How we handle your data.

01 Who is responsible

The data controller is EcoHubs.community, based in Ecuador. Questions, requests and complaints about your data go to privacy@ecohubs.community, or through our contact form.

We have not designated a Data Protection Officer. Everything about your data goes to the address above, and a person answers.

Membership records, governance and voting live in ecohubsOS (os.ecohubs.community), our own membership system, run by the same team. This page covers what reaches it from this website.

This policy also covers rcos.ecohubs.community, the website of the RCOS standard, run by the same team. It has no forms and uses fewer services: Vercel hosts it, Google Analytics works there exactly as described below, and its video and podcast players load only when you press play. Your cookie choice applies to both sites.

02 What we collect

If you write to us

• Your name, email address and message.
• We email the message to our team and send you a confirmation.

If you apply for membership

• Your name, email address, location, languages and time availability.
• Your answers about your values, motivation, experience, how you work with others and what you hope to give and receive.
• The application goes to ecohubsOS, and a copy is emailed to our team so a person reads it. You get a confirmation email.
• While you fill it in, a draft is saved in your own browser so you don't lose your work. We don't receive it until you submit, and it is cleared when you do.

If you subscribe to the newsletter or join the EcoHub One waitlist

• Your email address, and the list you joined.
• For the waitlist, anything you choose to add in the optional second step: first name, location, skills or profession, and why you want to join.
• Whether you confirmed the subscription, and whether you unsubscribed. Our mailing tools can also record whether an email was opened and which links were clicked.

If you take the Community Resilience Assessment

• Your email address, your community's name, website, location and size, and a summary of your quiz answers.
• If you then send us your community's agreements for a report, we read them, write the report, and delete the documents.

Everyone who visits

• Request logs: your IP address, the time and the page requested, kept for security and to fix problems.
• Anonymous visitor counts (Vercel Web Analytics): pages viewed, referrer, country, device and browser type. No cookies; see section 05.
• Your IP address, briefly and in memory only, to stop the same address from sending dozens of form submissions. It is not stored.
• Google Analytics: cookieless measurement until you choose, and cookies only if you accept them in the cookie banner; see section 05.

If you are an EcoHubs member

If your ecohubsOS profile is public, the member map on our homepage shows your display name, location, profile photo and contribution points. We fetch it from ecohubsOS and keep a copy for up to 12 hours. To be taken off the map, write to us.

In your own browser

Some things are saved only on your device and never sent to us: your application draft, whether you have dismissed the newsletter pop-up, your colour theme, and in the Learning Hub your reading depth, progress, bookmarks and quiz answers. Your cookie choice is different: it is a cookie, so your browser sends it along with requests to our sites, as it does with every cookie. We don't record or use it on the server.

03 Sensitive information

Our application asks how you want to live and work with others, so your answers may touch on things like your beliefs, health or family situation. We don't ask for these directly. Share only what you are comfortable with. Whatever you write is used only to consider your application, is read only by the people who do that, and is never published.

04 Why we use it, and on what basis

Every use has its own basis under Article 7 of the LOPDP. We ask for consent separately for each purpose and never bundle them:

• Answering your message: your consent, given when you send the contact form.
• Considering your membership application: your consent, given when you submit the application.
• Sending the newsletter or waitlist updates: your consent, confirmed through the link in the first email we send you.
• Sending your resilience report: your consent, given when you submit the assessment form.
• Google Analytics cookies and campaign tracking on two landing pages: your consent through the cookie banner. Declining changes nothing else on the site.
• Visitor counts (ours, and Google's cookieless measurement before you choose), spam protection and logs: our legitimate interest in keeping the site working, safe and useful, limited to what that needs. You can object at any time.
• Showing members on the homepage map: the member's choice to make their ecohubsOS profile public.
• Legal obligations: where the law requires us to keep or hand over data.

You can withdraw any consent at any time: unsubscribe from an email, change your cookie choice, or write to us. Withdrawing doesn't affect what happened before.

05 Cookies, analytics and tracking

Vercel Web Analytics (always on, no cookies)

Counts page views without cookies. It recognises a visit only by a code derived from the request, which changes every 24 hours, so it can't follow you across days or identify you.

Google Analytics 4 (cookies only with your consent)

The Google tag loads on every page, but until you accept in the cookie banner it sets no cookies and stores nothing on your device. It does send Google cookieless signals, such as that a page was viewed, which carry no identifier of yours and which Google uses to estimate overall numbers. As with any request, Google sees your IP address; anonymisation is on.

If you accept, it also sets its cookies (_ga, _ga_*) to show us which pages people read and how they found us. Accepting grants analytics only: Google's advertising signals stay switched off. Everything works the same if you decline.

Campaign tracking on two landing pages (Mautic, only with your consent)

On the Community Resilience Assessment and the EcoHub One waitlist pages, if you accept in the cookie banner, we load the tracking script of our own Mautic installation. It sets cookies (mtc_id, mautic_device_id) that recognise your browser on those pages, and if you then sign up, it links those visits to your email address so we can see how you found us. It runs on our own server, and nothing goes to an advertising network. If you decline, it never loads, and the forms work exactly the same. No other page loads it.

Spam protection and videos

Cloudflare Turnstile checks that a form is sent by a person; it sees your IP address and browser signals. Video previews are images loaded from YouTube; the video player itself (youtube-nocookie.com) loads only when you press play. On rcos.ecohubs.community, the podcast player (RSS.com) also loads only when you press play.

Changing your choice

Your choice is stored in a cookie (ecohubs_consent) that ecohubs.community and rcos.ecohubs.community share, so you choose once for both. It expires after six months, and then we ask again. To change it sooner, use Cookie settings at the bottom of any page. Our fonts are hosted by us, so loading the site doesn't contact Google Fonts.

06 Who else handles your data

These providers process data on our behalf and only for the purpose described. We don't sell, rent or trade personal data, and nobody else gets it.

Vercel

Serves this website, keeps short-lived request logs and counts visits (Vercel Web Analytics). United States

IONOS (ionos.de)

Rents us the server we manage ourselves. It runs ecohubsOS (where applications and member profiles live), our blog (Ghost), our newsletter (Listmonk) and our mailing and campaign tool (Mautic). Server located in the United States

Mediakular

Its mail server delivers the emails we send, including form confirmations, on our behalf. United States (on the same IONOS server)

Cloudflare

Turnstile, the spam check on the contact and application forms. It sees your IP address and browser signals, not what you write. United States

RSS.com

The podcast player on rcos.ecohubs.community. It loads only when you press play; from then on RSS.com sees your IP address and browser details, like any website you visit. Not yet confirmed

Google

Google Analytics: cookieless measurement until you choose, cookies only if you accept. Video previews come from YouTube; a video itself loads only when you press play. United States

Discord

Our private error alerts. If a form submission fails, the alert can include your name, email address and IP address, so we can reach you and your message is not lost. United States

07 International transfers

We are based in Ecuador, but most of our infrastructure is not. The server we rent from IONOS, which also runs the mail server, is located in the United States, as are Vercel, Cloudflare, Google and Discord. Using this site therefore means your data is transferred to the United States.

We only use providers that protect data with the safeguards the LOPDP recognises for such transfers, such as data processing agreements with standard contractual clauses, and we send each of them only what their task needs.

08 How long we keep it

Contact form messages

Two years after our last exchange.

Membership applications

While we consider them, then one more year if you do not become a member. If you do, your record stays in ecohubsOS for as long as you are a member.

Newsletter and waitlist subscriptions

Until you unsubscribe (every email has a link) or ask us to delete them. After unsubscribing we keep only your address, marked as unsubscribed, so we never write to you again by mistake.

Community Resilience Assessment answers

Until you ask us to delete them, and at most two years.

Community agreements you send us for a resilience report

Deleted once we have sent you the report.

Campaign tracking on the two landing pages (Mautic)

Visits linked to a sign-up: as long as the subscription. Visits that never led to one: until our yearly clean-up deletes them.

Google Analytics

Detailed, user-level data: at most 14 months, the longest Google allows. Google's summary reports keep only aggregated numbers.

Vercel Web Analytics

Stored only as aggregated counts. The daily identifier it uses is discarded after 24 hours.

Request logs

Vercel's: a few days at most. Our own server's (IP address, time, page requested): rotated monthly, at most 10 months.

Error alerts

Deleted by hand once we have dealt with the problem.

Data kept in your own browser

On your device until you clear it. We never receive it.

09 Your rights

Under the LOPDP you have the right to:

• Access: ask what we hold about you and what we do with it.
• Rectification: have inaccurate or incomplete data corrected.
• Deletion: have your data erased.
• Objection: object to processing based on our legitimate interest.
• Portability: receive your data in a structured, commonly used format.
• Restriction: ask us to suspend processing while a question is settled.
• No automated decisions: we make no decisions about you by automated means alone. People read every application.
• Withdrawing consent: at any time, without affecting what happened before.

Write to privacy@ecohubs.community from the address you gave us, or tell us how we can confirm it's you. We answer within 15 business days, as the LOPDP requires, and it costs nothing.

10 Security

• The site and every service behind it are served only over HTTPS.
• Forms are protected by Cloudflare Turnstile, a hidden spam trap and rate limits. The website talks to ecohubsOS only with secret keys.
• Access to applications, messages and subscriber lists is limited to our team.
• We keep an internal record of what we process and why, collect as little as we can, and delete what we no longer need.
• If a breach puts your data at risk, we tell the supervisory authority and you, within the deadlines the LOPDP sets.

11 Children

EcoHubs is for adults. Our forms are not meant for anyone under 18, and we don't knowingly collect their data. If you believe a child has sent us something, write to us and we delete it.

12 Changes to this policy

When we change something that matters, we update this page and the date at the top. If a change affects what we do with data you have already given us, we ask you again.

13 Complaints

If you think we have handled your data wrongly, please tell us first. We'd like to put it right. You can also complain to Ecuador's Superintendencia de Protección de Datos Personales (SPDP).