How your data is handled
This notice applies to the Response, Readiness, Conversation, Invitation and Notification forms, to the confirmation email, the automated reply, and any subsequent correspondence about the project.
In short
- We do not sell your data and do not pass it to third parties for their own purposes
- We do not publish your text, in whole or in part, without separate consent
- We do not show advertising and use no advertising or analytics trackers
- We do not send your free text to language models and do not use them to assess your position
- We do not make decisions about you automatically
- We do not send updates unless you have ticked the box for them
The full version follows. It is longer, but written in the same language: if any point is unclear, that is our failure, and you can write to us about it at the same address.
Controller and contact
The controller of personal data is Roman Voronkov, acting within the independent project The Political Unmanifest. The project has no legal entity at this stage.
The dedicated channel for data matters is privacy@politicalunmanifest.org. This address is used for requests concerning access, rectification, erasure, restriction of processing, portability and the withdrawal of consent.
No data protection officer has been designated: the scale and nature of the processing do not require one.
This is a working channel, not a formality: messages sent to it are read and answered within the periods stated in section 10.
What data is collected
The Response form
Name, email address, country of residence, age group, message type, free text and consent records.
The Readiness form
Name, email address, country of residence, age group, working languages, chosen direction, priorities for change, possible contribution, formats and time available, professional experience or a link to a profile, additional context. Citizenship is given only if you choose to.
The Conversation form on the exhibition page
Name, email address, country, enquiry type, the name of an institution and a role if you give them, and the text of the message.
The Invitation form on the school page
Name, email address, country, enquiry type, field, institution or role if you give them, and the text of the message.
The Notification form on the book page
The email address only. This form collects nothing else.
Age
The forms are intended for people aged 18 and over. Age is not verified: you confirm it by ticking the box and selecting an age group, and the project relies on that statement in good faith. Verification would require documents — that is, collecting far more sensitive data than the form exists for. If it becomes clear from the content of a message, from later correspondence, or from a parent or guardian, that a record was left by a minor, it is deleted and the correspondence ends.
Technical data
The language of the form, a reference number, date and time, working status, interaction history, and the version of the consent text in force at the moment of submission.
Abuse protection
The application temporarily stores irreversible hashes of the network address and the email address in order to limit the frequency of submissions. The network address itself is not stored in the records.
The source of the data is always the same: you. The project does not obtain information about you from other sources and does not enrich it from external databases.
Purposes and legal bases
Replying to your message and continuing the conversation
Consent — Article 6(1)(a) GDPR. Where your answer may reveal political opinions or philosophical beliefs, explicit consent under Article 9(2)(a) is also required.
Creating a readiness profile and matching tasks
Consent — Articles 6(1)(a) and 9(2)(a) GDPR. Matching is carried out manually by a person, not by an algorithm.
Notice of the English edition
Consent — Article 6(1)(a) GDPR. Exactly one email is sent, on the day of publication. The address is deleted once that email has been sent and is not used for anything else.
Anonymised and aggregated analysis
A separate optional consent. Declining does not prevent you from sending the form and does not affect the reply.
Occasional messages about the development of the projects and about tasks
A separate optional consent, given by the fourth box in the form. Without it, we contact you only about your own message. You can unsubscribe using the link in any email.
Protecting the forms from spam and abuse
Legitimate interests in the security of the service — Article 6(1)(f) GDPR, with data minimisation and a short retention period.
Confirming receipt
A technical email sent in response to your own action. This is neither a subscription nor marketing.
A consolidated reply to accumulated messages is formulated in general terms. Your text is not reproduced verbatim and is not published without separately requested consent.
Confirming your address
The forms require confirmation that you control the address given. This protects people from having messages sent in their name from someone else’s mailbox.
- After you press Submit, the record is saved with the status “unconfirmed,” together with the text of the message, so that it is not lost if the email is delayed.
- An email with a link valid for 48 hours is sent to the address given.
- The text of your message is not included in that email, in case the address was entered incorrectly or belongs to someone else.
- Before confirmation the record is not processed substantively.
- Unconfirmed records are deleted automatically within 48 hours.
If you received such an email but sent nothing, no action is needed: the record will be deleted. Misuse can be reported to privacy@politicalunmanifest.org.
Automated replies and decisions
The automated email is selected by the language of the form and by the structured response options. Free political text is not sent to language models and is not used to assess your position automatically.
The automated reply only confirms receipt and the reference number. It does not signify approval, refusal, a promise of a personal answer, cooperation, or any particular role.
No decisions producing legal effects or similarly significant effects are made automatically. No profiling within the meaning of Article 22 GDPR is carried out; all substantive work with messages and profiles is done by a person.
Who may have access
The author of the project and future team members
Only to the extent necessary for their role, and only after access has been granted separately.
The website hosting service
Hosting of the site, the database and the logs, and the operation of the closed panel.
Brevo
Only at the moment the automated confirmation is sent. Name, address, language, reference number and a short deterministic text are transferred. The full text of the answer, the age group, the country and citizenship are not transferred. Per-recipient tracking of opens and clicks is disabled.
Proton Mail
Working correspondence from the project’s addresses, once such correspondence has begun.
Data is not sold, not published, and not passed to other participants in the project without a separate basis or consent.
International processing
Providers may process data outside your country of residence. In particular, the current hosting does not guarantee storage within a chosen region, and Proton operates under Swiss jurisdiction.
Where applicable, processing and transfers rely on data processing agreements and on the safeguards provided for by law.
Please do not send through the forms any information that is not needed for the conversation or for possible participation. This includes data about other people, information about health or immigration status, and any circumstances whose disclosure could create a risk for anyone.
Retention periods
- A response and its related working history — until consent is withdrawn, and in any case no longer than 24 months after the last substantive interaction.
- An address given for the notice of publication — until the edition is published; deleted once the email has been sent. If the edition is not published within 24 months, the address is deleted without an email being sent.
- Unconfirmed records — no more than 48 hours.
- Technical rate-limiting hashes — no more than 48 hours.
- Records known to have been left by a minor — deleted immediately once this becomes known.
- Email logs — the minimum practically necessary period; individual service records held by providers may be retained under their mandatory security and accounting rules.
Irreversibly anonymised aggregate results, which can no longer be linked to a person, are not personal data and may be retained longer.
Your rights
You may request access to your data, a copy of it, rectification, erasure, restriction of processing and portability; withdraw consent at any time; and object to the processing of technical data carried out on the basis of legitimate interests. Withdrawal of consent does not affect the lawfulness of processing carried out before it.
Write to privacy@politicalunmanifest.org from the address you gave in the form and, if possible, quote the reference number. To protect your own data, reasonable verification of identity may be required. A reply is provided without undue delay and normally within one month.
You also have the right to lodge a complaint with a data protection supervisory authority — in the country of your residence, of your place of work, or of the alleged infringement.
Security and changes
HTTPS, server-side validation of fields, rate limiting, a closed panel with sign-in and an allowlist of addresses, separate storage of secrets, and working access statuses are used.
No measure removes risk entirely, which is why the amount of data collected is deliberately limited. That is the principal safeguard, not an addition to the others.
If the purposes, fields, providers or retention periods change substantially, this notice will be updated before the new processing begins and, where required, new consent will be requested. Previous versions are available on request.