Privacy Statement River Plastic Survey App

This privacy statement is applicable to the mobile and web application of The Ocean Cleanup (hereafter: “The Ocean Cleanup’’, ‘’we’’, ‘’us’’). The applications are referred to as the River Survey App throughout the rest of the document.

We value your privacy. In developing this app, we have taken the General Data Protection Regulation (‘’GDPR’’) into consideration and we have taken measures to process and protect your personal data accordingly. Safeguarding the privacy of our users is our top priority, in this privacy statement we explain, among other things, which personal data we process, how and why we do this and how we protect your personal data. In addition, we explain what your rights are as a data subject.

This privacy statement only relates to the processing of personal data in the River Survey app. The privacy statement relating to the processing and protection of personal data via our website can be found here.

We recommend that you read this statement carefully. If you have any questions regarding the statement and how we process your data, you can contact us using the following contact details:

The Ocean Cleanup HQ
Batavierenstraat 15, 4-7th floor
3014 JH Rotterdam
The Netherlands

https://theoceancleanup.com/contact/

riversurveyapp@theoceancleanup.com

1. Processing of personal data

We process your personal data for the following purposes:
i) Providing our services;
ii) Optimizing the user experience of the River Survey App.
iii) Research, namely the improvement/refinement of algorithm;
iv) We process name and e-mail address for registration purposes in the app and in order to communicate with you regarding the information you provided.
v) We process user time and location data in order to monitor the River plastic movements in real time.

We determine, alone, the purposes and essential means related to the processing of your personal data. We are therefore a data controller within the meaning of the GDPR. In this statement we explain how, as controller, we process your personal data when using the River Survey App.

2. What personal data do we process and for which purpose?

All information about an identified or identifiable individual is considered personal data. Examples of this are name and telephone number. When data is anonymized or sufficiently aggregated, making it impossible to link the data back to you or another identifiable natural person, the data is no longer regarded personal data.

The Ocean Cleanup considers it important and makes every effort to process only correct information and not to process more personal data than is necessary for these purposes (in line with the principle of data minimization). We collect the following categories of personal data on the basis of the grounds listed below and for the following retention periods:

If you wish to unsubscribe, please e-mail: riversurveyapp@theoceancleanup.com

3. Ways of processing data

In order to perform our services, we process your personal data in the following ways:

• capture;
• store;
• shield and remove;
• back-up.

4. Cookies

Cookies are small files that are sent with, for example, web pages or apps and are stored on your device. The information stored therein can be used again on a subsequent visit, for example to remember your preferred settings.

The River Survey App processes functional cookies and social media cookies. The associated cookie statement is included here.

5. Third parties

We use third parties for some of our services

• For cookie suppliers, please see our cookie notice.
• We use Sentry as a third-party error tracking service. This service allows us to automatically collect error log information, which helps the app work properly.
• The app uses Microsoft as hosting party. We concluded a contract with Microsoft that includes agreements to protect your personal data.

6. Third countries

The Ocean Cleanup stores the data on a server in Ireland, where Microsoft’s server is based. As the GDPR is also applicable in Ireland it can be assumed that they manage personal data accordingly.

7. Security measures

We believe it is important to ensure that your personal data is safe for as long as we have it. The Ocean Cleanup has therefore taken appropriate technical and organizational security measures. These measures ensure that your personal data is safe with us and is protected against misuse or accidental, unlawful or unauthorized destruction, loss, alteration, disclosure, acquisition or access.

We regularly check whether our security measures are still appropriate, so that we always maintain a high level of protection. The Ocean Cleanup has taken many security measures including the following:

• All communication between mobile app and backends happens by means of the HTTPS/TLS protocol, current state of the art.
• Passwords are hashed with best practice before going out to the authentication backend. The server rehashes these passwords before storing them in the database.
• Non-disclosure agreements with anyone who comes into or may come into contact with personal data in the context of processing operations by The Ocean Cleanup.
• The Ocean Cleanup takes care of logical and physical (access) security, keeping it up-to-date and securing digital equipment;
• The Ocean Cleanup stores data securely and makes regular backups;
• The Ocean Cleanup encrypts personal data.

8. Your Rights

We do our best to process requests regarding your rights within one month. We also have the right to extend this period by a maximum of two months if your request is very complex. If this is the case, we will let you know within the first period of one month and we will also explain why we need more time.

Right to information

Data subjects have the right to be informed on the personal data that are being processed and how the data are processed. The Ocean Cleanup informs you by means of this privacy statement.

Right of access

Data subjects can request insight in their personal data processed by the The Ocean Cleanup.

Right to rectification

In case we processed your data and they are incorrect or incomplete, you can request us to correct this.

Right to revoke consent

In case we process data on the lawful ground of consent, data subjects van revoke consent at any moment.

Right to erasure

In certain cases data subjects have the right to request erasure of their personal data. You can request this when:

• You are of the opinion that we no longer need your personal data;
• You objected the use of your personal data;
• You are of the opinion that we do not follow the privacy rules when processing your data;
• We are legally obligated to delete your personal data;
• We unintendedly processed the data of a person below the age of 16.

Right to restriction of processing

In some cases you have the right to restrict the processing of your data, namely when:

• You have indicated that the personal data we process are incorrect and you asked us to change the data;
• If we are not allowed to process the data according to the privacy rules but you do not want us to delete the data, for example if you want to request the data later;
• If we no longer need the personal data and should actually delete it, but you do not want the data to be deleted. For example because you will need the data later;

If you have objected to the processing of your personal data and it is not yet clear whose interest is prevailing (yours or ours), we are not allowed to use your personal data further and the processing will be limited.

Right to data portability

You may receive data that you have provided to us in a structured, commonly used and machine-readable form, so that you can transfer it to another organization.

Right to object

You have the right to object to the processing of your personal data. This is possible in two cases: when you receive advertising without your consent or because of personal circumstances. You can only object processing by an organization that does this on the basis of a task carried out in the public interest of to promote its own interests. In some cases the The Ocean Cleanup may rely on a legitimate interest for the processing of your personal data. If you object to the processing of your personal data, we will cease the processing of your personal data (unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or when the processing of your personal data is related to the establishment, exercise or defense of legal claims).

Right to avoid automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling. The The Ocean Cleanup does not make decisions based solely on automated processing of personal data that have consequences for you. We also do not use profiling.

For any questions or complaints regarding the processing of data you can contact The Ocean Cleanup. Finally, in addition to the rights mentioned above, in case you believe we do not process your data according to the General Data Protection Regulation you have the right to lodge a complaint with a supervisory authority, such as the Dutch Data Protection Authority.

If you wish to evoke your rights you can do so by contacting us:

The Ocean Cleanup HQ
Batavierenstraat 15, 4-7th floor
3014 JH Rotterdam
The Netherlands

https://theoceancleanup.com/contact/

riversurveyapp@theoceancleanup.com

9. Children’s privacy

We understand that children’s privacy deserves extra protection, especially in digital environments. The Ocean Cleanup does not aim to processes personal data of children aged 16 or younger for its own purposes.

We take the following measures to prevent this:

• The River Plastic Survey app is not specifically aimed at children.
• If the situation arises that The Ocean Cleanup knowingly processes data of children aged 16 or younger, these will be deleted.

10. Questions or complaints

If you have any questions or complaints about the use of your personal data, you can always contact us via our contact details. In that case we will try to find a solution together with you.

Our contact details are:

The Ocean Cleanup HQ
Batavierenstraat 15, 4-7th floor
3014 JH Rotterdam
The Netherlands

https://theoceancleanup.com/contact/

riversurveyapp@theoceancleanup.com

If you suspect that The Ocean Cleanup is processing your personal data in a way that is contrary to the GDPR, you can submit a complaint to the Dutch Data Protection Authority (AP) via the following link: https://autoriteitpersoonsgegevens.nl/nl/zelf-doen/privacy rights/complain-to-the-ap. You can also send a letter to this supervisory authority:

Dutch Data Protection Authority
Box 93374
2509 AJ in The Hague

11. Changes

We may amend this statement from time to time. Please refer to the date at the bottom of this statement to find out when the privacy statement was last revised. Any changes to this statement will become effective when we post the revised statement in the River Survey App.

Last updated: 07/12/2020