Kicklaws Privacy Policy

1. Data Controller

2. Personal Data We Collect

• Account data: name, email address, password (stored encrypted).
• Participation data: your votes on proposals, comments, and proposals you submit.
• Technical data: IP address, browser type, device details, and log files related to the time and date of your visits.
• Cookie data: see our Cookie Policy.

We do not knowingly collect personal data from persons under 18 years of age.

3. Purposes and Legal Bases of Processing (Art. 6 GDPR)

• Performance of a contract (Art. 6(1)(b) GDPR): to create and manage your account, verify your identity for voting integrity, record your votes, and display voting results.
• Legitimate interests (Art. 6(1)(f) GDPR): to ensure the security, integrity, and technical functioning of the Service, and to prevent fraud and abuse (e.g., duplicate voting).
• Consent (Art. 6(1)(a) GDPR): to send you email updates about the progress, status, and outcome of laws you have voted on, and notifications about new or related proposals; and to place non-essential cookies. You may withdraw your consent at any time (see Section 4).
• Legal obligations (Art. 6(1)(c) GDPR): to comply with applicable laws, including responding to lawful requests from authorities.

4. Consent and Right to Withdraw

• by using the unsubscribe link included in every update email;
• by adjusting your cookie preferences via the "Cookie Settings" link; or
• by contacting us at the address in Section 1.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

5. Recipients of Personal Data

6. International Data Transfers

Your data is primarily processed in Switzerland and the European Economic Area (EEA). Switzerland benefits from an EU adequacy decision. Where data is transferred to a country outside the EEA/Switzerland that does not provide an adequate level of protection, we ensure appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of these safeguards by contacting us.

7. Data Retention (Art. 5(1)(e) GDPR)

• Account data: retained as long as your account is active, then deleted or anonymized within 30 days of account deletion, unless a longer period is required by law.
• Voting data: anonymized voting results may be retained indefinitely; the link between a vote and your identity is deleted when your account is deleted.
• Technical logs: retained for a maximum of 12 months for security purposes.

8. Data Security (Art. 32 GDPR)

We implement appropriate technical and organisational measures to protect your personal data, including encryption of passwords, TLS encryption in transit, access controls, and regular security reviews.

9. Your Rights (Arts. 15–22 GDPR)

• Right of access (Art. 15): obtain confirmation of whether we process your data and receive a copy of it.
• Right to rectification (Art. 16): have inaccurate or incomplete data corrected.
• Right to erasure / "right to be forgotten" (Art. 17): have your data deleted, subject to legal retention obligations.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object at any time to processing based on legitimate interests, and to direct marketing.
• Right not to be subject to automated decision-making, including profiling (Art. 22). We do not carry out such decision-making.

To exercise these rights, contact us as described in Section 1. We will respond within one month (Art. 12(3) GDPR), free of charge. We may ask you to verify your identity before fulfilling a request.

10. Right to Lodge a Complaint (Art. 77 GDPR)

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC).

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced on the Service and, where the changes affect processing based on your consent, we will seek your renewed consent. The "Last updated" date at the top indicates the latest revision.