Privacy Policy

The Tyre Call is a grassroots advocacy initiative demanding international protection for Tyre, South Lebanon — one of the oldest continuously inhabited cities on Earth. This website is operated by the Tyre Call collective, hosted on EU-based infrastructure.

Data Controller: Tyre Call Initiative Contact for privacy matters: privacy@tyre-call.org Hosting: Netlify (EU infrastructure) and Supabase (EU region)

If you have concerns about how your data is handled, you may also lodge a complaint with your national data protection supervisory authority.

When you sign the petition, we collect the following information that you voluntarily provide:

• Full name — to identify you as a signatory
• Email address — for signature verification and optional campaign updates
• Country — for geographic validation of the petition
• Phone number (optional) — if you choose to provide it
• Profession (optional) — if you choose to provide it
• Organization name (optional) — if you sign on behalf of an organization

We also automatically collect:

• IP address — for fraud prevention and duplicate signature detection (retained for 90 days)
• Timestamp of your signature
• Technical data transmitted by your browser (user agent, language preferences) for security and compatibility purposes

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

Purpose	Legal Basis
Recording your petition signature	Legitimate interests (Art. 6(1)(f)) — operating the petition platform
Displaying your name and country publicly on the signatories list	Legitimate interests — transparency of the petition
Sending you campaign updates and mobilization calls	Consent (Art. 6(1)(a)) — via the opt-in checkbox on the form
Email open and link-click tracking for campaign analytics	Consent (Art. 6(1)(a)) — via the opt-in checkbox on the form
Fraud prevention and duplicate detection	Legitimate interests (Art. 6(1)(f))
Technical security and site operation	Legitimate interests (Art. 6(1)(f))

Important: Signing the petition does NOT require consenting to email communications or tracking. You can sign without checking the consent checkbox. Your signature will still be counted.

Campaign emails: If you check the consent checkbox on the signature form ("I agree to be contacted for future mobilisation and to be tracked for campaign interaction"), you consent to receive emails about the Tyre Call campaign and related mobilization efforts.

Email tracking: The same checkbox covers consent for campaign interaction tracking, which includes:

• Open tracking — knowing whether you opened a campaign email (via a tiny transparent pixel)
• Link-click tracking — knowing which links you clicked in campaign emails

This tracking helps us understand campaign engagement and improve our communications. It is never used for advertising or profiling.

Withdrawing consent: You can withdraw your consent at any time:

• Click the "unsubscribe" link in any campaign email to stop receiving emails and tracking
• Contact privacy@tyre-call.org to request removal from all communications

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Your petition signature remains valid regardless of your email preferences.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

Petition targets and decision-makers: When the petition is delivered to relevant authorities and international bodies, your name, country, and profession (if provided) may be included. Your email address, phone number, and IP address are NEVER shared with petition targets.

Service providers (data processors):

• Supabase — database hosting for signature storage (EU region). Supabase acts as a data processor under a Data Processing Agreement.
• Netlify — website hosting and content delivery (EU infrastructure).
• Donorbox — donation processing (if you choose to donate). Donorbox has its own privacy policy for donation data.

Legal obligations: We may disclose data if required by law or to protect the rights and safety of our users and the public.

Aggregated data: We may share anonymized, aggregated statistics (e.g., "12,000 people from 80 countries signed") that cannot identify any individual.

Your data is stored and processed on servers located within the European Union (EU) and European Economic Area (EEA). We do not transfer personal data outside the EU/EEA.

Our service providers (Supabase, Netlify) operate EU-based infrastructure. In the event any data transfer outside the EU/EEA becomes necessary, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

We retain your personal data only as long as necessary for the purposes for which it was collected:

Data Category	Retention Period
Petition signature (name, country, profession)	Duration of the campaign + 2 years after campaign closure
Email address (if consent given)	Until consent is withdrawn or 2 years after last campaign email, whichever comes first
Email tracking consent records	Duration of consent + 3 years (for accountability)
IP addresses	90 days from collection
Server logs	30 days

After the retention period expires, personal data is securely deleted or irreversibly anonymized. You may request earlier deletion at any time (see Section 8).

As a data subject under the GDPR, you have the following rights:

• Right of access (Art. 15): You can request a copy of the personal data we hold about you, free of charge.
• Right to rectification (Art. 16): You can ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): You can request deletion of your data when it is no longer necessary, or if you withdraw consent.
• Right to restriction of processing (Art. 18): You can ask us to limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): You can request your data in a structured, machine-readable format.
• Right to object (Art. 21): You can object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): You can withdraw consent at any time — it is as easy to withdraw as it was to give.
• Right to lodge a complaint: You have the right to complain to your national data protection authority.

To exercise any of these rights, email privacy@tyre-call.org. We will respond within one calendar month. We may ask you to verify your identity before processing your request. There is no fee for exercising your rights.

This website uses minimal cookies, all classified as strictly necessary for the operation of the site:

Cookie Name	Provider	Purpose	Type	Duration
theme	Tyre Call	Stores your light/dark mode preference	Persistent	1 year
cookie_consent	Tyre Call	Records your cookie consent preferences	Persistent	1 year

We do NOT use:

• Third-party advertising cookies
• Social media tracking pixels
• Analytics cookies (Google Analytics, etc.)
• Cross-site tracking cookies

Email tracking pixels (used only with your explicit consent via the form checkbox) are described in Section 4 above. These are not website cookies — they are embedded in campaign emails sent to consenting subscribers.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

• All data transmission is encrypted via HTTPS (TLS)
• Database access is restricted to authorized personnel only
• Supabase provides database encryption at rest and in transit
• We regularly review our security practices

No method of electronic storage is 100% secure. In the unlikely event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by law.

The Tyre Call petition is intended for individuals aged 16 and above. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact privacy@tyre-call.org and we will promptly delete it.

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The date of the latest revision is shown at the top of this page. Significant changes will be communicated via a notice on our website. Continued use of the site after changes constitutes acceptance of the updated policy.

For questions about this privacy policy or to exercise your data protection rights:

Email: privacy@tyre-call.org

You may also contact us via the social media channels listed on our website.

Supervisory authority: You have the right to lodge a complaint with the data protection authority in your country of residence. For EU residents, a list of national authorities is available at edpb.europa.eu.