Privacy Notice

Version 1.2 · August 2026

Not yet reviewed by counsel. This notice was adapted from the campaign privacy policy for the chat platform. It describes what the platform actually does, but it has not been checked by a lawyer.

Controller

Responsible for the processing of personal data on this platform within the meaning of the General Data Protection Regulation (GDPR):

E+M People Act Platform FlexCo, Paulinengasse 18/5/17, 1180 Vienna, Austria. Email: contact@save-europe-act.com

Data protection officer

We have appointed a data protection officer. You can reach them at Datenschutz@save-europe-act.com with questions, suggestions or complaints about the processing of your personal data and about exercising your rights.

General information

Personal data is any information relating to an identified or identifiable natural person. We process personal data only where there is a legal basis for doing so: in particular where processing is necessary to perform a measure you have requested, where we have a legitimate interest, or where you have given your consent.

Supporting or taking part in a political campaign can reveal political opinions or beliefs. Such information is special category data under Art. 9 GDPR. We process it only on the basis of your explicit consent under Art. 9(2)(a) GDPR. You may withdraw that consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before the withdrawal.

The chat platform

This platform is a Matrix homeserver with a web client. When you create an account and use it, the following is stored on our servers:

your user name, your password (salted and hashed, never in clear text) and your confirmed email address;
the rooms you belong to and your level of participation;
the messages you write and the files you upload, including their metadata such as time of sending;
your chosen country and region, and the postal code of the area where you want to volunteer: this is the area you picked for your activity, not necessarily where you live, as long as you have provided them;
which version of the community rules and of this notice you accepted, and when;
technical access logs of the web server, including IP addresses.

Messages in this platform are **not** end-to-end encrypted. This is a deliberate decision so that moderation is possible: people who administer the server can, in principle, read room content. Treat the platform accordingly and do not share anything there that must remain secret from the operator.

The homeserver is **not federated** with other Matrix servers. Your account cannot be reached from other servers, and rooms are not visible from outside.

The chat is built on Element Web, free software under the AGPL-3.0 license. Its source code is available at https://github.com/element-hq/element-web: this notice is the source offer required by that license.

The servers are operated within the European Union. Registration mails and password-reset mails are sent through an email delivery service; for that purpose your email address, the time of sending and technical delivery information are processed.

Legal basis is your explicit consent under Art. 9(2)(a) GDPR for the content that reveals political affiliation, and Art. 6(1)(b) GDPR for operating the account you asked for.

Server log files

When you access the platform, technically necessary data is processed: IP address, date and time, the page or file requested, browser type and version, operating system, and technical protocol, security and error data.

When you sign in to the administration interface, we additionally record what your browser reports about itself: language, platform and version, screen size, time zone, and on Android the device model. This is a trail for detecting misuse of accounts that hold responsibility for others; it is self-reported by the browser and is evidence of nothing on its own.

Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, functioning and traceable operation of the platform.

Volunteering and national coordination

If you make yourself available as a volunteer, a local contact or for national coordination, we process the information you submit: in particular your name and contact details, your place of residence or area of activity, and the kind of involvement you are looking for.

This serves to organise and carry out campaign activities, to get in touch with you, and to form local or national teams.

Where this information allows conclusions about political opinions or beliefs, processing is based on your explicit consent under Art. 9(2)(a) GDPR. Data is passed to national coordinators or local teams only where this is necessary for the involvement you asked for.

Cookies and local storage

We use only technically necessary cookies and comparable technologies: a session cookie so that you stay signed in, and local storage in your browser for your own settings, such as light or dark appearance. There is no tracking, no analytics and no advertising technology on this platform.

Legal basis is Section 25(2) TDDDG together with Art. 6(1)(f) GDPR.

Recipients of personal data

Personal data may be passed to the following categories of recipients:

providers of hosting and technical infrastructure;
providers of email delivery;
national coordinators, local teams or partner organisations, where this is necessary for the involvement you asked for;
authorities, courts or legal advisers, where we are legally obliged to do so or where it is necessary to establish, exercise or defend legal claims.

We do not sell or rent personal data.

Transfers to third countries

The servers of this platform are operated within the European Union. Where a service provider processes data outside the European Union or the European Economic Area, this only happens under the conditions of Art. 44 ff. GDPR: in particular on the basis of an adequacy decision of the European Commission or of standard contractual clauses, supplemented where necessary by additional technical and organisational measures.

How long we keep data

We keep personal data only as long as it is necessary for the purpose concerned, or as long as statutory retention obligations require.

Account, rooms and messages: for as long as the account exists. If you ask us to delete your account, its content becomes inaccessible; individual messages may remain in the rooms they were sent to, because a Matrix room is a shared history.
Country, region, the postal code of your volunteering area and the record of your consent: for as long as the account exists, and beyond that only as evidence that consent was given.
Web server access logs: 30 days.
Sign-in records for the administration interface: 90 days.
Invitations, including the email address they were sent to: 12 months.

Your rights

Within the limits of the law you have the following rights:

access to your personal data (Art. 15 GDPR);
rectification of inaccurate and completion of incomplete data (Art. 16 GDPR);
erasure of your personal data (Art. 17 GDPR);
restriction of processing (Art. 18 GDPR);
data portability (Art. 20 GDPR);
objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR);
withdrawal of a consent you have given (Art. 7(3) GDPR);
to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, contact us at contact@save-europe-act.com or our data protection officer at Datenschutz@save-europe-act.com.

Right to complain to a supervisory authority

You have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

For the controller, the competent authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, Austria: https://www.dsb.gv.at/

back to sign-up