Privacy notice
How ADCN collects, uses and protects personal data submitted through this website, the lawful bases we rely on, and your rights.
This notice is a draft. Passages marked TO CONFIRM are placeholders awaiting
facts that have not yet been settled. It is published here so it can be reviewed
and completed; it is not yet a statement of record.
Who is responsible for your data
The controller is TO CONFIRM — the organisation’s registered legal name, its jurisdiction of registration, its registration number, and the postal address to publish here.
The website says ADCN throughout, and a legal name may differ from an operating name. Both matter: a data subject exercising a right has to know which legal entity to address, and a supervisory authority has to know which one to contact.
To ask about anything in this notice, or to exercise any of the rights below,
write to TO CONFIRM — the address for data-protection requests. If this is the
same team@albaniandiasporacivicnetwork.com inbox that receives the forms, say
so plainly rather than implying a separate function that does not exist.
What we collect, and why
When you use a form on this site
The site carries several forms — general enquiries, collaboration and research interest, network membership, venue offers, organisation support, and a protected route for reporting concerns about the referendum process.
What you type into a form is sent to us by email and is kept in our mailbox. Alongside it we record the time of submission, which form was used, the language of the page, and two anti-spam signals: how long the form took to complete, and whether a hidden field was filled in.
We do not attach your IP address, your browser’s user-agent string, or the page you came from to that message.
When you subscribe to email updates
If you ask for email updates, we record your email address and evidence of your consent: when you gave it, which form it came from, and the exact wording you agreed to. We keep that evidence because consent that cannot be demonstrated is not usable consent.
Subscribing is always separate from any other request. It is never pre-ticked, never bundled into a form’s submit action, and every other form on this site works whether or not you subscribe.
When you simply read the site
The site sets no cookies, and there is no analytics, tracking or advertising technology of any kind. Nothing you read here is profiled.
Our content delivery network does keep server access logs, which include your IP address, your user-agent and the page you came from, retained for 90 days. These exist to operate and protect the service. TO CONFIRM — this retention is under active review and the decision must be recorded here once made: whether these logs are switched off, narrowed to exclude client fields, or kept with a stated justification and period.
One linked third-party form
The referendum participation page links to a signature-registration form hosted
at portal.referendum21.org, which is operated by a third party and not by us.
Anything you enter after following that link goes to its operator under their own
terms, not this notice. The portal is not embedded in this site.
The lawful basis for each use
| What we do | Lawful basis |
|---|---|
| Answer enquiries and act on offers of help | Legitimate interests |
| Receive and act on referendum concern reports | Legitimate interests |
| Send email updates you asked for | Consent |
| Keep evidence that consent was given | Legal obligation, and legitimate interests |
The legitimate interests we rely on are: responding to people who deliberately contacted us; organising volunteers, venues and partner organisations for a civic initiative; and receiving reports about the referendum process from people who choose to send them. In each case you initiated the contact, we use what you sent for the purpose you sent it for, and nothing is used for marketing without your separate consent.
Consent for email updates can be withdrawn at any time, using the unsubscribe link in every message or by writing to us. Withdrawing it does not affect anything done before you withdrew, and it does not affect any other correspondence.
Who else handles your data
| Processor | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosts the site; receives and processes form submissions; sends the notification email | Ireland and Germany, with content delivered from a global network |
| Microsoft | Hosts the mailbox that receives form submissions | TO CONFIRM — the Microsoft 365 tenant’s data region |
| Brevo | Manages the email-update list and sends the messages | European Union |
We do not sell personal data, and we do not share it with anyone for their own purposes.
Transfers outside the European Economic Area
People working on this initiative are located in more than one country, including Albania and the United States, and they access the mailbox that receives form submissions.
Albania has no European Commission adequacy decision. Access from Albania to personal data collected here is therefore a transfer to a third country and requires an appropriate safeguard — in practice, Standard Contractual Clauses.
TO CONFIRM — whether Standard Contractual Clauses are in place, between which parties, and from what date. If they are not yet in place, this section must say so rather than imply a safeguard that does not exist. The same question applies to access from the United States.
How long we keep it
TO CONFIRM — a retention period for form submissions held in the mailbox, and whether anything is deleted on a schedule or kept indefinitely. A privacy notice has to state a period or the criteria used to determine one, and “until we get round to it” is not one.
Email-update subscriptions are kept until you unsubscribe or ask us to delete them. Records of unsubscribing are kept afterwards, because that is what stops us contacting you again by mistake.
Your rights
You have the right to ask us for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased; to restrict or object to how we use it; and to receive data you gave us in a portable form. Where we rely on consent, you can withdraw it at any time.
We will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to a supervisory authority — in Albania, the Information and Data Protection Commissioner; in the European Union, the authority in the country where you live or work.
Do you have to give us your data
No. Nothing on this site obliges you to provide anything. If you use a form, we need whatever that form marks as required in order to answer you — but you are free not to use the form at all, and to write to us directly instead.
Changes to this notice
This notice was last reviewed on the date shown at the top of this page. When it changes materially we will say so here rather than change it silently.
Last updated