1. Who we are
Hong Kong Civil Society News Archive (hereafter “we”, “us”) is a free, nonprofit platform supporting research, education, and the preservation of public records. We are the data controller for personal data processed through this website. You can contact us at enquiries@hkcivilsocietynewsarchive.com.
2. What this policy covers
This policy explains how we handle personal data of (a) visitors to this website, (b) people who contact us, and (c) people named or mentioned in the news reports we archive.
3. Information we collect
Visitors. When you visit this website, our security and content-delivery provider, Deflect, processes technical data such as your IP address, the pages and files you request, and related request metadata. We use this data only to keep the website available and secure, including protecting it from denial-of-service attacks. We do not use it for advertising or profiling.
Enquiries. If you email us, we collect your email address, name (if given) and the content of your message, and use them only to respond.
The archive. The archive contains news reports published by Hong Kong and international outlets. These may name individuals and may include information about political opinions, activism, or criminal proceedings. Each entry records only what the original outlet reported, together with basic details such as date, outlet and link.
4. Cookies
We do not use optional cookies, and we do not use analytics or advertising cookies. Cookies of this kind do not require consent, and you can block or delete cookies in your browser settings.
5. Why we process personal data (legal bases)
- Website security and availability: legitimate interests (Article 6(1)(f) UK GDPR), namely keeping the archive secure and accessible.
- Responding to enquiries: legitimate interests, or steps you ask us to take.
- Archived news reports: legitimate interests, in maintaining a research and public-interest record of Hong Kong civil society. Where reports contain special category or criminal offence data, we rely on the fact that the information was manifestly made public by the original publication, and on the research and journalism provisions of the Data Protection Act 2018 where applicable.
6. Who we share data with
We do not disclose or publish information which identifies individual machines, or potentially identifying sub-groupings of addresses, without consent. We do publish aggregated information about usage patterns.
We do not sell personal data. We use the following service providers:
- Deflect (eQualitie Inc., Canada): DDoS protection and traffic logging. Deflect keeps visitor logs for up to 13 months, and may retain IP addresses it has blocked for security reasons for longer. See Deflect’s privacy notice.
- DigitalOcean (London): hosts the website and archive data.
- Proton Mail: handles enquiries.
7. International transfers
Deflect is based in Canada and may store or process data elsewhere.
8. How long we keep
- Visitor logs: held by Deflect for up to 13 months. We do not keep separate logs.
- Enquiries: 12 months after the matter is resolved.
- Archive entries: kept for as long as they remain of research or public-interest value, and reviewed on request (see section 10).
9. Security
We use reasonable technical and organisational measures to protect data, including encryption in transit (HTTPS) and access restrictions. Your IP address is visible to Deflect and to your internet service provider when you visit. If this concerns you, you may use a tool such as Tor Browser or a trusted VPN.
10. Your rights
Under UK data protection law you may have the right to access, correct, erase, or restrict the use of your personal data, to object to processing, and to receive a copy of it in a portable format. If you are named in an archived report and believe an entry is inaccurate, or that continued inclusion puts you at risk, email us with the link or entry ID. We will consider each request individually, balancing your rights against freedom of expression and the public-interest and research value of the record, and reply within one month. We may need to verify your identity.
11. Third-party links
Entries link to outlets’ websites and to Internet Archive copies. Those sites have their own privacy practices, and we are not responsible for them.
12. Complaints
Please contact us first. You can also complain to the UK Information Commissioner’s Office.
13. Changes
We may update this policy and will change the date above when we do.