Informativa sulla privacy

1. General Information

1.1 Introduction

Carbon Copy Association (“Carbon Copy”, “we”, “us”) attaches great importance to the protection of personal data.

This Privacy Policy explains how personal data is processed when you use the @gora mobile application and related digital services, or when you otherwise interact with Carbon Copy. It describes, in particular, the categories of personal data processed, the purposes and legal bases of processing, potential recipients, retention periods, and the rights of data subjects.

This Privacy Policy is intended to comply with:

• the Swiss Federal Act on Data Protection (DSG); and
• the EU General Data Protection Regulation (GDPR), where applicable.

The applicability of the GDPR depends on the specific circumstances, including the place of residence of the data subject and the nature of the relevant processing activity.

1.2 Controller

The controller within the meaning of Art. 4(7) GDPR is:

Carbon Copy Association
Oescherstrasse 26
CH-8702 Zollikon
Switzerland
hi@carbon-copy.org

Carbon Copy operates, inter alia, the @gora mobile application and related online services.

1.3 Scope

This Privacy Policy applies to all processing of personal data carried out within the scope of Carbon Copy’s activities and digital offerings.

Specific offerings or processing activities, including events, surveys, learning modules, participatory formats, or job applications, may be governed by supplementary data protection notices. Such notices apply in addition to this Privacy Policy.

Carbon Copy reserves the right to amend this Privacy Policy where necessary. The current version is made available via the app or website.

2. Categories of Personal Data and Purposes of Processing

For the purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person.

Carbon Copy processes personal data only insofar as necessary for the purposes set out below.

2.1 Master Data

This may include:

• name or username;
• email address;
• contact details; and
• other information voluntarily provided when registering, contacting us, or participating in events, surveys, learning modules, or community features.

Purpose: User registration, communication, participation management, provision of services, and, where necessary, internal account administration, user support, moderation, security, abuse prevention, billing, and legal compliance.

2.2 Contractual and Participation Data

This may include:

• participation records;
• consent records;
• contractual or pre-contractual information;
• administrative or billing data, where applicable; and
• data required to comply with legal obligations.

Purpose: Fulfilment of contractual or participation-related obligations and compliance with applicable law.

2.3 Communication Data

When you contact Carbon Copy, we process the content and metadata of communications via:

• email;
• in-app messaging;
• contact forms;
• social media channels; and
• telephone or video calls, where applicable.

Purpose: Handling inquiries, providing support, moderation, and documentation.

2.4 Usage and Analysis Data

When using the @gora app or website, we may process:

• information on usage patterns, such as visited sections and duration;
• interaction data; and
• technical events, such as errors or crashes.

Where feasible, such data is aggregated, anonymised, or pseudonymised and is not combined with directly identifying information.

Purpose: Ensuring technical stability, improving usability, evaluating participatory formats, and developing our offerings.

Once data has been anonymised in such a manner that no individual is identifiable, it is no longer considered personal data and may be used independently of individual user accounts.

2.5 Content and Information Services

Where you have given your consent, we may process personal data to inform you about:

• our own events;
• educational content; and
• programs and initiatives.

Purpose: Information and communication relating exclusively to Carbon Copy’s activities.

2.6 Technical and Security Data

This may include:

• IP addresses, shortened or stored only temporarily where possible;
• log files;
• device and app version data; and
• security-relevant events.

Purpose: IT security, abuse prevention, error analysis, and safeguarding system integrity.

2.7 Artificial Intelligence

In limited cases, Carbon Copy may use AI-supported tools to assist with:

• content moderation;
• aggregated analysis; and
• improvement of educational or participatory formats.

Where AI-supported tools are used:

• human oversight is ensured at all times;
• no automated decision-making producing legal or similarly significant effects takes place; and
• personal data is processed only where necessary and, where possible, in anonymised form.

For the purpose of enabling multilingual participation and accessibility, Carbon Copy may use AI-supported translation services, such as DeepL or comparable providers, to translate user-generated content, interface elements, or communications.

Translation is performed solely to render content in another language and does not involve profiling or automated decision-making. Where possible, translation is carried out on anonymised or pseudonymised content.

Any providers used for translation act either as processors under appropriate contractual safeguards or process data under their own responsibility in accordance with applicable data protection law.

3. Legal Bases for Processing

Where required, personal data is processed on the following legal bases:

• consent (Art. 6(1)(a) GDPR), in particular for participation, surveys, newsletters, and user-generated content;
• contract or pre-contractual measures (Art. 6(1)(b) GDPR);
• legal obligation (Art. 6(1)(c) GDPR); and
• legitimate interests (Art. 6(1)(f) GDPR), in particular operation and security of digital services, improvement and further development of offerings, and prevention of misuse and abuse.

Where processing is based on legitimate interests, such interests are assessed against the fundamental rights and freedoms of the data subject.

4. Data Sharing and Processors

Personal data is shared within Carbon Copy only to the extent necessary for the stated purposes.

In particular, authorised personnel may access account identifiers such as name, username, and email address through internal administrative tools only where such access is necessary for account management, user support, moderation, security, abuse prevention, billing, or legal compliance. Such access is restricted on a need-to-know basis and is subject to appropriate confidentiality, access-control, and security measures.

Where feasible and appropriate, administrative, evaluative, or analytical views are designed to rely on aggregated, anonymised, or pseudonymised data rather than directly identifying information. Where directly identifying information remains visible, including names or email addresses, such information remains personal data and is processed accordingly under applicable data protection law.

Carbon Copy may engage carefully selected service providers acting as processors within the meaning of Art. 28 GDPR. Such processors process personal data solely on our instructions and are subject to appropriate contractual safeguards.

Personal data is not sold and is not used for third-party advertising. Disclosure to authorities or other third parties takes place only where legally required or otherwise permitted under applicable law.

5. International Data Transfers

If personal data is transferred to recipients outside Switzerland or the EU/EFTA, Carbon Copy ensures an adequate level of protection, in particular by relying on adequacy decisions or recognised safeguards, such as standard contractual clauses.

Where required, supplementary technical and organisational measures are implemented.

6. Storage Duration

Personal data is retained only for as long as:

• necessary for the stated purposes;
• required by overriding legitimate interests; or
• mandated by applicable law.

Where possible, participation data is anonymised at an early stage. Thereafter, anonymised data may be retained for research, evaluation, quality assurance, and improvement purposes.

Data contained in internal administrative systems is retained only for so long as necessary for the relevant administrative, contractual, support, security, compliance, or documentation purpose, subject to statutory retention obligations.

7. Rights of Data Subjects

Data subjects have the following rights, subject to the conditions and limitations of applicable law: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent at any time with effect for the future.

Requests may be submitted to Carbon Copy Association, Oescherstrasse 26, CH-8702 Zollikon, hi@carbon-copy.org.

Data subjects also have the right to lodge a complaint with a competent supervisory authority.

8. Cookies, Analytics, and Online Tracking

Where analytics tools are used:

• IP addresses are shortened or anonymised where possible;
• data is not combined with directly identifying information; and
• analytics providers act as processors and do not process data for their own purposes, unless expressly stated otherwise.

Further details are available via the cookie preference settings or other relevant notices made available in the app or on the website.

9. Third-Party Platforms and Embedded Content

Carbon Copy maintains presences on third-party platforms, including social media services. Such platforms process personal data under their own responsibility in accordance with their own privacy notices.

Carbon Copy receives only anonymised or aggregated statistics from such platforms and does not receive individual user profiles unless expressly stated otherwise.

10. Use of the @gora App

When using the @gora app, technically necessary data is processed to ensure functionality, stability, and security.

Participation in surveys, polls, or dialogue formats is voluntary. Responses are not attributed to real names by default and are evaluated in anonymised or aggregated form where possible.

Users may skip surveys at any time without disadvantage.

Where participation features require user administration, moderation, support, or technical review, authorised personnel may, where necessary, access associated account identifiers in accordance with Section 4 of this Privacy Policy.

11. User-Generated Content

Certain features allow users to submit their own content, such as comments, arguments, or dialogue contributions.

In such cases:

• content may be publicly visible;
• usernames or pseudonyms may be displayed depending on the feature; and
• real names are not required unless explicitly stated.

Any public visibility is made apparent to users at the time of submission.

User-generated content is retained only for as long as necessary for its purpose and may be deleted upon request, unless statutory obligations or overriding legitimate interests require otherwise.

12. Transparency and Boundaries

Carbon Copy is committed to the principles of data minimisation, purpose limitation, and proportionate processing. Our digital offerings are designed to enable meaningful participation and learning without extensive personal data collection.

Carbon Copy does not:

• sell personal data;
• use personal data for advertising or behavioural targeting;
• create individual political or commercial profiles; or
• carry out automated decision-making with legal or similarly significant effects.

Aggregated and anonymised data may be used to generate insights serving the public interest, to improve participatory formats, and to support research and learning, provided that no conclusions can be drawn about individual participants.

13. AI-Supported Sense-Making Tools (Separate Services)

Carbon Copy may, in specific contexts, use or provide access to AI-supported sense-making tools or corresponding services to support the evaluation, structuring, and synthesis of contributions arising from live group discussions or deliberative events.

These sense-making tools are not an integral part of the @gora mobile application, but may be used in combination with @gora in the context of moderated participation or deliberation formats, such as workshops, citizens’ panels, or live discussion settings.

13.1 Purpose of Processing

The purpose of such tools is to support facilitators and organisers in:

• structuring large volumes of contributions;
• identifying themes or patterns;
• summarising discussions; and
• improving the quality and clarity of deliberative outcomes.

13.2 Use of Artificial Intelligence

Sense-making tools may rely on AI models for data processing, including but not limited to large language models, such as ChatGPT or comparable technologies.

Such processing serves exclusively analytical and organisational purposes and is intended to support human-led facilitation and interpretation. No automated decision-making with legal or similarly significant effects takes place.

13.3 Data Scope and Safeguards

Depending on the specific deliberative format:

• Inputs may consist of anonymised, pseudonymised, or contextualised contributions from group discussions.
• Personal data is processed only where necessary and proportionate to the stated purpose; and where feasible, data is anonymised prior to processing.

The use of sense-making tools does not involve the creation of individual profiles or behavioural scoring.

13.4 Separation from Core Platform Processing

Processing associated with AI-supported sense-making tools is functionally and purposefully distinct from the operation of the @gora app.

Where applicable, participants are informed about the use of such tools in the context of the specific deliberative format.