Privacy Policy

We collect the following categories of personal data:

• Contact information: Name, email address, organization, and job title, provided when you request access, contact us, follow a consultation file or organization, claim an organization page, or export a comparison. Details submitted through any of these forms are held in our CRM.
• Subscription data: The name and email address you give when you follow a consultation file or organization on Who Filed What, the files you follow, and the dates you confirmed or unsubscribed. Subscriptions are double opt-in: nothing is sent until you confirm from your inbox.
• Technical data: IP address, browser type, operating system, referring URL, and pages visited, collected automatically via server logs.
• Cookie data: See our Cookie Policy for details.

• Consent: When you submit a contact or access request form, or confirm a consultation subscription (Article 6(1)(a) GDPR).
• Legitimate interest: For website analytics and service improvement (Article 6(1)(f) GDPR), where our legitimate interest is understanding how visitors use our site to improve our services; and for the public consultation records described in section 4.
• Contractual necessity: To provide our services to subscribed users (Article 6(1)(b) GDPR).

We use your data to:

• Respond to your inquiries and access requests
• Provide and improve our platform services
• Send service-related communications
• Send the consultation updates you have subscribed to
• Analyze website usage to improve user experience

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling. Who Filed What aggregates public records at the level of organizations; it does not profile individuals.

Who Filed What republishes submissions made to the European Commission's public consultations, attributed to the organization that filed them and organized by legislative file and by organization. This section is our notice under Article 14 GDPR, because the data is not collected from the people it may concern.

Source. The Commission's "Have Your Say" portal, where every submission is already published, together with each organization's own declarations to the EU Transparency Register (declared staff, costs, accreditations, and memberships). Commission documents are reused under Commission Decision 2011/833/EU, which governs reuse of the documents and is not our lawful basis for processing personal data.

Categories of data. The organization's name, country, respondent type, and Transparency Register number as recorded by the Commission; the text of the submission and of any attachment as published; and the Register declarations above. This is organization-level data. Personal data can appear inside it: the name and job title of a person who signed a submission on an organization's behalf, and occasionally a contact detail that the Commission's publication did not remove.

Organizations only. Submissions that the Commission records as coming from private individuals are excluded. Contact details are removed from the text before it is indexed, and passages that contained them are withheld from search results. Where a submission is in fact from an individual, or a name or contact detail of an individual appears in a published record, we remove it on request.

Lawful basis. Legitimate interest (Article 6(1)(f) GDPR). The interest is transparency about who seeks to influence EU legislation, an interest recognized in the EU's own transparency framework and one the Commission serves by publishing every submission. We have weighed it against the interests of the people whose names may appear: the records were published by the Commission for public scrutiny; they were filed by organizations in their public role, not by individuals in a private capacity; the personal data involved is limited to the names and job titles of people acting for an organization; we remove contact details; and any person concerned can object and have their data removed. On that basis we consider the interest outweighs the limited intrusion.

Recipients. The records are public on this website, in its search, its exports, and its RSS feed, and can be read by anyone. Our hosting and database providers process them on our behalf (section 5).

Retention. A record stays published for as long as the source record is public on the Commission's portal, and is corrected or removed on request.

Your rights. If you are named in a published record, you have the right to have it corrected (Article 16), to object to its publication (Article 21), and to have your personal data erased (Article 17). Write to info@policyspeak.com with the page link. We respond within 30 days, and we remove a private individual's name or contact detail on request. Section 8 lists your rights in full.

We share personal data with the following categories of processors, all of which are bound by data processing agreements:

• Hosting: Vercel Inc. (website hosting, US-based, EU Standard Contractual Clauses in place)
• CRM: HubSpot Inc. (form submissions and contact management, US-based, EU SCCs)
• Email: Google Workspace (business email, US-based, EU SCCs)
• Database: Supabase (the subscription records for Who Filed What, hosted in the EU in Ireland)
• Transactional email: Resend (delivery of the confirmation and digest emails for Who Filed What subscriptions, US-based)
• Analytics: PostHog (product analytics, hosted in the EU/EEA) and Vercel Analytics & Speed Insights (privacy-friendly, cookieless usage and performance metrics, US-based, EU SCCs)

Some of our processors are based outside the EU/EEA (primarily in the United States). Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

We retain your personal data only as long as necessary for the purposes described above:

• Contact/access requests: 2 years from last interaction, or until you request deletion
• Server logs: 90 days
• Active customer data: Duration of the service relationship plus 1 year
• Consultation subscriptions: For as long as your subscription is active. A follow you never confirm receives nothing beyond the single confirmation email. When you unsubscribe, we keep your address marked as unsubscribed so that we do not email you again, and delete it on request
• Public consultation records: While the source record is public on the Commission's portal (section 4)

Under GDPR, you have the right to:

• Access your personal data (Article 15)
• Rectify inaccurate data (Article 16)
• Erase your data ("right to be forgotten", Article 17)
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent at any time, without affecting the lawfulness of prior processing

These rights also apply if you are named in a public consultation record we publish (section 4): write to us with the page link and we will correct the record, or remove your name or contact detail from it.

To exercise any of these rights, contact us at info@policyspeak.com. We will respond within 30 days.

You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, Belgium: www.dataprotectionauthority.be.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated revision date.

PolicySpeak · Rue de la Science 23 · 1000 Brussels, Belgium · info@policyspeak.com