Privacy Policy

1Who is responsible

I, Ali Al Mokdad, operate this site, and I am the data controller for it within the meaning of the General Data Protection Regulation (EU) 2016/679 (GDPR).

Contact for any question or request under this policy connect@gccphilanthropy.org

2What this policy covers

This policy covers gccphilanthropy.org and its sections, including the register, the funding intelligence, the news desk, the toolkit and the member states pages. It does not cover any external website you reach by following a link from here.

3What the site does not do

The site sets no cookies. It runs no analytics, no tag manager, no advertising, no tracking pixels and no social plug-ins. It stores nothing in your browser: no cookies, no local storage, no session storage. There are no user accounts, no logins and no newsletter.

Nothing on the site asks you for personal data except the connect form, which is used only if you choose to write. The technical processing that occurs on an ordinary visit is set out in section 4, and none of it is used to identify you or to build a profile of you.

4What is processed, and why

Four kinds of processing occur.

4.1 Hosting records. The site is served by GitHub Pages, a service of GitHub, Inc. (a Microsoft company). To deliver a page, GitHub receives and may log your IP address, the requested address, the time of the request and the identifying string your browser sends. This is technically necessary to serve the site and to protect it from abuse, and is carried out on the basis of legitimate interests under Article 6(1)(f) GDPR. I do not receive these records and cannot link them to you.

4.2 Fonts. The typefaces used by the site are requested from Google Fonts, a service of Google Ireland Limited. Your browser therefore contacts Google servers, and Google receives your IP address as part of that request. The basis is legitimate interests under Article 6(1)(f): presenting the register in the typefaces it is designed in. If you prefer that Google not receive the request, blocking third-party fonts in your browser prevents it, and the site remains fully readable in a substitute typeface.

4.3 Search. The register carries a search that understands a description rather than only keywords. If, and only if, you run a search, the words you type are sent to a search service I operate, which runs on Cloudflare Workers, a service of Cloudflare, Inc. Cloudflare receives your IP address in order to route that request. The basis is legitimate interests under Article 6(1)(f): you asked for a search, and it cannot be performed without sending the words you typed.

That service keeps nothing. It has no database and no key-value store, it writes no record of the words you type, and it passes them to no company other than Cloudflare, on whose platform it runs. Three models process a search there: two that measure how closely your description matches an organisation's published mandate, and one that writes the short explanation of why a result was returned.

Do not type personal data, confidential information or anything you would not wish to leave your own machine. The field is for describing what an organisation funds, and nothing more is needed from you.

4.4 The connect form. If you write through the connect page, the name, the email address and the message you enter are sent to a script on my own hosting at Namecheap, which forwards them to two mailboxes I read. The basis is Article 6(1)(f): you asked to be put in contact, and the message cannot reach me otherwise. The check that you are a person runs on the page itself and involves no other company. Your message is kept in those mailboxes as correspondence and nowhere else. It is not written to a database, it is not published, it is used only to answer you, and it is deleted on request.

No automated decision-making or profiling within the meaning of Article 22 GDPR takes place. The search ranks published mandates against the words you type. It reaches no decision about you and builds no profile of you.

5Transfers outside the European Economic Area

GitHub, Google, Cloudflare and Namecheap are established in, or transfer data to, the United States. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission adequacy decision for that framework. Where it is not, the transfer relies on that provider's standard contractual clauses. Their own privacy notices govern what they do with data they receive:

• GitHub: docs.github.com/site-policy
• Google: policies.google.com/privacy
• Cloudflare: cloudflare.com/privacypolicy
• Namecheap: namecheap.com/legal/general/privacy-policy

6Retention

I keep no records of visitors, so there is nothing about your use of this site to retain, delete or disclose. Records held by the providers named in section 4 are kept under their own policies and are outside my control.

Personal data appearing in a listed contact route is a separate matter. It is kept only for as long as the organisation itself still publishes it and it remains relevant to the entry, and it is removed sooner on request under section 8.

7Your rights

Where personal data concerning you is processed, the GDPR gives you the right to obtain access to it, to have it corrected or erased, to have its processing restricted, and to object to processing based on legitimate interests. Where Article 20 applies, you may also receive the data in a portable form. To exercise any of these, write to the address in section 1.

Because I hold no visitor data, a request about your use of this site will usually be answered by telling you so and directing you to the provider that holds the record. I will answer within one month.

8Organisations listed in the register

The register describes organisations, not individuals. Entries carry an organisation name, country, city, mandate and its own published contact routes, compiled from public sources.

Where a listed contact route identifies a person, for example a named officer or a personal mailbox published by the organisation itself, that is personal data and the following applies. It is processed on the basis of legitimate interests under Article 6(1)(f), for a public-interest reference work on philanthropic funding in the Gulf. If you are that person, you may ask for the detail to be corrected or removed, and you do not need to give a reason. Write to the address in section 1 and it will be dealt with promptly. Section 8 of the Terms of Use sets out the same route for organisations.

9Children

The site is a reference work for researchers, journalists and non-profit organisations. It is not directed at children and collects nothing from anyone.

10Changes

If the site starts to process anything it does not process today, this policy will be amended before that change goes live, and the date at the top will be updated. Material changes will be described at the top of this policy so a returning reader can see what moved.