​Definitions
 

Personal Data: any information relating to an identified or identifiable natural person.

Participant: an individual whose personal data is collected or processed.

Processing: any operation or set of operations performed on personal data.

Controller: the party that determines the purposes and means of processing (usually the Client or Voices That Count, depending on the context).

Processor: a party processing personal data on behalf of the controller.

Project: any structured activity, study, programme, consultation, or engagement undertaken by Voices That Count, either independently or on behalf of a Client, which involves the collection, processing, analysis, or reporting of personal or narrative data from Participants. A Project may include but is not limited to:
•    the design and implementation of surveys, interviews, or story collection tools (such as SenseMaker);
•    the collection of individual experiences, opinions, or demographic data;
•    the analysis and interpretation of collected data;
•    the delivery of findings or results to the Client or to the public, in accordance with the agreed scope.
Each Project is governed by a specific mandate, agreement, or contract, and is subject to the terms of this Data Privacy Policy.
​

Scope of application

​

This Policy applies to all personal data collected and processed by Voices That Count, whether in the context of its own initiatives or projects executed on behalf of Clients. It applies to data collected both directly by Voices That Count and indirectly via its Clients or third-party service providers.

​

​

A. Our way of working with our Clients

​

1. What Personal Data do we collect?

 

In the execution of its projects, Voices That Count may collect the following categories of data:

 

• Narrative data, including sometimes sensitive personal stories;

• Anonymous stories in an unstructured form with additional label questions and demographic questions which might include personal data (gender, age, etc.).

• Profile Data (e.g., age, gender, location) of individuals participating in our Human Sensor Network projects;

• We sometimes also collect names, e-mail addresses or phone numbers of participants who want to stay informed about the conclusions or results of the project. They are always voluntarily provided by the participants.

 

Data may be collected in anonymized or non-anonymized form, depending on the design of the project.

​

2. How do we collect Personal Data?

 

We do not collect or store personal information without explicit permission of the person who shares its data. 

During data collection processes, personal Data is either collected through offline (paper forms) or online (app or url) applications. 

Specifically for Sensemaker projects, personal data is uploaded to the SenseMaker Collection software supported by the Cynefin Company.

If we interview people, it is possible that - with the permission of the interviewee - we audio or video record the conversation. 

​

3. How do we use your personal Data and who has access to it?
 

All personal data shall be processed solely for the purposes outlined at the time of collection, as explicitly authorized by the Participants and/or Client. We only hold Data on our systems for the period necessary to fulfil the purposes outlined in this privacy policy or until our Clients request that the Data has to be deleted.

The Data is only visible to dedicated contact person(s) of our Clients and to the direct Voices That Count experts who carry out the processing and analysis.

If personal Data is transferred to our Clients, data Privacy policies of our Clients apply.  

​

4. How do we store your personal Data?

 

All Data, including Personal data, is stored using a combination of secured third-party software and internal platforms, including but not limited to:

• Data collection: Cognitive Edge, Tape App, SurveyMonkey

• Storage and processing: Dropbox, Google Drive, AWS

• Data analysis: R/Shiny dashboards, Tableau, VTC dashboards, Cognitive Edge SenseMaker platform

 

We never pass any personal Data to other parties, unless this is required for the execution of the objectives for which they were supplied. With these parties (processors), we make the necessary processing arrangements to guarantee safety of your personal Data. 
 

All SenseMaker software used is GDPR compliant. When respondents provide Data via the SenseMaker Collection process, Cynefin Company does not use or access the Data. The only use of respondent Data pertains to analysis as part of the SenseMaker Data analytics and Data export functions which are only available to authorized client users. Detailed information related to their privacy policy can be consulted on the website of the Cynefin Company. 

If personal Data is transferred to our clients, data Privacy policies of our clients apply.  
 

5. When to archive and erase your personal Data? 
 

Voices That Count and its third-party software partners store data during the entire lifespan of each project. After the completion of each project, we ask clear instructions from our clients on data storage and archiving. 

​

• Datasets containing strictly personal data (names, e-mail addresses, physical addresses or telephone numbers) will be deleted from the data processing workspaces (see chapter 4) on the personal computers of Voices That Count collaborators after completion of the project, i.e. after all analysis is done within the agreed scope of the project.

• Datasets where personal data (such as gender, place of residence, …) cannot be traced to a specific person (anonymized data) can be stored longer on the personal workspaces of Voices That Count collaborators in case further analysis is needed in the future. 

• Full raw datasets can be stored on the servers of data collection software partners we work with (see chapter 4) for a longer period of time.   

 

In all cases, if the client decides to remove and delete the collected data, Voices That Count will erase all data files for the respective locations, or instruct third parties to do so. ​​

​

6. Data security

 

Voices That Count has implemented appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of personal data, including:

• Access to our accounts are controlled by a unique user name and strong password 

• Data stored on our Voices That Count Dropbox team folders are protected with two-factor authentication

• Regular security reviews of all platforms and procedures
   

Our collaborators (incl. freelancers) are informed about the importance of protection of personal Data and agreements are taken up in our contracts with them.
 

​