Privacy Notice

‍

This Privacy Notice explains how PNL FINTECH B.V.,Jachthavenweg 109H, 1081KM,Amsterdam, the Netherlands, trade register number 74178784 (“we”, “us”)collects and uses your personal data when you sign our petition toUNESCO (the “Petition”).

By reading this notice, you will understand whatinformation we collect about you, why we need it, how long we keep it, who weshare it with, and what rights you have.

Who is responsible for your data

We are the controller of your personal data. Thismeans that we decide how and why your data are processed in connection withthis Petition. We are strongly committed to comply with EU General Data ProtectionRegulation (GDPR).

What data we collect

When you sign the Petition, we only ask you for theminimum amount of personal data needed to support and validate the Petition

your first name
your last name
your email address

We do not intentionally collect sensitivecategories of data (such as information about your health, political opinions,religion, ethnic origin, etc.), and we do not ask for anything beyond the threeitems listed above. We also do not use automated profiling or automated decision-makingin the context of this Petition campaign.

Why we collect your data and how we use it

We collect your data so that we can:

add your signature to the Petition addressed to UNESCO, and
demonstrate that the Petition is supported by real people, primarily entrepreneurs affected by complex bureaucratic language.

We use your data only in connection with this campaign.In practice this means compiling a list of signatures (names and emails) sothat we can present the Petition to UNESCO, and performing basic checks andadministration related to the Petition (for example, making sure we can contactyou if there is a question about your signature or if you ask us to exerciseyour data protection rights).

We do notuse your data for marketing, newsletters, unrelated advertising, or forcreating user profiles. You will not be subscribed to any mailing list justbecause you signed the Petition.

Our legal basis and your consent

Under the GDPR, any use of personal data must be basedon a clear legal ground. In this Petition campaign we rely on your consent.

When you decide to sign the Petition and provide yourname and email address, you are giving us permission to use this informationfor the specific purpose of organising and submitting the Petition to UNESCO, including transfer your data toUNESCO as an independent controller. We do not use your data for anyother purpose that is incompatible with this one.

You have the right to withdraw your consent at any time. If you do so, we will stopusing your data for the Petition and will delete it (unless we are required to keepit for a period to demonstrate that we respected your request or to handlelegal obligations).

Withdrawing consent does not affect the lawfulness ofany processing that took place before you withdrew it.

Where and how your data are stored

We store your data on secure systems with appropriatetechnical and organisational measures to protect it against unauthorisedaccess, loss, misuse or alteration. Access to your data is limited to people whoneed to process it for the purposes described in this notice.

We store and process your data within the EuropeanUnion / European Economic Area (EU/EEA).

Who we share your data with

For thepurposes of this Petition, we will share your data with UNESCO, as theorganisation to which the Petition is addressed.

When the Petitionis submitted, UNESCO will receive the list of signatures (names and emailaddresses) in order to consider the Petition and the public support behind it.After we provide this information, UNESCO will process it according to its ownrules and privacy framework. For those purposes, UNESCO acts independently andis responsible for its own compliance with applicable laws.

We do notsell your data, rent it, or share it with advertisers, data brokers, or otherthird parties unrelated to this campaign.

If we use external service providers to host or manageour Petition platform or email systems, they will act only as processors on ourbehalf, under written contracts, and will be allowed to process your datasolely according to our documented instructions and in line with the GDPR.

How long we keep your data

We keep your personal data only for as long as this campaign is running and we need the datato prepare, manage and submit the Petition.

In practice, this means:

while the Petition is open and collecting signatures; and
for a period after the Petition is submitted to UNESCO, for example to answer any questions or to handle your rights requests (access, deletion, etc.).

Once the campaign is fully completed and there is nolonger a need to keep your personal data for the purposes described in thisnotice, we will either delete your personal data in a secure way, or irreversiblyanonymise it so that it can no longer be linked back to you.

We do not keep your data indefinitely and we do notretain it for unrelated future campaigns.

Your rights under data protection law

Because we process your personal data under the GDPR,you have a number of rights. You can exercise any of these rights at any timeby contacting us.

Your main rights are:

Right of access: you can ask us whether we process your personal data and request a copy of the data we hold about you.
Right to rectification: if you believe that your data are inaccurate or incomplete, you can ask us to correct or update them.
Right to erasure (“right to be forgotten”): you can ask us to delete your personal data, for example if you withdraw your consent or if the data are no longer needed for the Petition.
Right to restriction of processing: in certain situations you can ask us to limit how we use your data (for example, while we are checking accuracy or handling an objection).
Right to object: you can object to our processing of your data where you consider we do not have a valid reason or where you have particular circumstances that justify your objection.
Right to data portability: you can ask us to provide your data in a structured, commonly used and machine-readable format so that you can reuse it or transmit it to another controller, where applicable.
Right to withdraw consent: as explained above, you can withdraw your consent at any time, and we will respect your choice.

You also have the right to lodge a complaint with the data protection authority if you haveconcerns about how we process your personal data. We rely on the One‑Stop‑Shop mechanism, as providedunder Article 56 of the GDPR. Our Lead Supervisory Authority is the Dutch DataProtection Authority (Autoriteit Persoonsgegevens), which is responsible forsupervising our GDPR compliance in cooperation with other concerned authoritiesacross the EEA according to Article 60 of the GDPR. You may contact either yourlocal data protection authority or our Lead Supervisory Authority. List andcontacts of data protection authorities in EEA is available on the website(https://www.edpb.europa.eu/about-edpb/about-edpb/members_en#member-hr) of theEuropean Data Protection Board. In the event of disagreement betweensupervisory authorities, the case may be referred to the European DataProtection Board for a binding decision according to Article 65 of the GDPR. Weencourage you to contact us first and give us an opportunity to understand andresolve the issue before filing an official complaint. This way your issue willbe resolved much faster and with the personal touch

Changes to this notice

If we make significant changes to the way we processyour data in connection with this Petition, we will update this Privacy Noticeand, where appropriate, actively inform you about the changes (for example, byupdating the notice on the Petition page).

If you have questions about this notice or about howwe handle your data, or wish to execute your rights, you can contact us at: privacy@finom.co.