Differences

This shows you the differences between two versions of the page.

--- hub:privacy_policy [2025/01/02 17:38] – external edit 127.0.0.1
+++ hub:privacy_policy [2026/05/14 18:35] (current) – davidpjonker
@@ Line 1: / Line 1: @@
 ====== Privacy Policy ======
-We are pleased that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to inform you at this point which of your personal data we collect when you visit our website and for what purposes it is used.
+We are pleased that you are visiting our website. Protecting the personal information you share with us is important to Perceptful.AI Inc. This Privacy Policy explains what personal information we collect when you use the Open Foresight Hub, why we collect it, how we use it, who we share it with, and the rights and choices available to you.
-This privacy policy applies to the Open Foresight Hub Website, which can be reached under the domain www.openforesighthub.org as well as the various subdomains ("our website").
+This Privacy Policy applies to the Open Foresight Hub website, available at www.openforesighthub.org and its subdomains ("our website"). It is provided in accordance with the //Personal Information Protection and Electronic Documents Act// (PIPEDA), the //Canadian Anti-Spam Legislation// (CASL), and applicable provincial privacy and consumer-protection laws of Ontario, Canada.
 =====Who is responsible and how can I reach you?=====
-====Responsible====
+====Accountability====
-for the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)
+Perceptful.AI Inc. is accountable for personal information in its custody or control. We have designated a Privacy Officer who is responsible for our compliance with this Privacy Policy and applicable Canadian privacy law.
-Foresight Academy GmbH \\
+Perceptful.AI Inc.\\
-Hochbrückenstraße 6 \\
+PO Box 28025\\
-Munich \\
+Waterloo RPO Parkdale, Ontario\\
-Germany\\
+Canada N2L 6J8\\
-+49 (0) 176 70274296\\
+Privacy Officer: <privacy@perceptful.ai>\\
-Carmen.Fischer-Seeger@foresightacademy.com\\
-=====What is it about?=====
+=====What is this policy about?=====
-This privacy statement complies with the legal requirements for transparency in the processing of personal data. This is any information relating to an identified or identifiable natural person. This includes, for example, information such as your name, age, address, telephone number, date of birth, e-mail address, IP address or user behavior when visiting a website. Information for which we cannot (or can only with a disproportionate effort) establish a reference to your person, e.g. by anonymization, is not personal data. The processing of personal data (e.g. collection, retrieval, use, storage or transmission) always requires a legal basis and a defined purpose.
+This Privacy Policy describes our practices for handling //personal information// — information about an identifiable individual. This includes, for example, your name, email address, phone number, IP address, account credentials, or behavioural data collected while you use our website. Information that has been irreversibly anonymized or aggregated is not personal information.
-Stored personal data will be deleted as soon as the purpose of the processing has been achieved and there are no legitimate reasons for further storage of the data. We will inform you about the specific storage periods or criteria for storage in the individual processing operations. Irrespective of this, we store your personal in individual cases for the assertion, exercise or defense of legal claims and if there are statutory retention obligations.
+We only collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and only with your knowledge and consent (express or implied), except where the law allows or requires otherwise.
-=====Who gets my data?=====
+We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to comply with legal or regulatory requirements, or to establish, exercise, or defend legal claims. We will inform you of specific retention periods in the relevant processing sections below.
-We only share your personal data that we process on our website with third parties if this is necessary for the fulfillment of the purposes and is covered by the legal basis in the individual case (e.g. consent or protection of legitimate interests). In addition, we share personal data with third parties in individual cases if this serves the assertion, exercise or defense of legal claims. Possible recipients may then be, for example, law enforcement agencies, lawyers, auditors, courts, etc.
-Insofar as we use service providers for the operation of our website who process personal data on our behalf within the scope of commissioned processing pursuant to Art. 28 GDPR, they may be recipients of your personal data. For more information on the use of processors and web services, please refer to the overview of the individual processing operations.
+=====Who receives my information?=====
+We share personal information with third parties only where:
+  * it is necessary to fulfill the purposes described in this Privacy Policy and we have a lawful basis to do so;
+  * we have your consent;
+  * we engage service providers ("processors") who handle personal information on our behalf under a written agreement that limits their use of the information to the purposes we specify and requires comparable safeguards; or
+  * disclosure is required or permitted by law (for example, to law enforcement, regulators, courts, or our legal advisors).
+Some of our service providers are located outside Canada, including in the United States. Personal information transferred outside Canada is subject to the laws of the foreign jurisdiction, which may permit access by foreign courts, law enforcement, or national security authorities. We use contractual and technical safeguards designed to protect personal information regardless of where it is processed. Details are provided in the individual processing sections below.
 =====Do you use cookies?=====
-Cookies are small text files that are sent by us to the browser of your end device during your visit to our website and stored there. As an alternative to the use of cookies, information can also be stored in the local storage of your browser. Some functions of our website cannot be offered without the use of cookies or local storage (technically necessary cookies). Other cookies, on the other hand, enable us to perform various analyses, so that we are able, for example, to recognize the browser you are using when you visit our website again and to transmit various information to us (non-essential cookies). With the help of cookies, we can, among other things, make our website more user-friendly and effective for you, for example by tracking your use of our website and determining your preferred settings (e.g. country and language settings). If third parties process information by using cookies, they collect the information directly from your browser. Cookies do not cause any damage to your end device. They cannot execute programs or contain viruses.
+Cookies are small text files placed in your browser when you visit our website. Information may also be stored in your browser's local storage. Some cookies and storage are //strictly necessary// for the website to function (for example, to keep you signed in or remember your preferences). Other cookies are //optional// and are only set with your consent — for example, to analyze how the website is used or to deliver embedded content.
-We provide information about the respective services for which we use cookies in the individual processing operations. You can find detailed information about the cookies used in the cookie settings or in the Consent Manager of this website.
+You can manage your preferences at any time through the cookie/consent banner or your browser settings. You can find detailed information about the cookies we use in our consent manager.
-=====What rights do I have?=====
+=====What are my rights?=====
-Under the terms of the statutory provisions of the General Data Protection Regulation (GDPR), you have the following rights as a data subject:
+Under PIPEDA and applicable provincial laws, you have the following rights with respect to your personal information:
-  * Information pursuant to Art. 15 GDPR about the data stored about you in the form of significant information about the details of the processing and a copy of your data;
+  * **Access**: you may request access to personal information we hold about you and an account of how it has been used and to whom it has been disclosed.
-  * Rectification according to Art. 16 GDPR of incorrect or incomplete data stored by us;
+  * **Correction**: you may ask us to correct personal information that is inaccurate or incomplete.
-  * Erasure pursuant to Art. 17 GDPR of the data stored by us, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims;
+  * **Withdrawal of consent**: you may withdraw your consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may affect our ability to provide certain services to you.
-  * Restriction of processing pursuant to Art. 18 GDPR, insofar as the accuracy of the data is disputed, the processing is unlawful, we no longer need the data and you object to their erasure because you need them for the assertion, exercise or defense of legal claims or you have objected to the processing pursuant to Art. 21 GDPR.
+  * **Deletion**: you may request that we delete personal information we no longer need for the purposes for which it was collected, subject to legal retention obligations.
-  * Data portability pursuant to Art. 20 GDPR, insofar as you have provided us with personal data within the scope of consent pursuant to Art. 6 (1) (a) GDPR or on the basis of a contract pursuant to Art. 6 (1) (b) GDPR and these have been processed by us with the aid of automated processes. You will receive your data in a structured, common and machine-readable format or we will transfer the data directly to another responsible party, insofar as this is technically feasible.
+  * **Complain**: you may file a complaint about our handling of your personal information by contacting our Privacy Officer at <privacy@perceptful.ai>. If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or, where applicable, your provincial privacy regulator.
-  * Objection pursuant to Art. 21 GDPR against the processing of your personal data, insofar as this is carried out on the basis of Art. 6 (1) e, f GDPR and there are reasons for this that arise from your particular situation or the objection is addressed to direct advertising. The right to object does not exist if overriding compelling legitimate reasons for the processing are demonstrated or the processing is carried out for the assertion, exercise or defense of legal claims. Where the right to object does not exist for individual processing operations, it is indicated there.
-  * Revocation pursuant to Art. 7 (3) GDPR of your granted consent with effect for the future.
+We will respond to access and correction requests within 30 days, as required by PIPEDA. We may ask you to verify your identity before responding. There is no fee for routine requests.
-  * Complaint pursuant to Art. 77 GDPR to a supervisory authority if you believe that the processing of your personal data violates the GDPR. As a rule, you can contact the supervisory authority of your usual place of residence, your place of work or our company headquarters.
+=====How is my information processed in detail?=====
-=====How is my data processed in detail?=====
+The following sections describe each processing activity, the personal information involved, why we collect it, the legal basis for processing under PIPEDA, and how long we keep the data. We do not make decisions about you based solely on automated processing, including profiling.
-In the following, we inform you about the individual processing operations, the scope and purpose of the data processing, the legal basis, the obligation to provide your data and the respective storage period. An automated decision in individual cases, including profiling does not take place.
 ====Provision of the website====
-===Type and scope of processing===
+===What we collect===
-When accessing and using our website, we collect the personal data that your browser automatically transmits to our server. The following information is temporarily stored in a so-called log file:
+When you access our website, your browser automatically sends us certain information that we temporarily store in server log files:
-  * IP address of the requesting computer.
+  * IP address of the requesting device
   * Date and time of access
-  * Name and URL of the accessed file
+  * Name and URL of the file requested
-  * Website from which the access is made (referrer URL)
+  * Referring website (referrer URL)
-  * Browser used and, if applicable, the operating system of your computer, as well as the name of your access provider.
+  * Browser type and operating system, and the name of your internet service provider
-Our website is not hosted by ourselves, but by a service provider who processes the aforementioned data on our behalf in accordance with Art. 28 GDPR. Our website is hosted by Netlify. When you access one of our web pages, your browser therefore establishes a connection to a server of Netlify, Inc, 610 22nd Street, Suite 315, San Francisco, CA 94107, USA. You can find more information on how Netlify processes your data in Netlify's privacy policy at https://www.netlify.com/privacy/.
+Our website is hosted by peaknetworks Hosting GmbH, Eduard-Bodem-Gasse 5–7, 6020 Innsbruck, Austria, which processes this information on our behalf under a written service agreement.
-===Purpose and legal basis===
+===Purpose and basis===
-The processing is carried out to protect our overriding legitimate interest to display our website and ensure security and stability on the basis of Art. 6 (1) f GDPR. The collection of data and storage in log files is mandatory for the operation of the website. There is no right to object to the processing due to the exception under Art. 21 (1) GDPR. Insofar as the further storage of log files is required by law, the processing is based on Art. 6 (1) c GDPR. There is no legal or contractual obligation to provide the data, however, accessing our website is technically not possible without providing the data.
+We process this information to deliver our website to you, to maintain its security and stability, and to detect and prevent abuse. Our legal basis under PIPEDA is //implied consent//, supported by our legitimate business interest in operating the website. Collection of this information is technically necessary to display the website — without it we cannot serve our pages to your browser.
-===Storage period===
-The aforementioned data is stored for the duration of the display of the website.
+===Retention===
+Server log data is retained only for the time necessary to operate the website and investigate technical or security issues, after which it is deleted or aggregated.
 ====Newsletter====
-===Type and scope of processing===
+===What we collect===
-If you register on our website to receive our newsletter, we collect your e-mail address and store this information together with the date of registration and your IP address. Subsequently, you will receive an e-mail in which you must confirm your registration for the newsletter (double opt-in). If you do not confirm the registration, it will automatically expire and the data will not be processed for the newsletter dispatch.
+If you sign up to receive our newsletter, we collect your email address along with the date of registration and your IP address. We then send a confirmation email and only add you to the list once you confirm (double opt-in). If you do not confirm, your registration expires and your information is not used to send you the newsletter.
-To send the newsletter, we use a service that processes your personal data on our behalf in accordance with Art. 28 GDPR. Your data will not be passed on to third parties.
+We use a third-party newsletter service that processes this information on our behalf. Your information is not sold or shared with unrelated third parties.
-===Purpose and legal basis===
+===Purpose and basis===
-We process your data for the purpose of sending the newsletter on the basis of your consent pursuant to Art. 6 (1) a GDPR. By unsubscribing from the newsletter, you can declare your revocation at any time with effect for the future pursuant to Art. 7 (3) GDPR. There is no legal or contractual obligation to provide your data, but sending the newsletter is not possible without the provision of your data.
+We process this information with your //express consent// to send you the newsletter, in accordance with PIPEDA and CASL. You can withdraw your consent at any time by using the unsubscribe link in any newsletter or by writing to <unsubscribe@perceptful.ai>. Providing your email address is voluntary, but it is required to deliver the newsletter.
-===Storage period===
+===Retention===
-After registration for the newsletter, we store the data at most until the confirmation of the registration. After successful confirmation, we store your data until you revoke your consent (unsubscribe from the newsletter).
+We retain your email address until you unsubscribe or withdraw consent, after which it is removed from the active mailing list. We may retain a suppression record of unsubscribed addresses to comply with CASL.
 ====Registration of a user account====
-===Type and scope of processing===
+===What we collect===
-For the use of certain areas of our website, you have the option to register a user account. The information collected during registration via the mandatory fields is required to provide access to the user account. In addition, you may voluntarily provide additional information for supplementary (convenience) functions.
+Certain features of our website require you to register a user account. The information collected through mandatory fields is required to create and operate your account. You may also choose to provide additional optional information for supplementary features.
-For the registration of a user account, your personal data will be disclosed exclusively in accordance with this privacy policy.
+===Purpose and basis===
+We process this information to fulfill our agreement with you to provide a user account and the related services (PIPEDA: necessary for the performance of a contract with you). Providing the mandatory information is a condition of registering an account; without it we cannot create your account. Optional information is processed on the basis of your //express consent//, which you may withdraw at any time by deleting that information from your account.
-For user administration and authentication, we use the Supabased tool from the provider Supabase, Inc, 970 Toa Payoh North #07-04, Singapore. In order to provide the services, it is necessary to process the contact details you used for your registration. This is a mutual interest on the basis of Art. 6 (1) lit. f GDPR.
+===Retention===
+We retain account information for as long as your account is active. After you delete your account or end the contractual relationship, we retain personal information only where required by law (for example, tax or commercial-record retention) or to establish, exercise, or defend legal claims. Optional information is retained until you withdraw consent or delete the information, whichever is earlier.
-We have concluded an order processing contract according to Art. 28 GDPR with Supabase as well as standard contractual clauses, which place a transfer to a third country under appropriate data protection and oblige the processor to process your data only within the scope of our instructions.
-You can find further information on data protection at https://supabase.com/privacy.
-===Purpose and legal basis===
-We process your data for the purpose of providing you with a user account to fulfill a contract with you pursuant to Art. 6 (1) b GDPR. There is a contractual obligation to provide your data, as this information is required to identify you and for the fulfillment of the contract on our behalf. There is no legal obligation to provide the data. Without the provision of this information, the registration of a user account and thus the conclusion of a contract is not possible.
-Furthermore, the processing of additional voluntarily provided information for the purpose of providing further (comfort) functions is based on your consent pursuant to Art. 6 (1) a GDPR. By deactivating the functions / By deleting the voluntary information in the user account, you can declare your revocation at any time with effect for the future pursuant to Art. 7 (3) GDPR.
-===Storage period===
-We store your personal data in the context of providing the user account for the duration of the contractual relationship. After the end of the contract / deletion of the user account, your data will only be stored further if there are legal retention obligations (e.g. tax and commercial law).
-Additional information that you provide to us on the basis of your consent will only be stored until you revoke your consent by deactivating the functions / by deleting the data, but at the longest until the end of the contract on which the provision of the user account is based.
 ====Presence on social media platforms====
-We maintain so-called fan pages or accounts or channels on the networks mentioned below in order to provide you with information and offers also within social networks and to offer you further ways to contact us and to inform yourself about our offers. In the following, we inform you about the data that we or the respective social network process from you in context with the access and use of our fan pages/accounts.
+We maintain pages, accounts, or channels on certain third-party social media networks so that we can share information about our work and provide additional ways to interact with us. The sections below describe how we and the relevant social media networks process information when you interact with us through those channels.
-===Data that we process from you===
-If you wish to contact us via Messenger or via Direct Message via the respective social network, we generally process your user name via which you contact us and, if applicable, store further data provided by you insofar as this is necessary to process/respond to your request.
-The legal basis is Art. 6 (1) f GDPR (processing is necessary to protect the legitimate interests of the controller).
-(Static) Usage Data we Receive from the Social Networks
-We receive automatically provided statistics regarding our accounts via Insights functionalities. The statistics include, among other things, the total number of page views, likes, information on page activities and post interactions, reach, video views, and information on the proportion of men/women among our fans/followers.
-The statistics only contain aggregated data that cannot be related to individual persons. You are not identifiable to us by this.
-===Which data the social networks process from you===
-In order to view the content of our fan pages or accounts, you do not have to be a member of the respective social network and, to this extent, no user account for the respective social network is required.
-Please note, however, that when you visit the respective social network, the social networks also collect and store data from website visitors without a user account (e.g. technical data in order to be able to display the website to you) and use cookies and similar technologies, over which we have no control. Details on this can be found in the privacy policy of the respective social network (see the corresponding links above)
+===Information we process===
+If you contact us through a messaging or direct-message feature on a social network, we generally process the username you use to contact us and any additional information you provide that is necessary to respond to your request. Our legal basis under PIPEDA is //implied consent//, supported by our legitimate business interest in responding to inquiries.
-Insofar as you wish to interact with the content on our fan pages/accounts, e.g. comment on, share or like our postings/contributions and/or contact us via messenger functions, prior registration with the respective social network and the provision of personal data is required.
+We may also receive aggregated statistics from the social networks about activity on our pages (for example, total page views, follower demographics, and post engagement). These statistics are aggregated and do not identify you individually.
-We have no influence on the data processing by the social networks within the scope of their use by you. To our knowledge, your data is stored and processed in particular with regard to the provision of the services of the respective social network, as well as for the analysis of user behavior (using cookies, pixels/web beacons and similar technologies), on the basis of which advertising based on your interests is played both within and outside the respective social network. It cannot be ruled out that your data will be stored by the social networks outside the EU/EEA and passed on to third parties.
-Information on, among other things, the exact scope and purposes of the processing of your personal data, the storage period/deletion as well as guidelines on the use of cookies and similar technologies in the context of registration and use of the social networks can be found in the privacy policy/cookie policy of the social networks. There you will also find information on your rights and objection options.
+===Information processed by the social networks===
+You do not need an account with a social network to view our public pages there. However, the social networks may still collect information about visitors using cookies and similar technologies. If you interact with our content (for example, comment, share, like, or message), you typically need to be signed in to that network and the network will process your information in accordance with its own privacy policy.
+We have no control over how the social networks process information collected through their platforms. They may store and process information outside Canada and may share it with their own affiliates and partners. Please review each network's privacy policy for details about its processing, retention, transfers, and your rights.
 ====Google Fonts====
-===Type and scope of processing===
+===What we collect===
-We use Google Fonts from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a service to provide fonts for our online offering. To obtain these fonts, you establish a connection to the servers of Google Ireland Limited, whereby your IP address is transmitted.
+We use Google Fonts, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to serve typefaces used on our website. When fonts are loaded, your browser connects to Google's servers and your IP address is transmitted.
-Google Analytics uses cookies and other browser technologies to evaluate user behaviour and recognize users.
+===Purpose and basis===
+We use Google Fonts to ensure consistent and accessible typography across our website. Our legal basis under PIPEDA is //consent//, obtained through our cookie/consent banner before non-essential connections are made.
-This information is used, among other things, to compile reports on website activity.
+===International transfers===
+Google Fonts may transfer information to servers located outside Canada, including in the United States. We rely on Google's contractual and technical safeguards for international transfers. You can find more information in Google's privacy policy at https://policies.google.com/privacy.
-===Purpose and legal basis===
+===Retention===
-The use of Google Fonts is based on your consent in accordance with Art. 6 (1) lit. a. GDPR and § 25 (1) TDDDG.
+We do not control the retention of information processed by Google. Please refer to Google's privacy policy for details.
-===Data transfer to the USA===
+=====Changes to this Privacy Policy=====
-Insofar as personal data is transmitted to servers in the USA when using Google Fonts, this is done on the basis of the EU Commission's adequacy decision on the Data Privacy Framework pursuant to Art. 45 para. 1 GDPR. If necessary, we will also ask you for your consent in accordance with Art. 49 para. 1 lit. a GDPR.
+We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last Modified" date below indicates when the policy was last revised. Material changes will be communicated through a notice on the website or, where appropriate, directly to you.
-===Storage period===
-The specific storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Further information can be found in the privacy policy for Google Fonts: https://policies.google.com/privacy.