In force from the moment of publication
Where this Policy diverges from the Charter, the Charter applies; where the Charter diverges from the Declaration, the Declaration applies. The processing of biometric data is described separately, in the Biometric Verification Policy, and where they diverge on that subject it is that Policy which applies.
Controller of personal data. At the structure-formation stage the functions of the controller are performed by the founders of the project. As institutional development proceeds, the function is handed over to a structure, and its registration particulars are published here.
Requests concerning data subject rights: privacy@earth-lings.org
Minimization. Only what is genuinely necessary for the people to work is collected. If a function can be performed without data, it is performed without them.
Purpose limitation. Data collected for one purpose are not used for another. The list of purposes in section 03 is exhaustive.
Intelligibility. Every decision about collecting or using data is explained in ordinary words. If an explanation requires a legal education, then the explanation is a bad one.
Most platforms treat personal data as a commodity. We treat them as part of human dignity.
What: a pseudonym of your choosing, an email address, a country of residence, confirmation of being 18+.
Why: the pseudonym is your public name in the passport and on the platform; the email is for confirming registration and for contact; the country is for statistics on geographical spread; age is a mandatory condition of participation.
Real first and last names are not retained.
What is retained: irreversible cryptographic hashes derived from the document data and from the pairing of the name with the country, and the verification status (passed or not).
What is not retained: images of the face and of the document, biometric templates. They are processed at the moment of verification and deleted.
Why: so that one person cannot hold two valid passports.
Precisely on the status of the hashes. A hash is irreversible: a name or a document number cannot be read out of it. But it does allow a particular person to be singled out among others - otherwise it would not do its job. These are therefore pseudonymized, not anonymous data, and the protection of personal data applies to them in full.
The details are in the Biometric Verification Policy.
What: IP address, browser and device type, operating system.
Why: security, detection of suspicious activity, technical support.
What: records of actions in the interface - which sections were opened, participation in the work of Cells, support requests.
Why: improving how the platform works and technical diagnostics.
What is not here and will not be. How you voted in secret votes is not recorded, is not linked to your account, and is available to no one, including those who operate the platform. Open votes are public by their nature, and their result is visible to all - that is a property of the vote itself, not of analytics.
Usage data are used in aggregate form. These are aggregated data, not anonymized: while a record is linked to an account, it remains personal data.
What: wallet addresses, passport records, transactions.
Why: the working of the infrastructure and your participation in decisions.
Entries in the ledger are by the nature of the technology not deletable - and that is precisely why there are no personal data in them: they hold pseudonymous addresses and marks of actions, not a name, not a document, and not biometrics.
How this relates to the right to erasure (Art. 17 GDPR). The right to erasure is exercised where data are held by us: the account, the results of identity verification, the platform logs - all of this is deleted at your request, and after deletion a ledger entry cannot be linked to you. The ledger entry itself is not deleted, because no one can delete it, ourselves included: it is not under our control and contains no data by which you could be identified. We do not claim that this exhaustively resolves the question - the relationship between immutable ledgers and the right to erasure is not settled in the practice of supervisory authorities. We chose a construction in which no personal data enter the immutable part at all.
Performance of a contract (Art. 6(1)(b) GDPR) - registration, maintaining the account, issuing and servicing the passport, participation in decisions, processing transactions, access to the infrastructure.
Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) - solely for the processing of biometric data during identity verification, and for informational mailings.
There are not and cannot be two bases at once here. Biometrics belong to a special category of data under Article 9 of the GDPR, and neither performance of a contract nor legitimate interest legalizes them by itself. The only basis is your explicit consent, and you are entitled to withdraw it at any time. The consequences of withdrawal are described in the Biometric Verification Policy.
Legitimate interest (Art. 6(1)(f) GDPR) - preventing multiple registrations and abuse, platform security, technical support, maintaining the registry of participants in its non-sensitive fields (pseudonym, country, verification status). You are entitled to object to processing on this basis (section 07).
Legal obligation (Art. 6(1)(c) GDPR) - meeting applicable requirements of law and responding to lawful requests from state authorities.
The list is exhaustive: no processing for other purposes takes place.
Never: advertising and third-party marketing; sale or transfer to data brokers; profiling for commercial purposes; tracking beyond the platform; any purposes not listed above.
Two different resources need to be distinguished here, because they are built differently.
The public site uses no cookies: not for authentication, not for personalization, and not for analytics. The only thing stored in the browser is the interface language you chose, in the device's local storage. This is a technical setting, not an identifier: it is not linked to your identity and is not sent to the server.
The platform, where you log in to an account, uses technically necessary session cookies - without them logging in is impossible. They are not used for analytics, for advertising, or for tracking beyond the platform, and they are deleted when you log out of your account.
There are no analytics or advertising cookies either on the site or on the platform, and no third-party trackers are installed.
By default data remain within the people's infrastructure. The exceptions are limited to three cases.
Technical providers. Identity verification is performed by the people's own system. Hosting and attack-protection providers are used to run the infrastructure. They act strictly on our instructions and have no access to participants' personal data.
Lawful requirements. Data are transferred only under a court decision in force or an equivalent lawful requirement, whose legitimacy is checked in every case. A participant is notified of requirements that have been complied with, unless the decision itself prohibits it; a summary is published in the transparency report.
Public data of decisions. Some data are public by the nature of self-government: proposals, voting results, movements of common funds. How a person voted in secret votes does not fall into this category.
The infrastructure is built so that no single point exists whose compromise would expose all the data. The registry of passports lives on a distributed network, not on our servers, and remains verifiable regardless of whether the platform is running.
In the event of an incident. If a security breach occurs affecting your data, we will notify you within 72 hours of discovery and report the measures taken.
Access. To obtain a copy of your data and information about how they are processed.
Rectification. To correct inaccurate or incomplete data.
Erasure. To delete data outside the distributed ledger. Entries in the ledger are by the nature of the technology not deletable; on exit the passport is burned, and a pseudonymous mark remains in the ledger recording that membership existed during a particular period. This is a fact of the past, not a continuing membership.
Restriction of processing (Art. 18 GDPR). To require processing to be suspended while the accuracy of data or the merits of an objection are checked.
Objection (Art. 21 GDPR). To object to processing based on legitimate interest. We cease processing unless we demonstrate compelling legitimate grounds overriding your interests.
Portability. To receive your data in machine-readable form and transfer them to another controller.
Withdrawal of consent (Art. 7(3) GDPR). To withdraw consent to the processing of biometric data or to mailings at any time. Withdrawal does not affect the lawfulness of processing before it was received; the consequences are described in the Biometric Verification Policy.
Freedom from purely automated decisions (Art. 22 GDPR). You are entitled not to be subject to a decision based solely on automated processing and producing significant consequences for you.
What this means in practice. An automated refusal of identity verification is not final: you are entitled to state your position and to demand review by a human being, and after two unsuccessful automated attempts the review is carried out without a separate request.
The supporting tools that analyse proposals on the platform take no decisions: their outputs are advisory, the reasons are disclosed, and consideration by a human being is guaranteed.
Complaint. To lodge a complaint with the data protection supervisory authority of your country.
Exit. To end participation at any time: you burn the passport with your own key, the account is marked as terminated, and the link between the data and your identity is broken.
How to exercise these. Most functions are available in your personal account. For the rest: privacy@earth-lings.org. We reply within 48 hours and complete the handling of a request within 30 days.
Having become an earthling, a person remains one by their own choice. No decision of a majority, including a qualified one, can deprive them of belonging to the people. Exit is possible only by the voluntary decision of the participant themselves.
An active account. Data are held for the duration of participation in the people.
After exit. The link between the data and the person is broken, and the processing of the account's personal data ceases. Irreversible hashes are retained in pseudonymized form solely so that one person cannot hold two valid passports; they do not limit the right to return.
Technical logs. IP addresses and timestamps - up to 12 months, for security and incident investigation.
Distributed ledger entries. Retained permanently by the nature of the technology. When a passport is burned the entry is marked as burned and gives access to nothing; it contains no personal data to begin with.
The people is transnational, and data may be processed in different jurisdictions.
Infrastructure is chosen by technical capability and the level of human rights protection, not by political affiliation.
Participation is possible on reaching the age of 18. This follows from the nature of the commitments: signing the Declaration, taking part in decisions, disposing of units of account.
The age of 18 is an unconditional requirement, and the consent of parents or guardians does not substitute for it.
If it becomes known that a person under the age of 18 has registered, the account is immediately suspended and the data outside the ledger are deleted. The passport is burned in that case: either by the holder themselves or, if that does not happen, under the procedure for annulment of an invalid issuance, since age is a condition of issuance (Charter, Article 21). Entry is possible on reaching the age of 18 on general terms.
Educational initiatives for young people are run through separate programmes that do not require registration in the people.
The Policy is updated as technology and legislation develop. Amendments are published with the date of entry into force.
For material changes:
For questions about this Policy: privacy@earth-lings.org