Skip to content
Public Order Initiative
Language:en
Menu

Privacy policy

We collect as little personal data as possible, use it only for this petition, and delete it when it is no longer needed. This policy explains what we do in plain language, as required by the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The controller is the organisers of the European Public Order Initiative (“we”, “the organisers”). To protect the safety of the people involved, we do not publish the names or addresses of individual organisers.

For any question about your data, or to exercise your rights, write to privacy@public-order.eu. This address is read by the organisers who are responsible for the signature database.

2. What we collect when you sign

Data Required Why
Your name Yes To show that each signature belongs to a real person and to detect abuse.
Your country of residence Yes To report the number of signatures per country.
Your e-mail address No To prevent duplicate signatures and, only if you tick the box, to send you a few updates about the petition.
Language, date and time of signing Automatic To run the petition and to report its progress.
Result of the security check (yes/no) Automatic To count only signatures that passed the automated check.

Because signing a petition reveals a political opinion, your signature is a special category of personal data (Article 9 GDPR). We treat it accordingly.

What we do not collect: we do not store your IP address, your browser details or any tracking identifiers. We do not use analytics cookies, advertising cookies or social-media trackers.

If you do not ask for updates, we do not store your e-mail address. We only keep a one-way cryptographic fingerprint (a salted hash) of it, which lets us recognise a second signature with the same address but does not allow us to read or use the address.

We process your data on the basis of your explicit consent (Article 6(1)(a) and Article 9(2)(a) GDPR), which you give by ticking the consent box before signing. You can withdraw your consent at any time — see section 7. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

4. How we use your data

  • Counting: the public counter shows only the total number of verified signatures.
  • Handing over the petition: when we present the petition to decision-makers, we report the total number of signatures and the number per country. We do not publish or hand over names or e-mail addresses.
  • Updates: only if you asked for them — at most a few e-mails about the progress and outcome of the petition. Each e-mail explains how to unsubscribe. You can also write to privacy@public-order.eu at any time. When you unsubscribe, we delete your e-mail address and keep only its fingerprint, so that your signature still counts.
  • Abuse prevention: we may review signatures to remove obvious fakes, duplicates or offensive entries.

We never sell, rent or share your data for marketing purposes and never use it for any other campaign without your separate consent.

5. Service providers

The website and database are hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which acts as our processor under a data processing agreement. The signature database is stored in Cloudflare’s EU jurisdiction. When you visit the website, Cloudflare necessarily processes your IP address in order to deliver the pages and protect the site against attacks; this data is not shared with us in identifiable form.

The signature form uses Cloudflare Turnstile to check that signatures come from humans, not bots. Turnstile works without tracking cookies and without showing you puzzles in most cases. It processes technical information about your browser and connection only for this check. See Cloudflare’s Turnstile privacy addendum.

Where Cloudflare processes data outside the European Economic Area, this is covered by the EU–US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

We keep signatures until the petition is closed and handed over, and no longer than six months after that. We then delete names, e-mail addresses and fingerprints permanently, keeping only anonymous totals (number of signatures per country). If you withdraw your signature, it is deleted from the database immediately. Our host keeps encrypted backups of the database for disaster recovery only; they expire automatically within 30 days, and we would never restore withdrawn signatures from them.

7. Your rights

You have the right to:

  • access your data and receive a copy of it;
  • have inaccurate data corrected;
  • have your data deleted (“right to be forgotten”);
  • restrict or object to its processing;
  • receive your data in a portable format;
  • withdraw your consent at any time.

The easiest way to delete your signature is to use the withdrawal code you received after signing on the withdrawal page. The deletion is immediate (for backups, see section 6).

If you have lost your code, write to privacy@public-order.eu — from the e-mail address you signed with, if you gave one. We will answer within one month, as required by the GDPR. To protect you, we may ask for information that confirms the request is really yours.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. A list of authorities is available from the European Data Protection Board.

8. Cookies and local storage

This website sets no cookies. It stores two things in your own browser, and neither is ever sent to us:

  • if you switch between light and dark mode, your choice is saved in your browser’s local storage;
  • right after you sign, your withdrawal code is kept in your browser’s session storage, so that the thank-you page can show it and the withdrawal page can fill it in for you. It is removed when you withdraw your signature, and your browser deletes it when you close the tab.

9. Security

All connections are encrypted (HTTPS). Access to the database is restricted to a small number of organisers who need it, protected by strong authentication. E-mail fingerprints and withdrawal codes are stored only as salted hashes.

10. Children

The petition is intended for people aged 16 and over. If you are younger, please do not sign.

11. Changes to this policy

If we change this policy, we will publish the new version here with a new date. We will not use data already collected for new purposes without your consent.