Legal
Privacy statement
How UpSide handles personal data across our website, our tools and the organisations we work with.
Stichting UpSide (hereinafter "UpSide", "we", or "us") believes it’s crucial to handle your personal data with care. In processing personal data, we adhere to relevant laws and regulations, including the General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG, 'UAVG'). We build tools that help civil society organisations track and act on European legislation, which means we hold data both about the people who use our tools and about the public officials and lobbyists whose activity those tools record. We distinguish our use of these clearly below.
It’s important for us to clearly and comprehensively explain what we do with your data and what control you have over it. Therefore, in this privacy statement, we extensively outline the data we collect from you and how we handle it. We encourage you to read this privacy statement carefully. We may update this statement from time to time; where changes are material we will summarise them at the top of this document.
On this page
- Contact details
- Data controller
- Categories of data subjects
- Platform accounts and organisation workspaces
- Personal data from public policy sources
- Workshops, briefings and other free services
- Questions and requests
- Case studies & quotes
- Funders
- Job applications
- Relationship management incl. vendors
- Website visitors: cookies
- Website visitors under 16 years of age
- Automated decision-making
- Your rights
- Sharing with others
- International transfer of personal data
- Data breach notification
- Security
Contact details
Stichting UpSide
Edward Wrightstraat 4A, 1086 WC, Amsterdam, the Netherlands
Chamber of Commerce (KvK) number: 42123131
RSIN: 869832499
Data protection queries reach us at privacy [at] up-side.org
Data controller
Stichting UpSide (Netherlands) is the controller for the processing described in this privacy statement. There are two ways to get access to the Platform. You can sign up yourself with a work email address at a domain your organisation has agreed with us, or we can invite you, usually at your organisation’s request. Either way, your access comes through an organisation that has arranged access with us, such as your employer. If you sign up, you create your own account; if we invite you, we create the account and you set your own password when you first sign in. In both cases you accept our Terms of Use, and in both cases we are the controller for your account, including your sign-in and security data. We are also the controller for the material you add to the Platform, such as notes and updates. An organisation that arranges access for you does not decide how we use your account data. We do not give your organisation information about how you use the Platform.
We are also the controller for data about our website visitors, funders, suppliers, business relations and job applicants, and for the public policy data we collect and structure ourselves.
Categories of data subjects
We process your personal data when you visit our website, use our tools, attend a workshop or briefing, contact us, apply for a role with us, or if you are a funder, supplier, or business relation. Not all personal data we process comes from users of our Platform. We also hold information about people who do not use the Platform themselves: elected representatives, public officials, interest representatives and others involved in EU policymaking, whose details we collect from public sources and people who are named in the working notes that organisations keep on our Platform. If you are in one of these groups, the section “Personal data from public policy sources” below explains what we process about you and why.
Platform accounts and organisation workspaces
Personal data
When you create an account to use our tools, we may process the following personal data:
- Your name, if you give it (optional)
- Email address (usually your work email address)
- Login credentials: your password (stored only as an argon2id hash, never in plain text), the authenticator secret for the two-step sign-in every account uses (stored encrypted, with the key held outside the database) and your recovery codes (stored hashed)
- Your organisation and your role on the Platform (viewer, contributor or administrator)
- Content you create or upload into your organisation’s workspace
- Searches, queries and instructions you give to our tools
- The time of your last sign-in and last visit, and a short-lived log of the pages you request (including any search terms in the page address), with your IP address and browser details.
- Audit records of actions taken in the workspace; how your account was created (invited by an administrator, or signed up with your work email address); and when you last signed in
- Device and browser information, IP address
Purposes and legal basis
We are responsible for the personal data we process about you when you use the Platform. Under the GDPR, this makes us the controller. We use your personal data for the purposes below and state the legal basis for each. Where we rely on our legitimate interests (Article 6(1)(f) GDPR), we explain what those interests are. We have weighed them against your interests and rights, and you can object to that processing at any time (see ‘Your rights’).
- Terms of Use: we ask you to accept our Terms of Use, which form the agreement between you and us for using the Platform, and we keep a record of the version you accepted. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR) and, for keeping the record, our legitimate interest in being able to show which terms applied. Accepting the Terms of Use is not consent to the processing in this statement, and we do not rely on consent to run your account.
- Your account: we create and manage your account so that you can use the Platform. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).
- Support: we help you when you ask for support. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).
- Improving the Platform: we diagnose faults from our server logs, so that we can fix problems and improve our tools. Legal basis: our legitimate interest in offering a Platform that works well. Where we use cookies or similar technologies for this that are not strictly necessary, we ask for your consent first.
- Service messages: we inform you about changes to the service or your account. Where a message concerns our agreement with you, such as a change to the Terms of Use or to your account, the legal basis is performance of that agreement (Article 6(1)(b) GDPR). For other updates about the service, we rely on our legitimate interest in keeping you informed about the service you use. These messages do not contain marketing.
- Security: we keep the Platform and your account secure. This includes verifying your email address, two-step sign-in, limiting repeated sign-in attempts and keeping audit records. Legal basis: our legitimate interest in protecting the Platform, your account and the data in it against misuse and unauthorised access.
Where your data is held
We build and operate our own platform rather than hosting it on a third-party community product. Data is stored on infrastructure located within the European Union, provided by European hosting companies. Our current arrangements include:
- Storage on EU-based infrastructure, under EU jurisdiction
- Encryption in transit (TLS 1.2 or higher), and encrypted backups
- Separation between organisations enforced by access controls in our software and checked by automated tests (all organisations’ data currently sits in one database; we plan to move to separate databases), so that one organisation’s workspace is not visible to another
- Access limited to the small number of UpSide staff who need it to run and support the service. UpSide staff with administrator or technical access can technically reach all content. We only do so to run, support or secure the Platform, or where the law requires it, and we do not otherwise read your notes
We keep the number of third parties involved deliberately small. Where we do rely on a supplier, it acts as our processor under a written agreement and may not use your data for its own purposes.
Our Platform holds two kinds of material: public records (legislative documents, votes, speeches, declared meetings, consultation responses, Commission publications, the EU Transparency Register), which every user can see; and the working material each organisation or coalition keeps on the Platform, which only that organisation or coalition can see.
As our capabilities evolve we will share more about what data we hold for what purpose.
Pilot surveys
Sometimes we ask a few short questions on the Platform, for example at the start and end of a pilot, to find out whether the Platform made a difference. Answering is optional, every question can be left blank, and skipping changes nothing about your access. The questions are not part of the Terms of Use.
What we keep. We note against your account that you have been asked, so that we don’t ask you again. Your answers are stored apart from your account, without your name, your organisation or the time you answered, and we never look up who gave which. Because the group asked is small, we still treat the answers as personal data. Please don’t name other people in your written answers; if you do, we don’t copy the names anywhere.
Who sees them. Only the UpSide team. A team member can download them to work on; that copy stays on an encrypted UpSide laptop and is never put in an online service. Outside UpSide, including with the coalition taking part in the pilot and our funders, we share only themes in our own words and totals that don’t identify you or your organisation. We never put survey answers into an AI tool.
Purpose and legal basis. To find out whether a pilot worked, by comparing the answers given at its start with those given at its end, for the group as a whole and never per person or per organisation. We don’t combine the answers with any other data. Legal basis: our legitimate interest, and that of the organisations taking part, in finding out whether the Platform helps them work together (Article 6(1)(f) GDPR).
How long we keep them. We will delete the answers, any downloaded copies and the record of who was asked once the comparison is written up. Closing your account doesn’t delete your answers, because we can’t tell which are yours; they go at that date. For the APLG pilot, that is by 31 March 2027. Deleted answers can remain in our encrypted backups for up to 30 days.
Your rights. You have the rights described under Your rights below, including the right to object. Because we don’t link answers to accounts, we may ask you to tell us what you wrote so that we can find your answers. Write to privacy [at] up-side.org.
AI and automated processing
Our tools use automated processing, including large language models, to read, structure, summarise and interpret legislative and policy material.
- What is processed. Public policy records, and the names and goals of the files your coalition follows; your notes, contributions and account details are not sent to any AI model.
- Who provides the models. We use third-party model providers Mistral and GreenPT as processors.
- Training and retention by model providers. Under our agreements, our model providers do not use the content we send to train or improve any model.
- Accuracy. Where our tools produce analysis about individuals drawn from source records, that analysis reflects the source. If a source, or our rendering of it, is inaccurate, you can ask us to correct it (see Your Rights).
- AI Act Art. 50. Where you interact with AI-driven features, or receive AI-generated or AI-assisted output, we make that clear, in line with our transparency obligations under the EU AI Act.
Retention period
How long we keep your data depends on what it is.
Your account. We close your account when you ask us to, when we close it (for example, if your organisation leaves the Platform or the Terms of Use are breached), or after 12 months without a sign-in. If you asked us to close it, we delete your account data in the next nightly run, normally within a day. Otherwise we delete it 30 days after closing, so it can be reopened if it was closed by mistake.
What you wrote. Your updates and contributions stay with your organisation and coalition. Where your email address was recorded as the author, we replace it with a neutral label ("deleted-user" and a number). We don't edit the text itself, so if you named yourself in it, ask us.
Your organisation’s material. Your organisation’s own material (its contributions on files, the updates it kept to itself, and the email domains its people join by) is kept while your organisation is on the Platform, and deleted 12 months after it leaves. Updates your organisation shared with the whole coalition stay with the coalition, under your organisation’s name, because the other members still work from them. We delete them with the file they belong to, or 12 months after the coalition’s last member organisation leaves the Platform.
Records and logs. Audit records of sign-ins and changes are kept for 12 months (for a deleted account, under the neutral label rather than your email address). Records of sign-in and sign-up attempts are kept for about one hour. A sign-up request is deleted when it is used, or within 2 days if it is not. Our Platform’s gateway log (your IP address, browser and the pages you request, with sign-up links removed) is rotated by size rather than date, and normally reaches back only a few days.
Backups. Deleted data can remain in our encrypted backups for up to 30 days. If we ever restore a backup, we apply the deletions again.
If an update mentions you. You can ask us at privacy [at] up-side.org to correct or remove what concerns you.
Personal data from public policy sources
This section applies if you are a Member of the European Parliament, a Commissioner or member of a Commissioner's cabinet, a Commission official in a management post, someone recorded as meeting them on behalf of an organisation, or another person whose professional activity is recorded in EU public records, a registered interest representative, or another person whose professional activity is recorded in public policy documents, or anyone else named in the news coverage we follow, in their public or professional role. We may hold information about you even though you have never been in contact with us.
Personal data
From public sources, we may process:
- Name, professional role, institution or organisation, and political group or affiliation where officially recorded
- Publicly recorded professional activity: votes cast, amendments tabled, questions asked, positions taken, committee membership, speeches and public statements
- Declared meetings with Members of the European Parliament and Commission officials, as recorded by those institutions, and organisations’ entries in the EU Transparency Register
- Professional contact details as published by the institution concerned
Sources
We collect this data from official and public sources, including the registers and document databases of the European Parliament and the Commission, the EU Transparency Register, and public statements and publications. We do not buy personal data, and we collect only from official and public sources and registers, and from published news coverage (the headlines and opening paragraphs of articles in the publications we follow).
Purpose and legal basis
We process this data on the basis of our legitimate interest (Article 6(1)(f) GDPR) in supporting democratic scrutiny of the legislative process, and to help civil society organisations understand and participate in that process on more equal terms with better-resourced actors.
Two limits follow from that basis: first, we process this data in relation to your public and professional role, not your private life; second, we do not process special category data (including inferred political opinions, health, religion or ethnicity) about individuals covered by this section. A record of how a representative voted is a public act; an inference about their private beliefs is not, and we do not make or store one.
Why you may not have been notified individually
Where we obtain personal data from public sources rather than from you, GDPR normally requires us to notify you. Given the number of individuals recorded across EU legislative and transparency data, individual notification would involve disproportionate effort, and we rely on Article 14(5)(b) GDPR. This statement is the public notice that takes its place. If you contact us, we will tell you what we hold about you.
Your rights in relation to this data
You have the same rights as anyone else described in this statement, including the right to access the data we hold about you, to have inaccurate data corrected, and to object to the processing on grounds relating to your particular situation. If you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. Write to privacy [at] up-side.org.
If you believe something we hold about you is factually wrong — a vote attributed incorrectly, an outdated role, a misattributed statement — please tell us. We would rather be corrected than be inaccurate, and correcting the record is in our interest as much as yours.
Retention period
We retain public policy data for as long as it is relevant to the legislative record, which for historical and archival purposes (Art. 89 GDPR) may be long-term. We mark superseded roles and past positions as historical records.
Workshops, briefings and other free services
Personal data
When you sign up for a workshop, briefing, webinar or other free service we offer, we may process the following personal data:
- First and last name
- Email address
- Organisation and role
Purpose and legal basis
We use this data to process your registration, organise the session, and send you practical information such as the programme, the joining details and any follow-up material. We process your data to perform our agreement with you (Article 6(1)(b) GDPR).
Retention period
We will only use your data to provide access to the requested service. We store all data in our archive. We retain our archive for three years.
Questions and requests
Personal data
When you contact us by phone, email, via the contact form on our website, or in any other way, we may process the following personal data:
- First and last name
- Phone number
- Email address
- Correspondence, including emails
- Other personal data you provide to us
Purpose and legal basis
We process your personal data for the following purposes:
- Contacting you or taking action in accordance with the form you filled out (legitimate interest)
- Handling your question or request (legitimate interest)
Retention period
We will only use your data to handle your question or request. We store all data in our archive. We retain our archive for five years.
Case studies & quotes
Personal data
If you agree to be quoted, or to appear in a case study about how your organisation uses our work, we may process the following data:
- First and last name
- Email address
- Photo
- Your organisation and role
- What you have said about our work, in your words or as agreed with you
- Other personal data you actively provide
Purpose and legal basis
We process this data to describe our work on our website, in funding applications and on social media, on the basis of your consent. We will show you the material before it is published.
Retention period
We retain your data until you withdraw your consent. Please note that when your quote or case study is shared on social media, it may not always be possible to completely remove it due to sharing and liking by others.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy [at] up-side.org.
Funders
Personal data
If you become a funder and financially support us, we may process the following personal data:
- First and last name
- Email address
- Phone number
- Address details
- Financial data
- Correspondence, including emails
- Other personal data you provide to us
Purpose and legal basis
We process your personal data for the following purposes:
- Administration (legal obligation)
- Personal contact (legitimate interest)
- Informing about developments at UpSide (legitimate interest)
- Reporting to you on the use of funds, where our agreement requires it (contract performance)
- Mention on our website as a funder (consent)
Retention period
We retain financial data for at least 7 years in accordance with the fiscal retention period. We retain all other data for the duration of the agreement and at least 5 years thereafter.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy [at] up-side.org.
Job applications
Personal data
If you apply for a role with us, we may process the following personal data:
- First and last name
- Email address, phone number, address details
- CV with information about your employment history and education/training
- Your application, covering letter and any answers to written questions
- Work produced for a paid trial task, where the role involves one
- References, where you have given us permission to approach them
- Correspondence, including emails
- Other personal data you provide to us
Purpose and legal basis
We process your personal data for the following purposes:
- Conducting the application procedure (legitimate interest)
- Retaining data after rejection for a subsequent application (consent)
- Retaining data in your personnel file if you are hired (contract)
Retention period
We retain application data until four weeks after the completion of the application procedure. Only with your explicit consent do we retain your data (each time) for up to one year. If you are hired, your application data will be stored in your personnel file.
Consent
If we process your personal data based on your consent, you can always withdraw it by emailing us at privacy [at] up-side.org.
Consequences of not providing data
We use the information requested to assess your application. If it is not provided, or provided incompletely, we may not be able to consider your application.
Relationship management incl. vendors
Personal data
In the context of relationship management, we may process the following personal data:
- First and last name
- Email address
- Phone number
- Organisation name and your role
- Chamber of Commerce (KvK) number
- Address details
- Correspondence, including emails
- Notes of meetings and conversations relevant to our working relationship
- Other personal data you provide to us
Purpose and legal basis
We process your personal data for the following purposes:
- Retaining contact details (legitimate interest)
- Making personal contact (legitimate interest)
- Building and maintaining a business network (legitimate interest)
We use Asana as our customer relationship management system for this purpose. Asana acts as our processor under a data processing agreement.
Retention period
We do not retain your data longer than necessary for the benefit of our organisation or until you request us to delete it.
Website visitors: cookies
Personal data
As of the date above, up-side.org sets no cookies and uses no analytics, advertising or tracking tools. Because there’s nothing on the site that needs your permission under EU cookie rules, there’s no cookie banner. Our cookie policy covers this in full, including the small number of infrastructure-level things, like security protection from our hosting provider, that could technically apply, and what happens if that ever changes. When you visit our website, our hosting provider may process:
- IP address
Purpose and legal basis
We process your personal data for the following purposes:
- Improving access to and operation of our website
- Providing a good user experience of our website
The legal basis is our legitimate interest in a well-functioning, secure website.
On our Platform (platform.up-side.org) we set only strictly necessary and preference cookies: a session cookie that keeps you signed in (12 hours), a sign-up cookie used only while you create your account (30 minutes), and a cookie that remembers which view you last used (1 year). Theme and layout preferences are stored in your browser. None of these are used for tracking.
If we ever add analytics, advertising or embedded third-party tools that need your consent, we’ll add a cookie banner, ask for that consent, and update this statement and the cookie policy at the same time.
Ip address and web servers
Like most websites, our web server and hosting provider, Cloudflare, keep short-lived logs that include your IP address, purely to run and secure the site. We don’t use this to track or identify individual visitors, and we generally can’t link an IP address to your name or identity unless you’ve separately given us that information.
Retention period
up-side.org sets no cookies, so none are stored. The short-lived logs described above are kept only as long as our hosting provider needs them to run and secure the site.
Consent
There is no cookie banner, because nothing on the site needs your consent. You can still set your browser to refuse or delete cookies.
Consequences of not accepting cookies
Refusing cookies makes no difference to up-side.org. On our Platform, the session cookie is needed to stay signed in.
Website visitors under 16 years of age
We do not intend to process personal data of website visitors under the age of 16 without the consent of parents or guardians. However, we cannot control this. If you suspect that we are processing personal data of a person under the age of 16 without consent, please contact us so that we can delete the information if we are not lawfully processing it.
Our tools are intended for use by professionals in the course of their work and are not directed at children.
Automated decision-making
Our tools use automated processing extensively: they read, classify, summarise and analyse legislative and policy material, and they produce analysis about the positions and activity of institutions and the people who work in them.
What we do. We produce automated analysis of public professional activity — for example, summarising a representative’s recorded position on a legislative file, or describing the declared lobbying activity of a registered organisation. This is analysis of the public record, presented as working material for people to evaluate.
What we do not do. We do not make automated decisions that produce legal effects concerning you or that similarly significantly affect you, within the meaning of Article 22 GDPR. This processing may involve profiling within the meaning of Art. 4(4) GDPR, but it does not constitute automated decision-making producing legal or similarly significant effects under Art. 22. There is always human evaluation: our outputs are inputs for decisions made by people.
Your rights
You may always ask us to access your data (right to access), correct your data if it is incorrect or incomplete (right to rectification), and delete your data (right to erasure). You also have the right to object to data processing, the right to restrict data processing, and the right to data portability.
Right to object. Where we process your data on the basis of legitimate interest, you can object at any time on grounds relating to your particular situation. We will then stop processing it, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims. To object, email privacy [at] up-side.org.
If you wish to exercise any of these rights, you can email your request to privacy [at] up-side.org. We may need to verify your identity to fulfill your request.
Your request covers everything we hold about you, including material in your organisation’s workspace or your coalition’s shared material. We handle it ourselves.
We will respond to your request within one month. If your request is complex, we may extend this period by two additional months, in which case we will inform you of the extension within the first month.
If you have a complaint about how we handle your data, we would like to resolve it with you. Please contact us to do so. If you are not satisfied with the handling of your request or complaint, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
Sharing with others
We use multiple processors to operate our services. We have entered into data processing agreements with all our processors. We will never sell your personal data to third parties.
We share your personal data with the following categories of processors:
- Cloud hosting and infrastructure providers (EU-based)
- AI model providers, for the automated processing described above
- Email software
- Customer relationship management software (Asana, Inc. — US, DPA in place; transfers under the EU-US Data Privacy Framework, with EU Standard Contractual Clauses as fallback)
- Accounting and financial administration software
- Online working environment, including email and document storage
- Website hosting
- Accountant (under confidentiality agreement)
- Form and survey tools
We do not share data held in one organisation’s private workspace with any other organisation, and we do not aggregate it into products sold to anyone. Within a coalition, the member organisations see the coalition’s shared material: the dossiers we keep for it, and any update or contribution its author marks for the coalition. Nothing is shared between coalitions. When you vote on how relevant a media item is, your display name is shown to everyone who can see that area, including people in other organisations.
A complete and up-to-date list of our processors and their key sub-processors is available on request. We update the list when our processor relationships change.
International transfer of personal data
Our Platform, its database and its backups are in the European Economic Area (EEA), and the AI model providers our Platform uses (Mistral and GreenPT) process data in the EU. Some of our operational tools are based outside the EEA, in the United States: Cloudflare, which hosts our website and sees website visitors’ IP addresses (our Platform does not pass through it); Google Workspace, for our email, documents and calendars; Asana, for relationship management; and GitHub, where we keep our code.
For these transfers we rely on the EU-US Data Privacy Framework, for providers certified under it, with EU Standard Contractual Clauses as a fallback, and on extra technical and organisational measures where a transfer risk assessment says they’re needed. You can request a copy of the relevant transfer safeguards by emailing privacy [at] up-side.org.
Data breach notification
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of a qualifying breach.
Where a breach affects material an organisation or coalition keeps on the Platform, we will also tell that organisation without undue delay.
Security
We take organisational and technical measures to protect your data. These measures include encryption in transit, encrypted backups, access controls, checked by automated tests, that separate organisations’ workspaces, access control limiting staff access to what each person needs to do their job, audit records of sign-ins and changes, two-step sign-in for every account, passwords stored only as argon2id hashes, encrypted authenticator secrets, and limits on repeated sign-in and sign-up attempts.
No system is perfectly secure. If you believe you have found a vulnerability in our systems, please tell us at privacy [at] up-side.org. We will not pursue action against anyone who reports a vulnerability to us in good faith and gives us reasonable time to fix it.