Important Information

1. Introduction and Scope

In compliance with the General Data Protection Regulation (GDPR) of the European Union, this Data Privacy Declaration (hereinafter, the “Declaration”) aims to inform Users of Jamiihub about:

• The personal data processed by Norwegian Church Aid

• The purposes for which this personal data is processed;

• The methods employed for processing this personal data; and

• The organizational and technical measures taken to ensure the protection of processed personal data and uphold the rights of data subjects.

It also specifies the rights of data subjects concerning the processing of their personal data through Jamiihub.

2. Identity and Contact Details

2.1. Complete Identity and Address

Norwegian Church Aid is a Norwegian non-profit organization with its registered office in Norway, listed in the commercial register under reference 951 434 353. Its main address is:

P.O. box 7100, St. Olavs plass, 0130 Oslo, Norway

2.2. Data Protection Officer

The Data Protection Officer (pursuant to Articles 37 et seq. GDPR) of is

Bjørn Are Geithus. Head of Division, Global IT.

3. Activities in Connection with Jamiihub

Norwegian Church Aid provides and operates the Jamiihub platform (located at https://voca.city) based on open-source Decidim software, enabling participatory processes on chosen topics.

• First-level Users: Contractual employees of Norwegian Church Aid

• Second-level Users: Third parties or institutions that have engaged Norwegian Church Aid (or its partners) to facilitate participatory processes with their own communities.

• Participants: Individuals invited by first-level or second-level Users to express opinions, comments, or votes on one or more specific topics.

3.1. Contractual Partners

• Octree Sàrl (Switzerland), technology partner, host the platform Jamiihub and provide technical services to Norwegian Church Aid.

4. Role in Data Processing

Norwegian Church Aid processes personal data for different categories of individuals:

1. Contractual employees & partner users (first and second level)

2. Participants (described in section 5.3 below)

When processing data of its own employees, Norwegian Church Aid acts as data controller (Article 4(7) GDPR).
When processing data of second-level users and participants on behalf of others, Norwegian Church Aid generally acts as data processor (Article 4(8) GDPR). However, it may also act as data controller if it must verify Jamiihub’s compliance with concluded contracts and the platform’s general terms of use.

5. Categories of Data Processed

5.1. Participants

Norwegian Church Aid processes personal data related to individuals participating in processes on Jamiihub. This data may include:

a) Identification Data

• Phone number(s)

b) User Account Data

• User ID or username

• Date, time, and duration of the last connection

• Technical configuration data (e.g., browser info)

c) Data Related to Participation

• Messages, exchanges, and comments made within a participatory process

• Votes or positions taken on participatory topic

Some of this data could be sensitive (e.g., indicating political opinions).

5.2. First and Second-Level Users

• Contact and login details (e.g., username)

• Data necessary to verify compliance with contractual obligations and the general terms of use of Jamiihub

• Information needed to provide assistance and troubleshoot issues

5.3. Purposes of Processing

1. Verifying compliance with concluded contracts and the general terms of use of Jamiihub.

2. Providing support for technical or usage-related problems.

3. Enabling platform operation for the participatory processes hosted on Jamiihub.

4. Hosting personal data securely and in accordance with applicable regulations.

5. Ensuring user identification to maintain privacy, secure discussions, and manage private communities.

6. Gathering inputs (opinions, comments, votes) on relevant topics of each participatory process.

6. Recipients of Personal Data

All data processed by Norwegian Church Aid is hosted on servers provided by Infomaniak Group SA (“Infomaniak”), which acts as:

• A data processor for Norwegian Church Aid when Norwegian Church Aid itself is the data controller;

• A sub-processor when Norwegian Church Aid is the processor on behalf of a client.

Personal data is not disclosed to any parties other than:

1. Infomaniak, for hosting purposes;

2. Contractual partners that have engaged Norwegian Church Aid to organize or administrate Jamiihub-based participatory processes;

3. Authorized Jamiihub users (first-level or second-level) who manage a specific participatory process and need relevant participant data.

7. Consent and Respect for Personality

By taking part in participatory processes on Jamiihub, data subjects:

1. Explicitly consent to the processing of their data as outlined in this Declaration.

2. Acknowledge and accept that some data may be sensitive (e.g., political opinions).

3. Understand that Norwegian Church Aid does not process data for any regulatory or non-agreed commercial use.

4. Recognize that declining to provide certain personal data:

   • Second-Level Users: Means they cannot access or use Jamiihub to create or manage participatory processes.

   • Participants: Means they cannot join a given participatory process.

8. Location of Data Processing

Personal data is primarily processed in Norway and Switzerland (hosted by Infomaniak). Switzerland benefits from an adequacy decision by the European Commission (Article 45 GDPR).
Occasionally, data may be processed in Portugal, a country recognized by the Swiss Federal Council under Article 16(1) LPD as having adequate data protection legislation.

9. Security Measures and Retention

9.1. Technical and Organizational Measures

• Data is hosted on servers protected by robust security controls preventing unauthorized access, alteration, or disclosure.

• Only duly authorized personnel of Norwegian Church Aid (or its sub-processors) can access personal data, and only when required for the purposes outlined in this Declaration.

• Regular backups ensure availability and quick restoration in case of incident.

9.2. Retention and Destruction

• Data is destroyed or anonymized once it is no longer needed for the stated purposes.

• Sensitive personal data (e.g., political opinions) is typically deleted or anonymized as soon as the relevant participatory process concludes, unless a user organizing the process explicitly requires longer retention. In such cases, the data is pseudonymized, encrypted, or otherwise rendered non-identifiable.

10. Rights of Data Subjects

In compliance with GDPR, data subjects have the following rights:

1. Right of Access (Article 15 GDPR):

   • You may request confirmation on whether your data is being processed. If so, Norwegian Church Aid will provide, within 30 days and free of charge, details such as the data’s origin, recipients, storage duration, and purpose.

2. Right to Data Portability (Article 20 GDPR):

   • You may request your personal data in a structured, commonly used, machine-readable format, and/or have it transmitted directly to a third party.

3. Right to Rectification (Article 16 GDPR):

   • If you believe your personal data is inaccurate or incomplete, you can request correction or completion.

   • If accuracy cannot be confirmed or disputed, you may request a note indicating the data is under dispute.

4. Right to Withdraw Consent and Erasure (Article 17 GDPR):

   • You may withdraw your consent at any time, without affecting the lawfulness of prior processing.

   • Upon withdrawal, you can request the erasure of your data. Norwegian Church Aid will also inform other data processors or controllers to delete all references, copies, or reproductions of that data.

5. Right to Restriction of Processing (Article 18 GDPR):

   • You can request restricted processing if data accuracy is contested, the processing is unlawful, or data is no longer needed except for legal claims.

   • During restriction, the data (except for retention) can only be processed with your consent or for legal claims.

11. Contact and Updates

For questions or to exercise any of the rights above, please contact Norwegian Church Aid

• By mail at the address indicated in Section 2.1 of this Declaration;

• By email: nca-oslo@nca.no

Norwegian Church Aid may update this Declaration without prior notice, particularly to comply with evolving data protection regulations. The current version published on https://nca.voca.city/pages/terms-and-conditions is the only valid version.