How PRISM collects, uses and protects your data, written plainly and to the same editorial standard as the rest of the platform.
PRISM (Protection, Risk & Impact Severity Monitor) is open evidence infrastructure for humanitarian decision-making. This policy explains what personal data PRISM collects, why, on which lawful basis, how long it is kept and what you can do about it. It is written to comply with the EU General Data Protection Regulation (GDPR).
Data controller: Umutcan Yüksel
Contact: [email protected]
Account data (when you register or sign in with Google):
Application data (when you apply to contribute as an author, analyst, editor or digital engagement intern):
The bio, affiliation, LinkedIn URL and CV also live on your profile, where you can see and change them at any time. A copy of what you submitted stays on the application record for the reviewer.
Profile photo, if you upload one. Uploads are re-encoded, cropped to a square and stripped of embedded metadata before they are stored.
Contributor status and roles: which roles you hold (author, analyst, editor, digital engagement), their status, when they were granted, and, for analysts, the countries you cover. The record of who granted or changed a role is kept with it.
Published bylines: the author line written on each piece at publication, and the link between a published piece and the account of each author.
Usage data (when you use the platform):
Cookie data (see Section 8).
Each purpose below rests on one lawful basis under Article 6 of the GDPR.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Operating your account: authentication, access tiers, the profile page, and the account, security and service emails that go with it | Account data, sign-in records | Necessary to provide the service you asked for (Art. 6(1)(b)) |
| Reviewing an application to contribute and, on approval, granting and administering the role | Application data, profile photo, contributor status | Necessary to act on your request before and under the contributor arrangement (Art. 6(1)(b)) |
| Public display of your name, photo, bio and LinkedIn profile on the contributors page and beside your published pieces (Section 4) | Name, profile photo, bio, LinkedIn URL, role label, list of published pieces | Consent (Art. 6(1)(a)), given on the application form, on the profile page or in reply to an approval request. Withdrawable at any time |
| Newsletter and platform updates, delivered through Mailchimp | Email address, name | Consent (Art. 6(1)(a)); unsubscribe from any email |
| Site analytics: unique visitors, sessions, popular pages, country of visits | Usage data, a visitor identifier and a session identifier | Cookie consent (Art. 6(1)(a) together with the ePrivacy rules); declined in the banner, nothing is recorded |
| Contributor readership reporting: telling authors periodically how many visits their pieces received | Aggregate visit counts per piece; never linked to an individual reader | Legitimate interest in keeping contributors informed (Art. 6(1)(f)); you can turn these emails off |
| Security logs: failed sign-in tracking, account lockouts, the administrative audit log | Email address, timestamps, IP address, user agent | Legitimate interest in keeping the platform and its accounts secure (Art. 6(1)(f)) |
| Academic research on humanitarian data platform design | Aggregate, anonymised usage statistics only | Legitimate interest (Art. 6(1)(f)); no individual can be identified from what is published |
PRISM is preparing a contributors page and an author line at the end of each published piece. This section says exactly what those surfaces show and when.
Nothing appears before you have given consent under this policy. The consent is recorded with a timestamp and the policy version you agreed to. When you withdraw it, your contributor page and your author line disappear on the next load. The byline text on pieces already published stays, because a published piece does not stop having been written; it carries no contact details.
You can withdraw consent to public display at any time from the Public display block on your profile page. One button withdraws it; the same block lets you grant it again later. Withdrawal takes effect on the next page load and has no effect on your account, your roles or your access. Newsletter consent is withdrawn from the link in any newsletter, and cookie consent by clearing this site's cookies and local storage in your browser.
We implement the following security measures:
SameSite=Lax attributePRISM uses cookies as follows:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
session |
Maintains your login state | Essential | Browser session |
prism_analytics_consent |
Records your cookie preference | Functional | 1 year |
When you first visit PRISM, a cookie consent banner asks for your preference. You can change your choice at any time by clearing your browser's local storage and cookies for this site.
We do not use third-party tracking cookies. No data is shared with advertising networks, social media platforms or third-party analytics services.
We do not sell, rent or share your personal information with third parties, except:
What you have consented to display publicly (Section 4) is, by its nature, visible to anyone who opens the page.
Under the GDPR, you have the right to:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
PRISM displays publicly available humanitarian data from organisations including OCHA, ACLED, ACAPS, OECD, UNICEF, IOM and others. This data is sourced from public APIs and open datasets. PRISM does not collect, store or process any personally identifiable information about affected populations.
PRISM is designed for professional humanitarian analysts, researchers and policymakers. We do not knowingly collect information from individuals under 18 years of age.
We may update this privacy policy to reflect changes in our practices or legal requirements. Significant changes will be communicated by email to registered users. The revision line at the top of this page carries the date and version of the current text, and every consent you give is recorded against the version in force at the time.
For privacy-related questions, data access requests or concerns:
Umutcan Yüksel, data controller
Email: [email protected]