Privacy Policy

1. Introduction

This Privacy Policy explains how Effective Activism (effectiveactivism.com, VAT ID DK36667621), which runs Active for Animals ("we", "us", "our"), processes personal data when acting as a data controller under the General Data Protection Regulation (GDPR). It covers this website and the platform that serves Active for Animals' tools.

This Policy does not cover personal data that organisations process with our tools, such as the contacts an organisation tracks with the Engagement Tracker or the posts it plans with the Social Media Content Planner. For that data the organisation is the data controller and we process it on its behalf under the agreement it accepts when it starts using a tool.

2. Categories of Personal Data We Process

We may process the following personal data in our capacity as controller:

2.1 Accounts

• Name and email address
• Preferred language
• The organisations you belong to and your role in each
• Sign-in sessions and the days you signed in

2.2 Client & Partner Contacts

• Name
• Email address
• Organisation
• Role / title
• Communication history

2.3 Website Contact Data

• Contact form submissions (your name, email address and message), which are sent to us by email and not stored by the platform
• Waiting-list sign-ups for tools we are still building (your email address, your organisation's name and, if you give them, its website and number of employees, and how urgently your organisation needs the tool), which are stored in the platform's own database, can be read only by Active for Animals' platform administrators and are kept until we delete them
• Email correspondence

2.4 Survey Responses

When you answer one of our Engagement Tracker impact surveys, we store your answers with the survey, the language you answered in and the time you submitted them: your email address (required in the 3-month, 6-month and 1-year surveys, optional in the baseline survey), the name of your organisation and, if you give them, its website and number of employees, your role and the answers to the questions. We use them, with your consent, to track our performance and improve our services. Survey responses are stored in the platform's own database, can be read only by Active for Animals' platform administrators and are never shared with third parties. We keep them for 2 years from the day you submit them and then delete them; you can ask us to delete your response earlier.

2.5 Booking a Demo or a Conversation

The pages "Book a free demo" and "Book a conversation" show the booking calendars of our scheduling providers, Calendly and zcal. Your browser talks to the provider directly when the calendar loads; the details you enter when booking are collected by that provider and shared with us so we can hold the meeting. Our own pages collect nothing.

2.6 Technical Data

• Your network address, kept for rate limiting and abuse handling
• Operational logs, with addresses masked and no message contents

We do not intentionally process special category data.

3. Lawful Basis for Processing

We rely primarily on Legitimate Interest (Art. 6(1)(f) GDPR), including:

• Managing client relationships
• Improving our services
• Operating our organisation
• Communicating with partner organisations
• Keeping the platform secure

We process account data to provide the tools your organisation has asked for (Art. 6(1)(b) GDPR), and survey responses on the basis of the consent you give in the survey (Art. 6(1)(a) GDPR). You can withdraw consent at any time by contacting us.

4. Cookies

This website uses only strictly necessary cookies. No tracking, analytics, or marketing cookies are used. These are all the cookies the platform sets:

These cookies are strictly necessary for signing in and for protecting forms against forgery, and are set under the lawful basis of Legitimate Interest. No consent is required for these cookies under the ePrivacy Directive.

When you dismiss the cookie notice, your browser remembers that choice in its own storage on your device. It is not a cookie and is never sent to us.

The booking calendars on "Book a free demo" (Calendly) and "Book a conversation" (zcal) are loaded from those providers, who may set their own cookies under their own policies. This happens only on those two pages.

5. Data Retention

Personal data is retained only as long as necessary for the purposes described above. The table below is the platform's retention register: every kind of data the platform keeps and for how long.

6. International Transfers

The platform's primary database and servers are in Frankfurt, Germany (EU). To keep the tools fast for organisations around the world, read-only copies of the database are kept in Singapore and New York (United States). The platform is primarily hosted in the EU, but this is not EU data residency: personal data is also stored in those copies. Requests to the platform pass through Cloudflare's global network.

Where personal data is transferred outside the EU/EEA, we rely on:

• European Commission Standard Contractual Clauses (2021/914), included in our providers' data processing agreements
• Appropriate technical and organisational safeguards

7. Subprocessors & Service Providers

We use the following service providers to run the platform. The list is the platform's processor register:

These providers are contractually bound to process data in accordance with applicable data protection requirements.

8. Security Measures

We implement appropriate technical and organisational measures to protect personal data, including:

• Secure hosting infrastructure
• Encrypted transmission (HTTPS)
• Access controls for administrative access
• Restricted internal access
• Encryption of sensitive data at rest
• Separation of each organisation's data from every other organisation's

9. Data Subject Rights

Under GDPR, you have the right to:

• Access your personal data
• Request rectification
• Request erasure
• Restrict processing
• Object to processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise your rights, contact us at: [email protected]

10. Social Account Connections and Data Deletion

This section applies to organisations that connect a Facebook Page, an Instagram professional account, a TikTok account or a LinkedIn organisation Page to the Social Media Content Planner through our platform.

10.1 What we store when an account is connected

When your organisation connects a social media account, we store:

• The access credentials the network issues to us for that account (encrypted at rest; never shown to anyone, never sent anywhere but to that network)
• The account identifier, display name and picture address, who connected it and when
• Posts published from that account in the 90 days before the connection, and those published afterwards, read once a day
• Performance figures for those posts (such as reach, views and reactions), read once a day
• A record of each post the planner published, scheduled, cancelled or removed on that account: who asked, when, what was sent and the network’s answer

10.2 What happens when you disconnect

Disconnecting a social account with the Disconnect button in your organisation’s Social Media Content Planner removes the stored access token and stops any further ingestion of posts or performance data from that account. The access token is deleted immediately, and posts the planner had scheduled on that account are cancelled.

Posts and performance figures already ingested before disconnection are not automatically deleted. They remain in your organisation’s workspace as a historical record, and the record of what the planner published remains as well.

10.3 Requesting erasure of ingested data

If you wish to have a social account’s data permanently deleted, send a request to [email protected]. Please include the name of your organisation, the network and the account(s) concerned. We will action erasure requests within 30 days.

An administrator of the platform then acts in every organisation where that account is or was connected, or was published or scheduled to:

• it deletes the connection and its credentials, and the account’s published posts and their performance figures;
• it removes the account’s name from the posts planned for it;
• from the record of what the planner published, it removes the account’s name, the content sent and the network’s messages, keeping only the fact that an action took place, and when.

Each deletion is recorded in the organisation’s audit trail.

10.4 Platform-level data removal

You can also revoke our access at any time in the network’s own settings: in Facebook under Settings → Business integrations, in TikTok under Settings and privacy → Security → Manage app permissions, and in LinkedIn under Settings → Data privacy → Permitted services. Revoking access there has the same effect as disconnecting within our platform: it prevents further reading of data but does not automatically delete data already read. To request deletion of that data, follow the process in §10.3 above.

11. Supervisory Authority

As a Denmark-based organisation, our supervisory authority is Datatilsynet (Denmark).

12. Updates to This Policy

We may update this Privacy Policy to reflect changes in legal requirements or operational practices. The latest version will always be available on our website, with its effective date at the top.

Contact

Questions about this policy can be directed to [email protected].