any time request more information on our processing activities and your personal data that we are keeping, as well as a copy hereof.

Right to rectification of inaccurate or incomplete personal data

You have the right to require us to, without undue delay, rectify or complete any of your personal data that is inaccurate or incomplete.

Right to deletion of your personal data (‘right to be forgotten’) 

You may request us to delete your personal data or part of your personal data in the following situations:

• when the processing is no longer necessary for achieving the purposes for which they were collected or otherwise processed;

• when you object to the processing of your personal data within the limits of the exercise of your right to object;

• in the event we would unlawfully process your personal data; or

• when your personal data have to be erased in compliance with a legal obligation imposed on us.

Note that we may refuse to delete your personal data: (i) if it is justified by the exercise of the right of freedom of expression and information; (ii) for compliance with a legal obligation; or (iii) for the establishment, exercise or defence of legal claims.

Right to restriction of processing 

You may request us to permanently or temporarily restrict the processing of your personal data in the following situations: 

• when you have contested the accuracy of your personal data, for a period enabling us to verify their accuracy;

• in the event we would unlawfully process your personal data and you would request the restriction of the use of your data instead of the deletion of your data;

• when we no longer need the personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; or

• pending verification whether our legitimate grounds override yours within the framework of an objection.

Right to object to the processing of your personal data

When we process your personal data based on our ‘legitimate interests’, you may object to the processing of your personal data, provided that you invoke grounds relating to your particular situation. We will then no longer process your personal data, unless we have compelling legitimate grounds to do so, or if such processing is necessary for the establishment, exercise or defence of legal claims.

You may also object to the processing of your personal data for direct marketing purposes (i.e. unsubscribe from our electronic mailings) at any time, and without having to justify this decision.

Right to data portability 

In some cases, you have the right to receive all your personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller. This right applies: 

• in case the processing is based on consent or on the necessity for the performance of a contract; and

• in case the processing is carried out by automated means.

Finally, you have the right to lodge a complaint with the Belgian Data Protection Authority relating to the processing of your personal data by us. You can find the contact details of this authority on www.gegevensbeschermingsautoriteit.be. Please find a list of other EU supervisory authorities here: https://edpb.europa.eu/about-edpb/board/members_en. 

In principle you may exercise these rights free of charge. Only where requests are manifestly unfounded or excessive, we may charge a reasonable fee. Further information and advice about your rights can also be obtained from the data protection authority in your country. We might (if deemed necessary) request a proof of identity in advance in order to double-check your request.

11: Contact

If you have any questions, comments, requests or complaints in relation to this Privacy Notice or the processing of your personal data by us, please feel free to contact us by sending an e-mail to info@eooh.eu or by sending a letter to Lodewijk Van Berckenlaan 180/2, 2140 Antwerp, Belgium.