![Involved logo](https://cdn.prod.website-files.com/64a92e76c2052d300e93272e/65a4fcdd9ca04e38935521f7_INVOLVED_DRK_PRPL_SHADOW.png)
Data Protection and Privacy Statement
Latest update: 16.08.2024
Aarhus, Denmark
Data protection is among our highest priorities at Involved. When we invite users to participate in an Involved session, we promise them anonymity. This is a promise we take seriously. We are committed to ensuring this anonymity and that everyone can participate in an Involved session without personal data being tracked, used, or shared in any way. We do this for two reasons:
This is the reason we have made the choice not to store or treat personal data from participants. We do not ask participants to log in or identify themselves before a session. We do not even log IP addresses of our participants. Additionally, there is no third-party analytics or tracking service linked to our participant platform.
If you have any questions or concerns about data collection or user anonymity, you can call our CEO, Sara Høyer Kragelund, at +45 5157 8240, or contact our CTO, Geert Vandensteen, at Geert@involved.live for technical questions, comments, or concerns.
In the document below, we have detailed our data collection practices for your Legal or IT department to review. This includes:
Once again, don’t hesitate to contact us if you have questions, concerns, or need more information. Anonymity and data protection are among our highest priorities, and if there is anything we can do to improve, we want to know!
Kind regards,
Sara Høyer Kragelund & Geert Vandensteen
CEO & CTO and Co-founders of Involved
www.getinvolved.io
Involved does not log any IP addresses. Involved does not store or treat personal data collected in a digital session. Instead, users receive a unique code to enter the session prepared for them. In the session, participants can anonymously give their input to the questions prepared. This input is stored, but it is not linkable to a physical person.
Involved's online sessions are browser-based. To participate in an Involved session, participants are provided with a unique link or code to the relevant online dialogue prepared for them. Participants are not asked to identify themselves in any way, as the dialogues are anonymous.
When a user joins an Involved session, it happens through the AWS API Gateway. A user connects anonymously and receives a random identifier in a token. The API Gateway does not communicate to the backend of the Involved platform where the participant is connecting from, nor does it log it. This means the Involved platform backend only knows the randomly assigned ID from the participant and can tell how many people are connected to a specific session, but not where they are connecting from, or any other factors which would serve as identifiers.
Participants may enter an Involved session directly from our website www.getinvolved.io. To ensure we do not compromise our promise of anonymity, we use a self-hosted analytics platform (Matomo) for tracking on our website. This platform shows who is visiting www.getinvolved.io, but is configured to drop the last 8 bits of the IP address. A visitor will be shown as 255.255.255.xxx. In addition, the analytics platform does not know which session a specific user connects to.
To facilitate an online session, Involved utilises various AWS services exclusively hosted in the EU-central-1 region (Frankfurt). These services are described in Section 2.
i. Involved does not log any IP addresses. Involved does not store or treat personal data collected in a digital session. Instead, users receive a unique code to enter the session prepared for them. In the session, participants can anonymously give their input to the questions prepared. This input is stored, but it is not linkable to a physical person.
i. Involved stores server log data to identify bugs and enhance the functionality of our software.
ii. No personal data is logged in the logging system. Personal data or IP addresses will not be written to the log files.
To facilitate a session, Involved utilises various AWS services. The services used can have logging configured for them so they log relevant data in the AWS log aggregator (AWS CloudWatch). Involved's services are configured in such a way that no personal data (including IP addresses) are logged in AWS. AWS does not perform separate logging of our data or requests. In its Data Processing Addendum, AWS guarantees not to access, use, or disclose our data unless it is necessary to provide the service, or in case of a court order (in which case we are notified first).
The services used for customer data are hosted exclusively in the EU-central-1 region. As the networking is also hosted in the EU-central-1 region, no traffic is sent to any data centers outside the EU to host a session. All services used in an Involved session, as well as the location of the service, are described below:
Involved implements appropriate technical and organizational measures to safeguard all data that enters our platform. This includes opinions that Involved participants write anonymously. (As these opinions cannot be linked to a specific individual, they do not constitute 'personal data' as per the definition of the European Commission). These measures are designed to prevent unauthorized access, loss, alteration, or disclosure of data.
Participants of an Involved session can access their sessions without visiting our website. This happens via a link directly to their Involved session where we have not implemented any tracking or analytics services.
For our general website www.getinvolved.io, we use the on-premise solution of Matomo Analytics hosted on our AWS servers in Frankfurt, Germany. The data is owned by Involved, and no third party has access to the data, which is stored in Europe. Learn more about Matomo here: https://matomo.org/privacy/
Involved collects contact information, such as email addresses, names, and last names, through personal business contacts, business relations of Involved consultants, and people reaching out to Involved's contact email addresses. This information is used for communication purposes and maintaining business relationships. Individuals can request to be forgotten and stop receiving emails by contacting the email address: sara@involved.live.
Involved can, if requested by the client, collect contact information provided by clients (data controllers) for the successful completion of projects. The use of this data is specified in the contract with the client. Contact information can be used for project-related activities, such as sending invitations to online dialogues, surveys, or other agreed-upon activities between the client and Involved. Involved acts strictly as a data processor in these cases, and the client remains in control of the data.
iv. Information provided by clients will be deleted after the completion of the project.
Involved collects resumes of individuals who contact Involved for potential job opportunities. Resumes are kept confidential and discussed internally within Involved.
iii. Resumes will be kept until the end of employment or will be deleted if a person is turned down for a vacancy. Open job applications may be kept for a longer period.
Involved retains personal data only for as long as necessary for the purposes outlined in this document or as required by law. Once data is no longer needed, it will be securely deleted or anonymized to ensure continued privacy protection.
Data subjects have the right to access, rectify, erase, restrict, and object to the processing of their personal data. To exercise these rights or inquire about any privacy concerns, data subjects can contact Involved at sara@involved.live.
Involved complies with applicable data protection laws and regulations, including the General Data Protection Regulation (GDPR), in the collection, processing, and storage of personal data.
Involved reserves the right to modify or update this document as necessary. Any changes will be communicated to relevant stakeholders and will be effective upon posting the updated version on the Involved website or other appropriate platforms.
For further information or clarification on data processing and privacy practices, please contact:
Involved CEO,
Sara Høyer Kragelund
Risdalsvej 13
8260 Viby J
Denmark
Email: sara@involved.live