Privacy Statement

Stichting Ministry of Future Affairs ("MFA", "we", "us") is a Think and Do tank for future-proof policy innovation. This privacy statement describes how we process personal data through our website and the services we provide. MFA is the controller of the personal data described in this statement. You can reach us at:

Stichting Ministry of Future Affairs
Fred Roeskestraat 115, 1076 EE Amsterdam, the Netherlands [visiting address]
Cruquiuskade 251, 1018 AM Amsterdam, the Netherlands [postal address]
Chamber of Commerce (KvK): 97075876
Email: hello@ministryoffutureaffairs.org

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

In case of any questions about this privacy statement or how we process personal data, please reach out via the contact details above.

If you click on the ‘expand’-button next to one of the topics below, the information on this topic will fold out.

This statement applies to www.ministryoffutureaffairs.org and to everything you can do through it: reading pages, downloading our publications, subscribing to our newsletter, registering for events, applying to our projects and calls, and writing to us.

It does not cover other organisations’ websites we link to, or the separate platforms some of our initiatives run on. Those have their own privacy statements.

3.1 Visiting the website

Our host records standard server log data: your IP address, browser type and version, the pages you request, the date and time, and the page you arrived from. We use this to serve the site, keep it secure and diagnose faults. We do not use it to build a profile of you, and we do not use analytical or advertising cookies or similar technologies, including trackers. See section 6 for more information.

Legal basis: legitimate interests, Art. 6(1)(f) GDPR, operating a secure and functioning website.

3.2 Downloading a publication

To download a report, memo or paper we ask for your name, email address and organisation, and optionally your role and country. We use this to send you the document and to understand, in aggregate form, which audiences our work reaches. With the aggregate data we can no longer identify you. We only add you to the subscriber list of our newsletter if you tick the separate box on the form (see 3.3 below).

Legal basis: legitimate interest, Art. 6(1)(f) GDPR, when using your personal data to share the report with you and to aggregate your data for audience analytics.

3.3 Newsletter

You can subscribe to our newsletter on our website, or by ticking the box on a download, application or registration form. The box is never ticked in advance, and nothing you request from us depends on it. With the same subscription you receive invitations to our events and webinars; together this is no more than two emails a month.

We use double opt-in: after you sign up, we send you one email with a confirmation link, and you only start receiving it once you click.

We store your email address, your name and organisation if you give them, and the date, time and IP address of both your sign-up and your confirmation. We keep that record so we can demonstrate that you consented.

Every edition carries an unsubscribe link. Unsubscribing takes effect immediately. We then remove your address from our mailing list and keep the record of your consent for 24 months as proof.

Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time; withdrawal does not affect what we did lawfully before.

3.4 Applying to a project, call or programme

When you apply to one of our projects, calls or programmes, we collect:

• your name, email address, telephone number and country;
• your organisation, role and, where relevant, its legal form, size and website;
• the content of your application: answers to the questions in the form (such as about your eligibility, your novel food and your experiences), and any documents you attach, such as a CV, motivation letter, project description, budget, references or links to your work;
• our own assessment notes, scores and the decision we reach.

We use this to assess your application, contact you about it, run and document the selection, and, if you are selected, set up the collaboration and/or facilitate the project, call or programme. If you are selected, we may also ask you to complete preparation tasks before an activity starts.

We share applications in confidence with the members of the selection committee. Where an activity is run together with partners or funders, we may also share applications and preparation task answers with them so they can prepare the activity; the project, call or programme text names these partners before you apply (for example, Atova Regulatory Consulting for the New Foods RegLab). We may use certain questions in the application, anonymised, in the project's public report; we do not name companies or products without your permission.

Please do not include information about your health, religious or political beliefs, trade union membership, ethnic origin or sexual orientation. We do not ask for it and do not need it to assess your application.

Legal basis: our legitimate interests, Art. 6(1)(f), in assessing applications fairly and being able to account for our decisions and, if selected, set up the collaboration and/or facilitating the project, call or programme. Where we ask to keep your details on file for future calls, we ask for your consent, Art. 6(1)(a) GDPR.

3.5 Events, webinars and online meetings

In-person events. To register you for an event we collect your name, email address, organisation and role. For in-person events we may ask about accessibility or dietary requirements: that is voluntary, we use it only to run the event, and we delete it afterwards. Accessibility and dietary information may contain sensitive or special categories of personal data for which we need your (explicit) consent.

Webinars. We run our webinars on Zoom. When you register, Zoom collects your first and last name, email address, company, role and country. You can also tell us whether you plan to apply to the programme the webinar is about, and whether you would like to receive our news. Zoom records whether you attended and for how long. Other attendees cannot see your name, and questions you ask in the Q&A are read out without your name or company.

We use these data to register you, send you the joining link and reminders, and run the webinar. Afterwards we send you the slides, the recording (if there is one), and one reminder about the application deadline. We then move your registration to our contact database (Zoho CRM) and delete it from Zoom within four weeks of the webinar. Speakers from partner organisations receive only the number of registrations and attendees, never the list of registrants.

Recordings. We tell you before a session starts whether it is recorded. Webinar recordings show only the speakers, without attendee names, chat or video. If a recording of an in-person event shows participants, we ask for your consent before we publish it. This recording will be speakers only, without attendee names, chat or video. Participant lists are shared with co-hosts only where we say so on the registration page.

Meetings will be conducted in full compliance with EU competition law, in particular Articles 101 and 102 of the Treaty on the Functioning of the European Union (TFEU), and with applicable national competition laws.

Legal basis: steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR; your (explicit) consent for accessibility and dietary information and for publishing recordings, Art. 6(1)(a) and - if applicable - Art. 9(2)(a) GDPR., your consent, see article 3.3.

3.6 Writing to us

If you email us or use a contact form, we keep your message and contact details so we can reply and pick up the thread later.

Legal basis: legitimate interests, Art. 6(1)(f) GDPR, responding to enquiries about our work.

3.7 Balancing test

Where we rely on our legitimate interests as a legal basis (sections 3.1, 3.2, 3.4, 3.5 and 3.6, section 4), we have weighed those interests against your rights and freedoms and concluded that the processing is proportionate. You can ask us for a copy of that assessment by emailing hello@ministryoffutureaffairs.org.

3.8 Required provision

In principle you are under no obligation to provide any information about yourself to us. However, refusal to supply certain information could have a negative influence on, for example, your experiences on or functionality of our website. If the provision of certain personal data is a legal or contractual obligation or an essential requirement for concluding an agreement with us, we will separately provide additional information about this for as far as this is not clear in advance. In this case we will also inform you about the possible consequences if this information is not provided.

We obtain your personal data in various ways:

• Provided by you. We obtain information actively provided by you. For example, if you reach out to us by e-mail or if you apply for our newsletter or events.
• Through the use of our website. We obtain some information about you when you use our website (see section 3.1 above).
• Sometimes we process personal data not on our own initiative, but to comply with a legal obligation incumbent on us. This is the case, for example, when we retain personal data for a longer period in order to comply with a legal retention obligation
• Public professional sources. When you apply to one of our calls or register for an event, we may look at publicly available professional information, such as your organisation’s website or your LinkedIn profile, to confirm your role and to prepare the selection or the event. We only note what we need for that purpose, and we do not collect data from websites automatically (scraping).

Legal basis: our legitimate interest in assessing applications and preparing our events, Art. 6(1)(f) GDPR.

Inside MFA, only the people who need your data for the purpose it was collected for can see it. Outside MFA, we use the following processors, each under a written processing agreement:

• Sliplane for website hosting and server logs.
• Zoho (CRM, Campaigns) for form submissions, contact records, mailings and event registrations. This environment is operated on our behalf by Future Affairs Consulting B.V..
• Microsoft 365 for our email and document storage.
• Microsoft OneDrive for storage of application attachments.
• Zoom Video Communications for webinar registration and the webinars themselves.

We also share data where it is necessary: with partners and co-organisers named in a specific call (such as Atova Regulatory Consulting), with our accountant, with funders where our grant conditions require us to account for how a project was run, and with public authorities where the law obliges us.

We do not sell personal data and we do not share it for third-party advertising.

This site uses only strictly necessary cookies or similar technologies, the ones needed to load pages and submit forms securely. We do not use analytical, advertising or social media cookies or similar technologies, and we do not build profiles of visitors. That is why we do not have a cookie banner.

If we ever add analytics or embedded content that tracks you, we will ask for your consent first and update this statement.

We prefer processors with data centres in the European Economic Area, and our Zoho CRM / newsletter environment is set to the EU region.

Some of our providers are established in the United States, or use support staff there. Where data reaches a country outside the EEA, the transfer rests on the European Commission’s Standard Contractual Clauses, on the provider’s certification under the EU-US Data Privacy Framework, or on an adequacy decision, together with additional safeguards where needed.

You can ask us for a copy of the safeguards that apply to a specific transfer via the above-mentioned contact details.

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. Data in our systems is not deleted automatically, so we check the periods below every quarter and delete what has expired.

We take appropriate organizational and technical security measures to protect your personal data and to prevent misuse, loss or alteration thereof. In addition, we limit access to personal data to those employees, consultants, contractors and other third parties who need to have access in view of their work/services. Also, the aforementioned persons involved are bound by a confidentiality obligation, either in their employment agreements or (data processing) agreements.

The site is served over an encrypted connection (HTTPS). Access to our systems is limited to the people who need it, protected by individual accounts and two-factor authentication, and reviewed when someone leaves.

If a data breach occurs that is likely to put your rights at risk, we report it to the Dutch Data Protection Authority within 72 hours and inform you where the law requires it.

10.1 In relation to our processing of your personal data, you have the below privacy rights. For more information on your privacy rights, please be referred to this webpage (opens in a new tab) of the European Commission.

1.    Right to withdraw consent. In so far as our processing of your personal data is based on your consent (see above), you have the right to withdraw consent at any time.

2.    Right of access. You have the right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you (but not necessarily the documents themselves). We will then also provide you with further specifics of our processing of your personal data.

3.    Right to rectification. You have the right to request rectification of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.

4.    Right to erasure. You have the right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where: (i) the personal data are no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the personal data have been unlawfully processed, (v) the personal data have to be erased on the basis of a legal requirement, or (vi) where the personal data have been collected in relation to the offer of information society services. We do not have to honour your request to the extent that the processing is necessary: (i) for exercising the right of freedom of expression and information, (ii) for compliance with a legal obligation which requires processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise or defence of legal claims.

5.    Right to object. You have the right to object to processing of your personal data where we are relying on legitimate interests as processing ground (see above). Insofar as the processing of your personal data takes place for direct marketing purposes, we will always honour your request. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms or that are related to the institution, exercise or substantiation of a legal claim.

6.    Right to restriction. You have the right to request restriction of processing of your personal data in case: (i) the accuracy of the personal data is contested by you, during the period we verify your request, (ii) the processing is unlawful and restriction is requested by you instead of erasure, (iii) we no longer need the personal data but they are required by you for the establishment, exercise or defence of legal claims, or (iv) in case you have objected to processing, during the period we verify your request. If we have restricted the processing of your personal data, this means that we will only store them and no longer process them in any other way, unless: (i) with your consent, (ii) for the establishment, exercise or defence of legal claims, (iii) for the protection of the rights of another natural or legal person, (iv) or for reasons of important public interest.

7.    Right to data portability. You have the right to request to transfer of your personal data to you or to a third party of your choice (right to data portability). We will provide to you, or such third, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies if it concerns processing that is carried out by us by automated means, and only if our processing ground for such processing is your consent or the performance of a contract to which you are a party (see above).

8.    Automated decision-making. You have the right not to be subject to a decision based solely on automated processing, which significantly impacts you (“which produces legal effects concerning you or similarly significantly affects you”). In this respect, please be informed that when processing your personal data, we do not make use of automated decision-making.

9.    Right to complaint. In addition to the above-mentioned rights, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or of an alleged infringement of the GDPR at all times. Please be referred to this webpage (opens in a new tab) for an overview of the supervisory authorities and their contact details. However, we would appreciate the chance to deal with your concerns before you approach the supervisory authority so please contact us beforehand.

10.2 How to exercise your rights.

The exercise of the abovementioned rights is free of charge and can be carried out by e-mail via the contact details included above. If requests are manifestly unfounded or excessive, in particular because of the repetitive character, we will either charge you a reasonable fee or refuse to comply with the request.

10.3 Verification of your identity.

We may request specific information from you to help us confirm your identity before we comply with a request from you concerning one of your rights.

10.4 Follow-up of your requests.

We will provide you with information about the follow-up to the request without undue delay and in principle within one month of receipt of the request. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months. We will notify you of such an extension within one month of receipt of the request. The applicable privacy legislation may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Our website and our work are aimed at professional audiences. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, write to us and we will delete it.

We update this statement when our processing changes. The version date at the top of this document always tells you which text applies. If a change materially affects you, we will say so on the website and, where we rely on your consent, ask you again.