This privacy notice describes what personal information is collected, and how it is used, and how it is shared, in the process of the running the Green Web Foundation’s operations.
It applies to users of this website, and partners helping in the Green Web Foundation’s operations.
The data controller ultimately responsible for is Stichting The Green Web Foundation (the we in this document, also referred to as TGWF ), a foundation based in Wagingen, in the Netherlands.
It is regulated by the Dutch Data Protection Authority.
This notice was last updated on May 20th 2022.
How we collect personal information.
We get personal information either directly, indirectly or automatically, in the course offering the services provided by the Green Web Foundation.
Most of the information we process is provided by you directly, for one of the reasons below:
- You signed up to receive news from us
- You contacted us, make an enquiry
- We have met online or in person
- You have contacted us to contribute to our publications
- You are working with us as a partner, contractor, or associate
- You, or your organisation is a supplier
- We are providing a service or product to your organisation
We may also receive information about you indirectly, in the following scenarios:
- You were included in conversations with us, or someone recommended you to us.
- You have an existing relationship with the team working on one of our projects.
- You are working with one of our clients or suppliers.
Finally, some information is collected automatically:
- If you are a reader or viewer of sites we operate we do not use any cookies at all.
- If you are accessing our websites and we use information related to your connection to serve content to you quickly over a content delivery network.
- If you are using our browser extensions – see the information below for more details.
What we use your data for
We use your personal information to publish work and provide services, and improve how we work. We may use this information to:
- Send you news and updates
- Inform you of changes to the services we provide
- To do business with you
- To manage your work if you are contracted by us
- To share documents with you securely
- Maintain legally required records, like for tax and accounting purposes
Our lawful basis for processing your data
Under the GDPR, if we are to process your personal data, we need a lawful basis for doing so. The lawful bases we rely on for processing your data are below:
Consent: You are not a client, supplier or otherwise in a contract with us, but you want to receive news and updates from us. We provide a way to unsubscribe from any update in every message we send. You can also unsubscribe by contacting [email protected] with the heading “unsubscribe”.
Contractual obligation: you have entered contracted with us to provide good or services, or vice versa. Alternatively, before we have entered a contract, you have asked us to do something.
Legitimate interests: you are a client or partner, and you’d reasonably expect us to get in touch beyond work we have contracted directly to do. You have a right to object to this, as outlined below.
We do not rent, sell or give away potentially personally-identifying and personally-identifying information to anyone.
What data we store
In the daily operations of The Green Web Foundation, we use a number of third party services, who process data on our behalf – our data processors.
We use these services to work with clients, manage contributions to our publications, host our websites and digital publications, and handle communications like email.
Each supplier we use has a policy that explains what data they process, how they process it, how long they keep it, and how they keep it safe.
Third party services
Below, we list the third party services, what we use them for, and link to their privacy policies.
Where data is stored
The Green Web Foundation website is hosted in the UK. Our Member portal servers are hosted in Finland.
Where organisations who process data on our behalf are are based outside the European Economic Area (the EEA), or where data may be be transferred outside the EEA, we have put in place agreements to ensure that data is processed to the same standards of protection as European Law.
How long data is stored
We do not store data longer than necessary. We review our records every quarter to remove or anonymise data that should no longer be retained.
We use the following criteria to decide if data is necessary:
- Do we still carry out the activities for the purpose it was provided?
- Is this information still up to data and accurate?
- Are we required by law to keep this data, like for tax or employment purposes?
- Are there contractual obligations we need this data for, in order to be able to honor them?
How we keep data safe
We take care to choose services and tools that make it possible to follow good security practices, like strong passwords, 2 factor authentication, and secure connections using known protocols like TLS, and SSH.
We have reviewed the privacy policies and security practices of every service and tool we use. We have written agreements that require them to protect the personal data they process.
We limit administrative access to key individuals, and only for as long as necessary.
The GDPR grants the following rights to EU citizens. We’ve linked to more details, but below are examples of how you might use it.
The right to be informed – you have the right find out how data is collected and processed.
The right of access – you have the right to see any data collected, and how it is being processed
The right to rectification – you have the right to have any inaccurate data we are storing corrected.
The right to erasure – if we are not required to retain data by law, you have the right to request its deletion
The right to restrict processing – you have the right to request data is no longer processed – including stopping it being deleted. You might use this in a legal claim, to safeguard data for use as supporting evidence.
The right to data portability – you can request data you have provided to us. We will provide securely in a structured, machine readable format.
Right to object – you have the right to object to certain types of processing of data. If we can’t provide a compelling reason for continuing to do so, we will stop. You might use this as a partner or former contributor, to stop us contacting you with news that might otherwise be relevant.
Rights related to automated decision making, including profiling – we don’t do any of this.
Exercising your rights
To exercise any of these rights, please contact us at [email protected]
Our postal address is:
We have a calendar month to get back to you, once we have heard from you.
To prevent fraud, and keep your data safe, we may ask you to verify your identity securely before we continue with your request.
If you aren’t satisfied with our response, we are regulated by the Dutch Data Protection Authority.
Further details for specific services
Accessing our websites
Information collected automatically
When you use our websites we automatically collect information about your visit. This helps us understand how to improve our site and services.
We use Cabin Analytics, a privacy-first, cookie-free, carbon conscious analytics service. This data is stored in the UK, and collection does not identify you personally. You can see a full list of the data points collected, and more about their approach to privacy, and how they follow data protection laws around the world.
Information you provide for the member portal
We collect your email address, and a username when we create an account for you, so you can update info about hosting providers and datacentres. We use this to identify you, when signing in to make updates.
Submitting information via our form builder tools
We use form builder software on our main website to collect information from you in a structured form when you apply for a position, request support and so on.
This information is stored on the same server as the website, and our existing policy for retaining data (see “how long is data stored?” above).
Using the Green Web Browser Extensions and Addons
When you use one of the Green Web browser plugins, the following information is sent to the Green Web API automatically:
- the domain of the current page you are on – this shows if the current page runs on green power or not
- the domain of any links on the page – this shows if sites linked to run on green power
Nothing else is sent to TGWF servers, and you can’t be identified by sending this data.
What is retained, and why
Once the information about the domains is returned to be displayed in your browser, we retain the following information:
- the domains that were checked
- the time of the check, at the resolution of the nearest minute
We use this to track changes to how servers behind a given domain name are powered, over time as part of our mission to speed a transition to an internet running on green power.
Since there is not a moment in the day that we have less then dozens different users per minute (on average around 20.000 checks per hour are carried out as we write) there is way to connect these sites to a certain user.
Nothing else is stored about the request, and nor anything that links a user to checking a specific domain.
Transparency and open source
Other access data
To help prevent abuse of our services , we retain access logs at the server level, for a period of 21 days. These record:
- The time of the request
- The request sent
- The status
- That type of device sent (specifically, the user agent)
We track this to identify patterns in usage that may affect the ability for services to function – for example, if one user is making so many requests that it stops the API working for others.
After the retention period, we delete these logs.
We may compile statistical data about the behavior of uses of the offered services.
For instance, we reveal how many downloads a particular version of a browser add-on received, or say which versions or websites are most popular based on checks against the web services we offer.
None of these statements are linked to personally-identifying information in any steps of the aggregation process.