PRIVACY
POLICY.
Introduction
The Human Development Research Initiative is committed to ensuring the privacy of all our users. This policy represents our commitment to your right to privacy. This Privacy Policy outlines Human Development Research Initiative’s information processing practices in relation to you and your personal data and applies when we collect and process personal data from you through various sources, and explains your rights regarding your personal data.
“Human Development Research Initiative” or “HDRI” refers to Human Development Research Initiative, and also referred to as “we” “us” , , or “our” . HDRI is the controller to which this policy refers to.
Human Development Research Initiative, a national research and policy-oriented civil society organization (NGO), governed by the Law of 1 July 1901, registered under SIREN number 103 531 935 and RNA number W751275674 with registered seat at 50 Rue des Tournelles, 75003 Paris, France.
Definitions
This Privacy Policy is to be understood in line with the General Data Protection Regulation, Regulation (EU) 2016/679, as amended.
-
‘Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
-
‘Personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
-
‘Processing’ means any operation performed on personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
-
‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
-
“You” or “Your” refers to those who interact with our website or otherwise submit personal data to the Human Development Research Initiative.
What types of information do we collect, and how?
HDRI collects personal data that you provide personally, but we also gather data from other sources, including social networks and third-party service providers. For more details, refer to the Third Party Services section.
We collect and process the following information:
-
Data you provide, like your name and email address.
-
By filling out surveys, sign up for events, applying for volunteer positions, or contacting us in any other manner.
-
-
Data about your engagement with our services, such as:
-
Interactions with our social media content
-
Whether you click on links on our website.
-
The acceptance of cookies on our website.
-
How do we use your data?
HDRI collects your data so that we can:
-
Deliver content on our website.
-
Personalise our content and communications with you.
-
Respond to your inquiries.
-
Comply with applicable laws.
We will NOT:
-
Sell your data to third parties;
-
Transfer your data to third parties, other than those outlined within this Privacy Policy, unless it’s relevant authorities, and required by law.
We do not use automated decision-making technology in relation to your personal data.
How do we store your data?
HDRI stores your data in different manners, depending on how you interact with us.
We store all data pertaining to applications, events, HR and financial data on our Google Workspace, cf. below. If we store your data on another platform, you will be informed of this before you submit your data.
Who has access to your data?
Personal data is processed exclusively by authorised HDRI personnel and solely for purposes related to the organisation’s activities.
Personal data collected through our surveys, can be accessed by the relevant volunteers, or members of staff, tasked with processing the data, but not anyone else. We regularly assess who requires access to personal data, and remove access if the persons no longer have a need to access the personal data.
Third Party Services
We are not responsible for data provided to third parties by following external links on our website, nor for how those data are used. Our privacy policy only applies to our services.
We use the following third parties to provide our services:
Google Workspace
Within the Google Workspace suite, we use Google Forms, Gmail, Google Docs, Google Sheets Data is only collected with your explicit consent. Measures are in place to uphold the compliance with any applicable laws. For more information about measures taken by Google, you may consult their privacy policy for Google Workspace. HDRI has indicated that we are bound by the “European Requirements” set out in their privacy policy.
WhatsApp is used for communication and coordination within HDRI. WhatsApp is provided by Meta Platforms and may involve the transfer and processing of personal data outside the European Economic Area (EEA). Appropriate safeguards are implemented to support compliance with applicable data protection regulations, including the General Data Protection Regulation (GDPR). Further information regarding WhatsApp’s data processing and privacy measures can be found on the official WhatsApp website and privacy policy.
Zoom
Zoom is used for online video meetings and events, which we may record and store within Google Workspace, based on the consent of all participants. HDRI does not transfer any data to Zoom, but Zoom collects personal data. You may consult Zoom’s privacy policy on their website.
Usercentrics (to be updated with new website)
Usercentrics is used to manage GDPR-compliant cookie-consent-collection on the HDRI website (https://www.hdevri.org/). Data is stored inside the EU on Microsoft Azure servers.
Sharing Data with Third Parties in Collaborative Projects
In some cases, HDRI may collaborate with external organisations to jointly promote events, campaigns, or other initiatives. If personal data is collected as part of such a collaboration, for example, through a sign-up form or link provided on our website or communication channels, the data may be processed by the partner organisation in accordance with their privacy policy.
When HDRI includes links to a collaborating party’s website or platform, please note that any data submitted through those channels will be subject to the third party’s data protection practices and policies, and not the one of HDRI.
We encourage users to review the privacy policies of any external organisations prior to submitting personal data.
Legal Basis for Processing Your Data
We only collect and process your personal data if we have a legal basis, which may include:
-
Explicit Consent: We process your personal data based on your explicit consent. You can withdraw your consent at any time. To unsubscribe from our newsletter, please use the link at the bottom of each newsletter. You can also update your profile through the link provided. Additionally, you have the right to request the deletion of all your information.
-
Legal Obligation: In certain circumstances, we may need to process personal data to comply with legal obligations, such as for auditing and accounting purposes.
-
Legitimate Interests of the Organisation: We process your personal data for legitimate business purposes. These purposes do not override your interests, fundamental rights, or freedoms. You have the right to object to our processing of your personal data for these legitimate interests. Our purposes include:
-
Communicating with you.
-
Understanding your engagement with our newsletter and website.
-
Ensuring the security of our services and preventing fraud.
-
Responding to your queries or complaints. Meeting internal business needs.
Compliance and Data Protection Practices
In general, we ensure that we follow data protection rules, document our compliance, and act appropriately in case of a personal data breach or request from a data subject.
Our data processing activities are conducted lawfully, fairly, and transparently. For each processing activity, we assess its lawfulness, limit data processing to its intended purpose, and minimize the amount of data processed.
We ensure that all personal data is accurate, secure, and retained only as long as necessary. All personal data we process is stored securely in digital systems with controlled access limited to relevant internal stakeholders.
In the event of data loss, breach, public exposure, hacking, damage, or corruption, we assess the potential impact and determine the necessary steps. If needed, we will inform the affected data subjects and file a report with the relevant data protection authority within 72 hours.
Data subjects have certain rights which we respect. They can contact us to exercise these rights, and we are committed to responding appropriately.
As an organisation, we undertake all necessary technical and organisational measures to ensure compliant personal data processing. This policy is one aspect of our compliance efforts, alongside our data processing register and external data privacy policy.
Data Retention
We will retain your personal data as long as it is needed to fulfil the purposes for which it was collected (see Legal basis) or until you withdraw your consent for us to process it.
You may withdraw your consent at any time.
We regularly go through our data, to delete personal data that we no longer have a purpose for processing. We may keep some of your personal data for up to 10 years, namely concerning financial and human resources data in our financial accounts, to comply with statutory requirements.
Your Rights
You have a number of rights with regard to the personal data that we hold about you, and you can contact us if you have questions about the following rights, or wish to exercise any of these rights:
-
The right to be informed: You have the right to be informed about any processing that we undergo in relation to your personal data. (Art. 12, 13, 14 GDPR)
-
The right to access: You have the right to receive a copy of the personal data we hold about you and where applicable receive a machine-readable copy of your personal data. (Art 15. GDPR)
-
The right to rectification: You have the right to rectify any inaccuracies in relation to the personal data we hold about you. (Art.16 GDPR)
-
The right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
-
The right to erasure: You have the right to request that we erase your personal data, under certain conditions. (Art. 17, 19 GDPR)
-
The right to object: You have the right to object to the processing of your personal data, under certain conditions. (Art- 21 GDPR)
-
The right to withdraw consent at any time: Where you have provided us with consent to use your personal data, you can withdraw this at any time. (Art. 7 GDPR)
-
The right to data portability: You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions. (Art. 20 GDPR)
You have the right to lodge a complaint with a Data Protection Authority if you are dissatisfied with the way we process your personal data, or if you find that one of your rights as described above has been breached.
You may lodge a complaint with the Data Protection Authority in the country of your habitual residence; your place of work; or the place where the alleged infringement took place.
You can find the contact information of every Data Protection Authority on the European Data Protection Board website.
How to contact us
If you have any questions, would like further information about our privacy and information about our privacy and information handling practices, would like to enact your rights as described above, or would like to make a complaint about any breaches, please contact us at these email addresses: info@hdevri.org ; legal@hdevri.org :
Changes to this Statement
We may update this Statement from time to time. When we do, we will post the current version on this site, and we will revise the version date located at the bottom of this page.
We encourage you to regularly check back so that you will be aware of our privacy practices.
This Statement was last updated on 01/05/2026.