Data protection
How we handle your data
This site does not track its visitors. It uses no cookies, no analytics and no third-party scripts: when you read these pages, nothing is sent to any server other than ours.
The only data collected is what you voluntarily write in the form endorsing the Founding Declaration.
What is collected and why
From individuals: full name, email address, country and, if you choose to give them, occupation, institution and a message. From organisations: name, email, country, the person representing it and their position.
There is a single purpose: to keep the register of endorsements of the Founding Declaration and to be able to contact signatories about that endorsement.
The two consents, which are separate
The form asks two distinct things, and no box is ticked in advance. The first is the endorsement itself: without it there is no signature. The second is permission to appear in the public register of signatories, and it is optional.
Anyone who leaves the second box unticked still signs and still counts in the totals, but their name appears nowhere. You may change your mind at any time by writing to the Observatory.
What is published and what is not
For those who authorise publication, the name, the country and, where provided, the occupation or position are published. The email address is never published, never passed to anyone and never used for advertising. The free-text message is not published either.
The public list is also offered as an open file, in JSON and CSV, under a CC0 licence, so that anyone can check and quote the figures. Those files contain exactly what the page contains, with no added data.
Nothing is published before the endorsement is confirmed through the link sent by email.
Legal basis
Explicit consent under Article 6(1)(a) of the General Data Protection Regulation, given by ticking each box, and withdrawable at any time without affecting the lawfulness of processing carried out beforehand.
Abuse prevention
To stop a bot filling the register with false names, an irreversible cryptographic fingerprint of the IP address the form was sent from is stored, together with the browser identifier. The IP address itself is never stored, and the fingerprint cannot be reversed or matched against anything.
Who processes the data on the Observatory’s behalf
Hosting and the execution of the functions are provided by Netlify. The register’s database is held at Supabase, in its European region. Confirmation emails are sent by Resend. All three act as processors, under contract and with the safeguards required for international transfers.
Beyond them, the data is shared with no one.
How long it is kept
Unconfirmed endorsements are deleted after thirty days. Confirmed ones are kept while the register exists, or until the person asks for theirs to be withdrawn.
Withdrawing an endorsement deletes the name, the email, the occupation, the organisation and the message. Only the country and the dates remain, which identify no one and allow the register’s historical figures to continue to add up.
Your rights
You may request access to your data, its rectification, its erasure, restriction of processing and portability, and withdraw your consent. The unsubscribe link included in the Observatory’s emails carries out the erasure immediately, with no need to justify anything.
For anything else, write to the Observatory: [contact address pending publication]. You may also lodge a complaint with the Spanish Data Protection Agency.
Controller
Cognitive Rights Observatory. The association is in the process of being constituted; as soon as it is registered, its registered name, address and registration number will be published here.
Back to the Declaration