Data protection

Draft: under legal review. The commitments here are the ones we keep today; the wording may change.

This page answers the question a director asks before signing anything: what happens if someone with power asks for the data.

Where the data is

The platform runs on servers in Ireland, under Irish and European law. UnityHelp, Inc. is a US company, so a US court can also order it to hand over data held there. No server, backup or copy is held in Sudan or in any country where the platform is used.

What is there to ask for

Less than people expect.

• A referral case is sealed so that only the receiving organisation can read it. A case already sealed cannot be read by UnityHelp's own staff, even with full access to the server.
• Names and national identity numbers in a household register are encrypted, and the number is kept so that two organisations' registers can never be joined.
• Gender-based violence records hold no location and no date of birth.
• Nothing the platform shows to anyone outside an organisation is about a person. Counts under a threshold are withheld.

Who decides what leaves

The organisation that recorded the data. If an authority, a donor or a cluster wants an organisation's data, it asks that organisation, and the organisation answers as it would for its own files. UnityHelp does not share, sell or give out an organisation's records on anyone else's request. Its technical staff can technically reach them to run the service, and open them only for that; only a sealed case is beyond their reach.

Aggregates

Counts by state and locality, with dates and the organisations' consent, can be shared, and often should be. That is what coordination needs, and it identifies no one.

If UnityHelp receives a demand

UnityHelp complies with a lawful order of a court that has jurisdiction over it. It tells the organisation concerned unless the order forbids it, and it hands over only what the order names. It builds no way to read sealed data and accepts no request to build one.

If an organisation is forced

The organisation decides what to do with its own records. It can ask for a copy of them, and close its account, at any time.

Our own registration

UnityHelp registers where the law requires it and does not register as a humanitarian organisation in a country of operation, because it is not one. It is a software provider to the organisations that are.