Privacy Policy

Fab City Foundation is committed to responsible, transparent, and proportionate data stewardship. As the coordinating body of the Fab City Global Initiative, we operate at the intersection of technology, governance, and community. We believe digital systems should serve the public interest, and personal data should be processed with clarity, restraint, and accountability. This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with www.fab.city and related activities. Data Controller: SA FAB CITY FOUNDATION Registration Code: 90014922 F. R. Faehlmanni 5 10125 Tallinn Estonia Email: admin@fab.city SA FAB CITY FOUNDATION is the data controller responsible for the processing of personal data described in this policy. Categories of Personal Data: We collect personal data only where necessary to operate our programs, coordinate the Fab City network, and comply with legal obligations. Depending on your interaction with us, this may include your name, email address, organization, professional role, date of birth or personal identification number, country of residence, and information submitted through event registrations, other forms, or resource contributions. Gender information may be collected on an optional basis. This information is used exclusively in aggregated form to monitor diversity and inclusion and to comply with reporting requirements under European Union funded projects. When you use our website, limited technical data such as cookie identifiers and general usage metrics may be collected through analytics tools. We do not collect payment information through our website. We do not knowingly collect data from minors. We do not process special category data such as health information or political opinions. How We Collect Data: Personal data is collected when you subscribe to our newsletter, register for events, submit a Fab City pledge or locality application, contribute resources, participate in projects, enter into a legal contractual relationship or contact us directly by email. Structured submissions are processed through Airtable forms. Newsletter subscriptions are managed through Mailchimp and/or Flodesk. Our website is integrated with an AI-based interface for individual information queries about the Fab City resources and general learning purposes. Upon interactions with the AI interface, we collect data on Render. Purposes and Legal Basis: We process personal data for clearly defined purposes. Participation in events, projects, and network activities is processed on the basis of contractual necessity or our legitimate interest and obligations in coordinating the Fab City Global Initiative. Newsletter communications are processed on the basis of your consent, which may be withdrawn at any time. Gender information, where provided, is processed on the basis of legitimate interest and, where applicable, legal obligations linked to European Union funded projects requiring diversity reporting. This data is analyzed only in aggregated form. Website analytics are processed on the basis of consent. Non-essential cookies are not activated unless consent is provided within the Cookie-Tool. Our website includes an AI-based learning interface developed and hosted by vendor Many Mangoes Pty Ltd on infrastructure provided by Render. Queries submitted through this interface are processed in anonymized form. They are not linked to identifiable individuals, IP addresses are not stored, and the data cannot be traced back to a specific user. Logs are retained in anonymized form to improve the quality and effectiveness of the learning experience. Processing is based on our legitimate interest in improving educational tools and methodologies. We do not sell personal data, we do not use personal data for advertising or behavioral profiling and we do not engage in automated decision-making or profiling that would produce legal effects. Recordings of Online Sessions: Some webinars, workshops, and public sessions are recorded for documentation and educational purposes. Prior to any recordings, the participants are informed at the beginning of recorded sessions, and the participants have the right to turn off their camera. Chat messages as part of a webinar session are not recorded. All such recordings are stored in the Fab City general database for an indefinite period of time. Recordings may be published online as part of our dissemination and knowledge sharing activities. Service Providers and International Transfers: We rely on selected service providers to operate our infrastructure. These include Webstudio for website hosting, Cloudflare where applicable, Google Analytics, Airtable for structured data processing, Google Workspace for document storage and communication, Mailchimp and Flodesk for newsletter management, SignNow for digital signatures, and Many Mangoes for the AI learning interface hosted on Render. Some of these providers operate outside the European Economic Area. Where personal data may be processed outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent legal mechanisms. We have agreements in place with our processors defining their responsibilities regarding data protection and confidentiality. Data Retention: Newsletter data is retained until you unsubscribe. Data related to event participation and project involvement is retained for two years after the last active participation, unless continued involvement justifies longer retention. Fab City pledge records are retained as part of the historical and institutional record of the initiative. Contracts and legally required documentation are retained for seven (7) years counted from the end of the financial year in which the economic transaction was recorded. AI interface logs are anonymized data that cannot be linked to identifiable individuals, and thus not regarded as personal data. Such logs are retained indefinitely. Personal data deletion is conducted through periodic manual review processes. Cookies: We use cookies for essential website functionality and analytics. Non-essential cookies are blocked until consent is provided through our cookie management banner. You may withdraw consent at any time through your browser settings or cookie preferences. Security Measures: We implement appropriate technical and organizational measures to protect personal data. These include role-based access controls within Airtable, secure cloud storage via Google Workspace, restricted administrative access, and encrypted communications where applicable. While no digital system can guarantee absolute security, we apply proportionate safeguards consistent with the nature of our activities. Your Rights: Under the General Data Protection Regulation, you have the right to access your personal data, request rectification, request deletion, restrict processing, object to processing, request data portability, and withdraw consent where consent is the legal basis. To exercise your rights, contact admin@fab.city. All requests shall be resolved maximum within one (1) month of receipt of the request, unless the complexity of the request requires an extension as permitted under the GDPR regulations. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate. Updates: This Privacy Policy may be updated to reflect changes in legal requirements or operational practices. The most recent version will always be available on our website.