Vocdoni.app

Aragon Privacy Notice

Specifications on the Vocdoni Application and Privacy Notice

This Privacy Notice is part of the Aragon Association (the "Aragon") Privacy Policy and regulates the specifications of the data processing framework operated under the use of the Vocdoni.app, a free software initiative focused on the development of voting technology universally verifiable and censorship resistant digital technology thanks to a technological design that relies on decentralized components such as Ethereum, xDAI, Tendermint and IPFS.

For the purposes of the applicable laws of Switzerland and also of the E.U. (GDPR) the Data Controller is Aragon AG, a company incorporated under the laws of Switzerland, with head offices at Bahnhofstrasse 20, 6300 Zug, Switzerland.

The data controller can be reached through the following contact details:

Email: privacy@aragon.org

Telephone: +372 54680950

For any security or privacy matters, including the exercise of any data subject rights, the Data Protection Officer of Aragon can be reached using the following contact details:

Roger Baig dpo@aragon.org

1. What data is collected through the Vocdoni.app?

1.1 Data provided directly by the users

In order to provide the voting service to applicants, as well as to answer their queries, process a registration in the newsletters or other forms posted on the Aragon web pages, it is necessary to collect the following personal data:

• E-mail address in the case that a personal e-mail address is used as the organization's e-mail address, which is not recommended

It is the responsibility of each interested party that the data provided is true, accurate, complete and up-to-date and only they will be responsible for any damage or loss, direct or indirect, that may be caused as a result of the breach of such obligation.

Platform users cannot provide data that belongs to a third party other than the one who provides the data.

1.2 Data collected by third parties:

Aragon also collects data from third parties, acting for that purpose as data processors, including clients, services providers and other entities engaged with Aragon for the purposes of providing services, and subject to a specific data processing agreement between the parties.

1.3 Data collected in an automated way through cookies:

Aragon collects, in an automated way through cookies, or data storage and retrieval devices, data on navigation and use made by our users when accessing the Vocdoni.app platform. In this case, the information collected refers to context data.

For more information about this treatment, you can consult the Vocdoni.app Cookie Policy.

2. Purpose for the aforementioned personal data processing

Personal data is collected exclusively for the purposes indicated in this Privacy Notice and Aragon Privacy Policy, based on the following legitimizing bases:

2.1 Execution of the service:

1. Upon request made by the users and applicants for the voting process.
2. Upon registration and request of service, including managing, maintaining and controlling the contractual relationship with users and applicants.

The personal data collected for these purposes shall be the strictly necessary to provide the service, formalize and manage the contractual relationship.

If this data is not provided, Aragon may not adequately formalize the contractual relationship and provide the services, or even adequately address any questions, concerns or support requests.

2.2. Communications

Aragon may carry out commercial and/or advertising actions, including electronic communications, related to products or services similar to those contracted and regarding electronic voting services. Users can at any time oppose to these actions, by just following the instructions mentioned in the clause "Rights of the interested parties" of this Privacy Notice below.

2.3 Legal obligations

Aragon may also process personal data in order to execute a request of the user or applicant to exercise any data subject rights under the articles 15 to 22 of the GDPR, within a reasonable period.

3. Data Sharing

Apart from the entities identified in the Aragon Privacy Policy, for the specific purposes of the Vocdoni.app usage, Aragon may share the collected information with:

• Service providers contracted by Aragon, as data processors. Aragon requires, contractually, that the data processing is carried out only for the purposes provided for in the corresponding contract and that, upon completion, the data is returned or destroyed.
• Service providers contracted by Aragon, as data processors, if located outside the European Economic Area, which implies the realization of International Data Transfers (TID). In these cases, Aragon requires such recipients to comply with measures designed to protect personal data and, for this, it relies on mechanisms approved by the EU that allow such transfers.
• Fulfilment of any legal obligations and court orders.

4. Data Retention

The personal data corresponding to the provision of the service will be kept as long as the contractual relationship is in force.

The personal data corresponding to other services will be kept for the time necessary to fulfill the purpose for which they are collected.

In all cases, once the service is finished, Aragon will keep the personal data blocked during the legal prescription periods. After these prescription periods have elapsed, the data collected will be destroyed.

5. Exercise of data privacy rights

Data subjects have the right to directly request all information regarding their own data processing carried out by Aragon, including the right to request the portability of their personal data.

If any of the personal data is inaccurate or incomplete, the data subject may request its rectification.

Data subjects have the right to object to the processing of data and / or to request its deletion.

Data subjects may request the limitation of the processing of personal data in the following cases:

• While the challenge to the accuracy
• While exercising rights

At any time, data subjects can revoke the consent given.

For the correct exercise of rights, Aragon may request the presentation of a valid identification document.

For any privacy matters, including the exercise of data privacy rights, the subject may contact the Aragon Data Protection Officer at the address above, or to the competent authority.

6. Updates of the privacy notice

Aragon strives to continuously improve its services, processes and the protection of the rights of the interested parties. Therefore, this privacy notice may be reviewed periodically.