The MENA Human Rights Observatory (“the Observatory”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of everyone who visits this website or interacts with our research, newsletters, and publications. This Privacy Policy explains, in plain language, what personal data we collect, why we collect it, the legal bases on which we rely, how long we keep it, and the rights available to you under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and comparable data-protection laws.
This policy applies to this website and to any communication you send to us through it. It does not apply to third-party websites that we may link to; we encourage you to review the privacy notices of those websites separately.
1. Who We Are (Data Controller)
The entity responsible for the processing of your personal data (the “data controller”) is:
- Controller: MENA Human Rights Observatory
- Registered address: Keizersgracht 241, 1016 EA Amsterdam, Netherlands
- Registration / transparency number: KVK 87654321
- Data Protection Contact: [email protected]
Questions about this policy or about how we handle your data can be sent to the data protection contact above. If we are required to appoint a Data Protection Officer (DPO) under Article 37 GDPR, the DPO’s details will be published here.
2. What Personal Data We Collect
We aim to collect as little personal data as possible. Depending on how you use the website, we may process the following categories of data:
- Newsletter subscription data: the email address you provide when subscribing, the language you selected, the source page you subscribed from, and the timestamp and status of your consent.
- Contact and enquiry data: your name, email address, organisation, and the content of any message you send us through our contact channels.
- Technical and usage data: IP address, browser type and version, device type, operating system, referring pages, pages viewed, and timestamps. This data is collected only through analytics cookies after you have given consent.
- Consent data: a record of the cookie and privacy choices you have made, stored so that we can respect them on future visits.
We do not knowingly collect special categories of personal data (such as data revealing political opinions, health, or trade-union membership) about our visitors, and we ask you not to include such information in messages to us unless it is strictly necessary.
3. Purposes and Legal Bases for Processing
Under Article 6 GDPR we must have a legal basis for each processing activity. The table below sets out our purposes and the corresponding legal bases.
| Purpose | Data involved | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Delivering and securing the website | Technical and usage data | Legitimate interests (Art. 6(1)(f)) |
| Sending the email newsletter you requested | Email address, language, consent record | Consent (Art. 6(1)(a)) |
| Responding to enquiries and correspondence | Contact and enquiry data | Legitimate interests (Art. 6(1)(f)) |
| Measuring and improving our content | Analytics and usage data | Consent (Art. 6(1)(a)) |
| Complying with legal obligations (e.g. accounting, responding to lawful requests) | Data required by the relevant obligation | Legal obligation (Art. 6(1)(c)) |
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
4. Cookies and Similar Technologies
We use cookies and comparable storage technologies to operate the website, remember your preferences, and — only with your consent — measure anonymous usage. There are three categories:
- Strictly necessary cookies that are required for the website to function and cannot be switched off through our interface. These include the cookie that remembers whether you accepted or rejected non-essential cookies.
- Analytical cookies that help us understand which pages are read and how visitors move through the site. These are set only after you accept them.
- Preference cookies that remember choices such as your language or reading settings.
For the specific cookie names, purposes, and retention periods, please see our Cookie Policy. You can change or withdraw your consent at any time by clearing the consent cookie in your browser and reloading the site, after which the consent banner will appear again.
5. Your Rights as a Data Subject
Subject to the conditions and exceptions set out in the GDPR, you have the following rights in relation to your personal data:
- Right of access (Art. 15): you may request confirmation of whether we process your data and receive a copy of that data together with information about how it is used.
- Right to rectification (Art. 16): you may ask us to correct inaccurate or incomplete personal data.
- Right to erasure (Art. 17): you may ask us to delete your personal data where there is no compelling reason for us to keep it.
- Right to restriction of processing (Art. 18): you may ask us to limit the way we use your data while a question about its accuracy or lawful use is resolved.
- Right to object (Art. 21): you may object to processing carried out on the basis of legitimate interests, and you have an absolute right to object to processing for direct marketing.
- Right to data portability (Art. 20): where processing is based on consent or contract and is carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format and ask us to transmit it to another controller.
- Right to withdraw consent (Art. 7(3)): you may withdraw consent at any time, including by unsubscribing from the newsletter.
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one month, extendable by a further two months where a request is complex. We may ask you to verify your identity before acting on a request so that we do not disclose data to the wrong person.
6. Data Retention
We keep personal data only for as long as necessary for the purposes described in this policy:
- Newsletter subscriptions: retained until you unsubscribe, after which your email address is deleted or anonymised, except for a minimal suppression record kept to honour your opt-out.
- Contact and enquiry data: retained for up to 24 months after our last exchange, unless a longer period is required for legal reasons.
- Analytics data: retained in aggregate form for up to 14 months, after which it is deleted or anonymised.
- Consent records: retained for as long as the consent remains valid and for a reasonable period afterwards to demonstrate compliance.
7. International Transfers
We prefer to store personal data within the European Economic Area (EEA). Where a service provider processes data outside the EEA, we ensure that an appropriate safeguard is in place, such as an adequacy decision of the European Commission or the Standard Contractual Clauses approved under Article 46 GDPR. You may request more information about the safeguards we rely on by contacting us.
8. Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted transport (HTTPS), access controls, two-factor authentication for administrators, and regular updates to our software. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to reduce risk to a minimum.
9. How to Complain
If you believe that we have not handled your personal data lawfully, we ask that you contact us first at [email protected] so that we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.
Lead supervisory authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority), PO Box 93374, 2509 AJ The Hague, Netherlands — autoriteitpersoonsgegevens.nl.
A list of national supervisory authorities is also maintained by the European Data Protection Board.
10. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The “last updated” date below indicates when the current version took effect. Material changes will be announced on the website, and where required we will seek fresh consent.
Last updated: 2026-09-22.