30. User contact details are only shared with the administrator of an HDX organization if the user requests access to data via HDX Connect.

 

31. OCHA upholds the highest standard of data protection for the personal data of HDX users and organization administrators. In case such personal data is exposed, OCHA will notify all affected individuals and manage the incident in line with internal data incident management procedures.

 

32. OCHA uses JIRA, a third-party service managed by Atlassian, to help automate workflows related to the administration of HDX, including organization management and quality assurance of datasets. OCHA transfers system-generated CKAN userID’s of HDX users who maintain a dataset on HDX to JIRA as part of our quality assurance process. The CKAN userID’s are retained on JIRA for five years to allow OCHA to follow up with dataset maintainers. After five years OCHA deletes the CKAN userID’s from JIRA. The data stored on JIRA is governed by the Atlassian Privacy Policy. 

 

33. OCHA uses MailChimp, a third-party marketing automation and email marketing platform managed by Intuit Inc., for outreach to registered HDX users and organization administrators. OCHA shares the email addresses and full names of registered HDX users with MailChimp in order to personalize messages. Review the Intuit Inc. Global Privacy Statement for information on the processing of personal data by Intuit Inc. 

 

34. OCHA continually seeks to understand the behavior of users on the HDX platform in order to make improvements. To do so, OCHA uses third-party analytics services, including Google Analytics, Mixpanel and Hotjar. These services use cookies stored on users’ devices to send encrypted information to Google Analytics, Mixpanel and Hotjar about how users arrived at HDX, what pages they visited on HDX, and their actions within those pages. Similar tracking is performed when users access HDX via our API or when directly downloading files from a shared link. OCHA does not send identifying information (including names, usernames, or email addresses) to Google Analytics, Mixpanel or Hotjar. Use and retention of the data collected from the HDX platform is governed by these services’ respective Terms of Use. 

 

35. If you would like to disable the tracking described above under clause 34, you can install the Google Analytics Opt-out Browser Add-on to disable Google Analytics tracking. Mixpanel and Hotjar respect “Do Not Track” settings in web browsers. Follow the instructions in this guide to prevent your browser from sending data to Mixpanel and Hotjar. 

 

36. Emails sent by OCHA to registered HDX users may contain web beacons, which allow OCHA to track information about how many people have viewed its email campaigns. OCHA will never share personal data from this tracking with third parties other than with MailChimp, our mailing list provider, which has access by default. The data collected by this tracking system will be retained indefinitely in order to understand how readership of the emails is changing over time.