1. Information we collect
|What we collect||How we collect it|
|Your name.||We require you to provide a chosen name when you create a Manifesta account, or sign a petition.|
|Your email address.||We require you to provide an email address when you create a Manifesta account, or sign a petition.|
|Your password.||We require you to enter a password when you create a Manifesta account, or sign a petition.|
|Your IP address. Your “IP Address” is a designator that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP).||An IP Address may be identified and logged automatically in our server log files whenever you use our platform and services, along with the time of your visit and the specific page(s) that you visited.|
|Your postal address.||You may choose to provide your postal address when you create a Manifesta account. Providing this information is not required to use the service.|
|Your telephone number.||You may choose to provide your telephone number when you create a Manifesta account. Providing this information is not required to use the service.|
|Your country.||We use the ControlShift Labs service to suggest your country from your IP address, in order to show you local petitions that may be of interest. You can change this information if it is displayed incorrectly.|
|Your profile picture.||You may choose to upload a profile picture when you create an account, or at any time. Providing this information is not required to use the service.|
|Your specific activities on or connected to the Manifesta platform. These might include petitions you have started or signed, shared or promoted, or whether you decide to become a Manifesta member.||When you are signed in or identified as particular Manifesta user, your activities on or connected to the Manifesta platform are automatically associated with your account.|
|Any other information you voluntarily submit.||You may be offered the choice to provide other information to us. For example, we may collect information when you respond to user surveys or provide information if we assist you by telephone. Providing this information is not required to use the service.|
|Your unique mobile device ID number if you access our services via a mobile application.||When you download and use any mobile applications we develop, we’ll collect your unique device ID and all your account and activity information will be tied to that unique device ID. In addition, we may track and collect app usage data, such as the date and time the app on your device accesses our servers and what information and files have been downloaded to the app. This information may be associated with your account.|
|The name of the browser you use to access Manifesta.||Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows PC or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version, and the name and version of the Manifesta platform you are using. Collecting this information helps us build and deliver the best possible version of Manifesta to you.|
|Your social media account ID, and information shared with us via your social media account.||We may obtain certain information through your social media accounts connected to your Manifesta account, if you choose to link them. Linking a social media account is not required to access the service. For example, if you log in to Manifesta via Facebook, we ask for your permission to access certain information about your Facebook account, activities and friends. Social media sites make information available to all apps through their API, such as friend lists. The information we receive depends on what information you or the social media site decide to give us.|
|Information inferred about the issues you care about based on your activities on the platform.||As part of our efforts to connect people to causes that interest them, petitions you sign might be tagged by our users or by us as particular cause areas. For example, a petition may be tagged as “reproductive rights” or “women’s rights”. If you sign one petition tagged in a particular cause area, we may infer that you would be interested in other petitions tagged in the same way. We may also send you petitions that are relevant to your general geographic area.|
|The currency of any contributions made through Manifesta.||We infer your currency based on your country.|
Some of the information above reveals your specific identity, or is directly tied to your specific identity, such as your name and email address. Some of this information does not reveal your specific identity, or does not directly relate to you, such as your browser and device information. If we ever combine non-personally identifiable information with personally identifiable information, the combined information will be treated by us as personally identifying information and protected accordingly.
Our services are not directed to people under the age of sixteen (16), and we do not knowingly collect personal information from them.
2. How we use your information
Here are the ways we might use your information to run our platform, provide our services and serve you better content.
We and our service providers may use your information for our legitimate business interests in providing a petition platform that enables people to connect with issues of interest. Our legitimate business interests are explained below, alongside examples of how your information may be used for these purposes.
|Providing the functionality of our platform. We engage in these activities to manage our contractual relationship with you.||
|To fulfill your specific requests through the platform. We engage in these activities to manage our contractual relationship with you.||
|Accomplishing our business purposes. We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, because we have a legitimate interest, and/or with your consent.||
|Analysis of personal information for business reporting and providing personalized services. We provide personalized services either with your consent or because we have a legitimate interest.||
|To share marketing communications that we believe may be of interest to you. We engage in this activity with your consent, or to manage our contractual relationship with you.||
3. Who may receive your information
Here we outline who may receive your information when it is shared either by you via the platform, or by us.
a. The Manifesta community
All information you post on our platform (such as petitions you create, reasons for signing a petition, or your posts on the Manifesta Community message boards) will be visible to other users. If you choose to send messages or connect with others through our platform about petitions you have signed or shared, you disclose your personal information to the recipient of your message. Our platform provides an open forum for communication by users all around the world. We do not monitor, verify, or perform any background check on campaign starters, petition signers, or other users of Manifesta.
Similar to traditional paper petitions, we consider an online petition to be a public expression of support for an issue. Therefore, your name, general geographic location (i.e. city, state, country), and a link to your Manifesta user profile may be displayed on the landing page for any petition you sign, and on related areas of our platform. This information will be viewable to any visitor, including the media, search engines, and other organizations that provide archival internet activities. If you do not wish to have your support for a petition to be public, we recommend you do not sign the petition. If you do not wish to have your name displayed on a petition landing page, you may select the option not to display your name and comment publicly on the petition page.
Your first name, last name, city and/or postcode, and the day that you signed will be shared with the person who initiated a petition you have signed, even if you select the option not to display your name and comment publicly. This is extremely important for petition starters to demonstrate the legitimacy of their signatures to the decision-makers they are working to influence. If you do not wish to have this information shared with the person who initiated the petition, please do not sign the petition.
The petition starter may choose to share your name and general geographic location with the intended decision maker who is the recipient of their petition. For example, the intended decision maker may be your congressman/woman when the petition concerns an issue relevant to him or her. If you do not wish to have this information shared with the petition recipient, you should not sign the petition.
If you sign a petition started by an NGO or other organization, you will be presented with the option of sharing your email address with that NGO or organization to receive direct email updates from them (not via the platform) should you choose to provide your consent for such sharing. Such organizations are not Manifesta’s commercial partners and are in no way affiliated with Manifesta. Enabling our users to interact directly with organizations, if those users consent to this connection, is part of our goal of helping people to stay informed on the causes that matter to them. We may revoke an organization’s access to this option in response to reports of abuse.
b. Your connected social media platforms
You may voluntarily share information on message boards, chats, profile pages, blogs, and other services to which you are able to post information and materials (including the Manifesta pages on Facebook and other social media platforms). Please note that any information you post or disclose through these services will become public information, and may be available to other Manifesta users, social media platform users and to the general public. We urge you to be very careful when deciding to disclose any information about yourself via the social sharing features of our platform.
c. Our business entities and service providers
We may share your information with third parties for the following purposes:
Manifesta and its consultants that operate in certain countries. Local consultants may contact you if you are within their country, as part Manifesta's mission to build social movements that create transformational change.
Our suppliers, subcontractors and business partners (“service providers”): We may share information about you with our service providers who process information to provide services to us or on our behalf. We have contracts with our service providers that prohibit them from sharing the information about you that they collect or receive with anyone else or from using such information for other purposes.
d. Legal & administrative obligations
We may use and disclose your personal information as necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:
Fraud prevention: We may use and disclose the information we collect from and about our users as we believe necessary to investigate, prevent, or respond to suspected illegal or fraudulent activity or to protect the safety, privacy, rights, or property of us, our users, or others.
Law enforcement purposes: If requested or required by government authorities such as law enforcement authorities, courts, regulators, or otherwise to comply with the law (which may include laws outside your country of residence), we may have to disclose information we have about our users. We also may use and disclose information collected about you in order to exercise or protect legal rights or defend against legal claims.
Sale or merger of our company: We have no plans to sell our business. In this unlikely event, we may use, disclose, or transfer your personal information to a third party if we or any of our company affiliates are involved in a corporate restructuring (e.g., a sale, merger, or other transfer of assets, including in connection with any bankruptcy or similar proceedings).
4. Accessing or deleting your information
If you would like to request to review, correct, update, suppress, or delete personal information that has been previously provided to us by you, you may log in to your account, and update your profile information. You can also contact us via our contact form here and ask us to specify what personal information we have about you and to delete certain personal information about you from our records, or request to receive an electronic copy of your personal information for purposes of transmitting it to another company (to the extent this right to data portability is provided to you by applicable law). Please let us know what information you would like us to remove from our databases or otherwise let us know what limitations you would like to put on our use of your personal information. For your protection, we may only implement requests with respect to the personal information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will respond to your requests consistent with applicable law, and we will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for record keeping purposes and/or to complete any transactions that you began prior to your request. There may also be residual information that will remain within our databases and other records, but such residual information will no longer be tied to your identity. For example, if you created a petition, we will have records that other Manifesta users signed your petition. If you subsequently ask us to delete your information from our platform and databases, information related to those other users’ signatures cannot be removed and will remain in our records.
5. Data retention & security
We take a lot of measures to protect your personal information. If you suspect someone else is using your account, let us know by contacting our Contact page.
Security and privacy are a priority for MANIFESTA and also our partner – Control Shift. It’s a process that is continually being improved on and a committment that runs through everything – from how member data is stored to the tools provided to customers. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please contact us immediately.
We will retain your Personal Information for as long as needed or permitted in light of the purposes for which it was obtained. The criteria used to determine our retention periods include the length of time we have an ongoing relationship with you and provide our services to you, our legal obligations or whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).
Designed for Security
We use industry best practices for encryption, physical security, multi-factor authentication and segmentation of data. Security is a core part of our software design process, and one of the criteria we use during code review.
We automate everything. When security configuration is automated we can guarantee its correctness and repeatability. When infrastructure is automated, fewer people need access to sensitive data.
All infrastructure is built to be highly available and resilient. Our architecture is designed to eliminate single points of failure with ample excess capacity so your campaigns keep running no matter what.
We promptly notify customers of outages and security events through our status pages and proactively via email.
ChangeSprout, Inc. stores customer data using Amazon Web Services, in their US-East region in northern Virginia, USA. This facility limits and audits physical access, and provides fire suppression, climate control and uninterruptible power supplies.
Databases are always replicated in a N+1 configuration to provide immediate failover in case of instance hardware failure. A full snapshot of all data is taken nightly, encrypted and shipped to Amazon Glacier and retained for 6 months. A complete offline and offsite backup is stored on an encrypted external disk rotated monthly into a bank safe deposit box.
We use TLS/SSL encryption to protect data in transit across the internet, ensuring that our users have a secure connection from their browsers to our service. Remote access for systems administration is provided over encrypted VPN and encrypted SSH connections. Where possible data is encrypted at rest, and backups are always encrypted before they are stored.
Access & Authorization
ChangeSprout staff use multi-factor authentication, in addition to passwords, in order to access administrative interfaces of the ControlShift platform. Multi-factor authentication is also available to organization staff, though it is dependent upon the organization to ensure its use. Access to systems is limited to ChangeSprout staff who require access.
While member data is collected using the platform, ChangeSprout Inc. does not own the data, nor do we process it except as directed by the Customer or as required for the operation of the platform. We treat member data as confidential information and take precautions to prevent the unauthorized disclosure, misuse, or loss of data. In addition to the other measures outlined above, we allow users to access and update their personal information to ensure its accuracy.
ControlShift only transfers member data to third parties when requested by the Customer or when required for the reliable operation of the platform. We limit the number of third parties we use to process member data and ensure that all third parties adhere to adequate data protection policies.
The third parties we currently send platform data to are: Amazon Web Services, Mailgun, Akismet, and Sendgrid. At the customer’s explicit request we may also send information to the customer’s chosen CRM and / or Segment, a service that provides data analytics. CRM and Segment integrations are optional and it is the responsibility of the customer to ensure that these services adhere to their country’s data protection regulations.
Emails sent from the ControlShift platform automatically include links to unsubscribe from communications. By default, this allows users to unsubscribe from communications about a specific campaign. However, for certain CRMs, the ControlShift platform also supports global unsubscribes – allowing the user to unsubscribe from all of the organization’s communications at once. Admin tools also allow Customer Staff to unsubscribe users manually.
6. Cross-border transfers
Manifesta is a global organization, so your information may be transferred across borders when you use the Platform. We have put in place measures to comply with laws regulating cross-border transfers.
Manifesta is a global organization. Your personal information may be stored and processed in any country where we have facilities or in which we engage service providers, and by using the platform you consent to the transfer of your personal information to countries outside of your country of residence, including the United States, which may have different data protection rules from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal information.
Some of the non-European Economic Area (“EEA”) countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards, and the full list of these countries is available here. For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission to protect your personal information. You may obtain a copy of these measures by contacting us.
7. Third-Party Services
We’re not responsible for the privacy practices of third parties linked to from our Platform.
8. Policy updates & contacting us
This policy may change over time. We’ve included here our contact information, but the best way to get in touch with us is through our contact page.