1. Definitions
Controller – TechSoup Foundation, Czackiego 15/17, 00-043 Warsaw, Poland, entered into the Register of Associations, other Social and Professional Organisations, Foundations and Public Health Care Facilities kept by the District Court for the Capital City of Warsaw, Commercial Division under the KRS (National Court Register) number 000032733, NIP (Tax ID): 7010177399 and REGON (Business ID): 141792374.
Personal data – all information about a natural person identified or identifiable by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity, including the IP of a device, location data, online identifier and information collected through cookies and other similar technology.
Controller’s Partner(s) – organisations which, as part of cooperation with the Controller, organise Events and are responsible for building, within individual regions, the Hive Mind community.
Processing –
an operation or set of operations performed on personal data inside or outside the IT system, e.g. collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Policy – this Privacy Policy.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Website – the Hive Mind website maintained by the Controller at
https://hive-mind.community.
User – any natural person visiting the Website or using one or more functions of the Website described in the Policy.
Events – courses, trainings, online events organised as part of the Website in accordance with the Website Terms of Use.
Website Terms of Use – Terms of Use concerning the
https://hive-mind.community website, specifying the terms and conditions of using the services provided via the website.
2. Controller contact details. 1) The Controller’s contact details are as follows:
TechSoup Foundation,
ul. Czackiego 15/17,
00-043 Warsaw
Poland
e-mail:
privacy@techsoup.org 3. Data processing in connection with the use of the Website. In connection with the User’s use of the Website, the Controller collects data to the extent necessary to provide particular services offered, as well as information on the User’s activity on the Website.
Detailed rules and purposes of processing personal data collected during the use of the Website are described below:
1) Persons using the Website. Personal data of all persons using the Website (including the IP address or other identifiers and information collected through cookies or other similar technologies) are processed by the Controller:
a) to provide services by electronic means in accordance with the Website Terms of Use – then the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR).
b) for technical and administrative purposes, in order to ensure the security of the IT system and its management, as well as for analytical and statistical purposes (e.g. by registering in the so-called server logs) – in this respect, the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), consisting in conducting analyses of the Users' activity and their preferences in order to improve the functions used and content provided.
c) to determine and pursue claims or defend against claims – then the legal basis for the processing is the legitimate interest of the Controller (Article 6(1)(f) GDPR) consisting in the protection of the Controller’s rights.
2)
Registered Website Users. a) The Website has functionalities available only for registered Users.
b) Persons registering on the Website are asked to provide the data necessary to create and operate an account. Providing data marked as mandatory is required in order to create and operate an account, and failure to provide such data results in inability to create an account. When creating an account, the User provides their first name/last name/pseudonym and e-mail address. The User may also provide their phone number as optional data. Once the account is created, the registered User can modify their profile and, depending on their user status, add additional data about them.
c) Users signing up for particular Events are requested to fill in the registration form and provide data necessary to participate in a given Event or, in specific cases, data necessary to participate in the recruitment for a given Event. The provision of data marked as mandatory is necessary to sign up for the Event or, as appropriate, to participate in the recruitment for this Event. The scope of data may vary depending on the type of Event in which the User intends to participate. The User can also provide optional data. In connection with participation in a given Event, the User may, in accordance with the Website Terms of Use, receive e-mail correspondence concerning that Event.
d) Personal data of registered Users are processed in order to perform the contract in accordance with the approved Website Terms of Use – the legal basis is the necessity to conclude and perform the contract (Article 6(1)(b) of the GDPR).
e) In the scope of optional data – personal data of registered Users are also processed on the basis of a consent given by the User (Article 6(1)(a) of the GDPR).
f) Personal data of registered Website Users are also processed for the purpose of possible establishment, exercise or defence of claims – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.
g) Personal data of registered Website Users participating in specific Events may also be processed for documentation or reporting purposes, in particular if the Event is financed from the funds of a donor/sponsor. In such a case, the legal basis for the processing of data is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), consisting in the necessity to account for the funds provided to it by the donor/sponsor.
h) If the User places on the Website any Personal Data of other persons (including their first and last name, address, telephone number or e-mail address), they may do so only provided that the provisions of law and personal rights of such persons are not infringed.
Where a User accesses the Hive Mind Circle community, the Controller may also process the User’s display name, nickname, profile photograph, time zone, community posts, comments, discussion contributions, direct messages where the functionality is enabled, and associated activity information. The exact categories depend on the features used and the information voluntarily added or published by the User.
Content published in the community may remain associated with discussions or other Users’ contributions after an account is deactivated. Where continued retention of such content is not necessary or legally justified, personal identifiers will be deleted or anonymised. The Controller will assess deletion requests in accordance with Article 17 GDPR and the rights and freedoms of other Users.
4. Single Sign-On (SSO), identity management and access to the Hive Mind Circle community. To provide secure and convenient access to the Website and the dedicated Hive Mind community hosted on the Circle platform, the Controller uses a Single Sign-On mechanism supported by Microsoft Entra External ID.
The Hive Mind content management system manages the registration process and the relevant Hive Mind account information. Microsoft Entra External ID supports authentication and identity management, while Circle maintains a separate account and activity record for the dedicated Hive Mind community. These systems perform different functions and may retain different categories of information.
When a User signs in through SSO, authentication is performed through Microsoft Entra External ID. The Controller does not have access to the User’s password. Credentials used for authentication are handled by the identity provider and must not be transferred to Circle or stored by Circle as part of the Hive Mind SSO data exchange.
The categories of personal data processed or exchanged in connection with SSO may include:
• email address;
• unique User identifier;
• display name;
• tenant ID, token issuer and intended application identifiers;
• token issue and expiry information;
• authentication status and technical session information;
• account status and access permissions;
• first name and last name, only where required by Hive Mind and obtained through the implemented and documented data flow; and
• other limited account attributes strictly necessary for authentication, authorisation, account administration, security and provision of the requested service.
The final scope of the attributes exchanged between Hive Mind, Microsoft Entra External ID and Circle is determined in accordance with the principle of data minimisation. Microsoft Entra External ID is not used as an additional general profile database solely because an attribute may be useful in Circle.
Following the first SSO login, a Hive Mind Circle profile may be created or pre-filled. The User may be required to review or complete certain information required by Circle, such as time zone. Where available, Users may manage optional profile information directly in Circle.
The Hive Mind Circle community may allow Users to publish posts, comments, discussion content, profile information, photographs or other materials. A User’s display name, username and content may be visible to other members of the community. The visibility of the member directory, email addresses, profile fields and messaging options depends on the Circle configuration and the privacy settings available to the User. The Controller applies privacy-by-default settings where administratively available and informs Users where a setting remains under their individual control. Users should not publish personal data relating to other persons unless they have a lawful basis and authority to do so.
Personal data processed in connection with SSO are used to:
• authenticate Users and provide access to Hive Mind and the dedicated Hive Mind Circle community;
• create, maintain and administer User accounts;
• manage access rights and service permissions;
• maintain the security, integrity and proper functioning of the services;
• detect, prevent and investigate fraud, abuse, security threats and unauthorised access;
• maintain authentication, access and security logs;
• troubleshoot technical issues; and
• comply with legal obligations and establish, exercise or defend legal claims.
The legal basis for processing is Article 6(1)(b) GDPR where processing is necessary to create or administer the account and provide a service requested by the User. Article 6(1)(f) GDPR applies where processing is necessary for the Controller’s legitimate interests in securing its systems and services, preventing misuse, administering access, troubleshooting and protecting legal rights. Where optional profile information is processed on the basis of the User’s choice and consent is the appropriate legal basis, Article 6(1)(a) GDPR applies.
Personal data processed in connection with SSO may be disclosed to service providers supporting authentication, identity management, hosting, system administration, transactional communications, integration workflows and IT security, including Microsoft, Circle, SendGrid and, where used, Zapier. The applicable role of each provider as processor, independent controller or, if relevant, joint controller must be determined by reference to the actual processing activities, contractual arrangements and allocation of decision-making responsibilities.
The dedicated Hive Mind Circle community is currently separate from other Circle communities and is not currently connected with TechSoup Engagement Hub through the Hive Mind SSO user journey. Access to another Circle community or another TechSoup service may require a separate registration and acceptance of the terms and privacy information applicable to that service. If the architecture changes and Hive Mind SSO is connected with additional TechSoup platforms, this Policy will be reviewed and updated before or at the time the materially changed processing begins.
Account deactivation, identity deletion and anonymisation of personal data are separate operations. Removing or disabling an identity in Microsoft Entra External ID does not automatically delete or anonymise corresponding information held in the Hive Mind content management system or Circle.
Where a User requests deletion of their account or personal data, the Controller will coordinate the request across the relevant systems. Depending on the request, applicable law and information that must lawfully be retained, the process may include:
• disabling or deleting the Microsoft Entra External ID identity to prevent further authentication;
• deleting or anonymising personal data in the Hive Mind content management system;
• deleting, deactivating or anonymising the Circle profile;
• deleting or anonymising personal data contained in community content where required and technically possible;
• preserving only information that must be retained for legal, security, reporting or claims-related purposes;
• applying appropriate restrictions to retained information; and
• recording completion of the request in the Controller’s internal request-management process.
Where automated integration through Circle, Circle API or Zapier is used, the Controller remains responsible for ensuring that the process operates correctly, is appropriately secured and does not result in excessive or inaccurate data processing.
Where SSO or the related services involve transfers of personal data outside the European Economic Area, such transfers will be handled in accordance with Section 13 of this Policy.
5. Contact form. 1) The Controller makes it possible to contact it using the electronic contact form available on the Website at: https://hive-mind.community/contact.
2) Using the form requires providing personal data necessary to contact the User and respond to the request. The User can also provide other data in order to facilitate contact or handle a request. Providing data is voluntary, but failure to provide data such as first and last name and e-mail address results in inability to handle a request.
3) Personal data are processed in order to identify the sender and answer a question included in the contact form – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), in particular communication with the Website Users concerning the functioning of the Website and organisation of particular Events.
6. Newsletter and email communications. 1) The Controller makes it possible to subscribe to newsletters and other email communications concerning Hive Mind, the Hive Mind community, Events and related TechSoup activities. Providing an email address for this purpose is voluntary, but necessary to receive such communications.
2) We may use email communication service providers, such as Mailchimp, to send newsletters and other email communications and to manage mailing lists.
3) We may also use transactional or technical email service providers, such as SendGrid, for the delivery of authentication messages, account notifications, security-related communications and other operational communications necessary for the provision of the services.
4) If the User subscribes to newsletters or other email communications, personal data may be processed for the purpose of sending such communications, managing the subscription, maintaining suppression lists and documenting the User’s communication preferences.
5) Depending on the nature of the communication, the legal basis for processing may be Article 6(1)(a) GDPR, where the User has given consent to receive marketing or newsletter communications; Article 6(1)(b) GDPR, where the communication is necessary to provide a service requested by the User; or Article 6(1)(f) GDPR, where processing is necessary for the Controller’s legitimate interests, including communication with Users, service-related updates, maintaining records of communication preferences and protection against claims.
6) Where permitted by applicable law and the User’s communication preferences, we may collect information about how recipients interact with our email communications, including whether an email was opened, the date and time of opening, whether links were clicked and general engagement with the communication. This information may be used to measure communication effectiveness, improve content relevance and manage future communications.
7) Users may unsubscribe from marketing or newsletter communications at any time by using the unsubscribe link included in the message or by contacting us directly. Service-related or transactional communications, such as account, security, login, password reset, Event or important policy update communications, may still be sent where necessary to provide the service or comply with applicable obligations.
7.
Social Media. 1) The Controller processes the personal data of the Users visiting the profiles maintained by the Controller in social media (Facebook, LinkedIn, YouTube, Spotify, Anchor.fm, Apple Podcast).
2) Data processing takes place when the User, via social media, undertakes activity on one of the profiles, e.g. by liking the profile, observing the profile, sending messages via the profile or commenting on the posts published by the Controller.
3) These data are processed only in connection with the profile, including in order to inform the Users about the Controller’s activity and to promote its activity within the scope of Hive Mind and the community created around it.
4) The legal basis for the processing of personal data by the Controller for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR), consisting in informing about its own activity and promoting it.
5) Social networks have their own privacy policies, regulations and data processing rules that bind their users and which the Controller is also obliged to comply with. If you are a User of such a portal, the processing of your personal data is also subject to such rules and policies and you can exercise your rights under them. Detailed information on this subject can be found in the Privacy Policies on particular portals used by the User.
8.
Cookies and similar technologies. 1) The Website uses cookies. Cookies are IT data, in particular text files, which are stored on the User’s end device to enable or facilitate the use of the Website.
2) We do not use cookies to store information that directly identifies a specific person (such as first and last name). However, some information collected by cookies is treated as personal data within the meaning of GDPR.
3) The Controller uses the following cookies: essential, functional and analytical.
4) The Controller uses essential cookies primarily to enable the User to use the services and features of the Website. Essential cookies can only be installed by the Controller through the Website. The legal basis for processing of data in connection with the use of essential cookies is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR).
5) Functional cookies are used to remember user preferences so that the Website can be customised for the User, also in terms of language preferences. Functional cookies can be installed by the Controller and its partners through the Website.
6) Analytical cookies are used to determine the number of visits to the Website as well as where that traffic originates. They are used to understand how the User interacts with the Website as well as to generate statistics and reports about the Website performance. Information collected by these cookies is not intended to identify the User. Analytical cookies can be installed by the Controller and its partners through the Website.
7) The legal basis for the processing of personal data in connection with the Controller’s use of functional and analytical cookies is its legitimate interest (Article 6(1)(f) of the GDPR), consisting in the provision of highest-quality services on the Website.
8) In connection with Single Sign-On, Microsoft Entra External ID and other providers technically involved in authentication may use cookies or similar technologies necessary to enable secure sign-in, session management, account selection, sign-out, request routing, fraud and abuse prevention and operational service telemetry.
The Controller treats such technologies as strictly necessary only where they are essential for the authentication or security function requested by the User. Any analytics, measurement, profiling, advertising or other non-essential technologies used by Hive Mind, Circle or another provider require the appropriate legal basis and, where required by applicable electronic communications law, prior User consent. Non-essential technologies must not be placed before the required consent has been obtained.
The Controller does not use authentication technologies for behavioural advertising. However, Users may be subject to separate cookies or similar technologies when they access Circle or another external service. Information about those technologies should be provided through the relevant cookie notice or consent interface.
9.
Managing the cookie settings. 1) In principle, cookies may not be used to collect data, including to obtain access to data stored on the User’s device, without the User’s consent. The cookie banner on the Website is used to obtain the User’s consent. This consent may be withdrawn at any time.
2) The User’s consent is not required for essential cookies as they are necessary for the provision of telecommunications services within the Website (data transmission to display content).
3) You can withdraw your consent to the use of cookies using a cookie banner or browser settings.
4) To manage your cookie settings, select the web browser (operating system) from the list below and follow the instructions:
a) Internet Explorer:
https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookie
b) Mozilla Firefox:
https://support.mozilla.org/pl/kb/ciasteczka
c) Google Chrome:
https://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647
d) Opera:
https://help.opera.com/Windows/12.10/pl/cookie.html
e) Safari:
https://support.apple.com/kb/PH5042?locale=en-GB
5) Restrictions on the use of cookies may affect some of the functionalities available on the Website's pages.
10.
Data recipients. 1) The Controller reserves the right to disclose selected information concerning the User to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with the applicable law.
2) Entities responsible for the operation and support of the Website and related services may have access to personal data where necessary to provide, maintain and secure those services. These entities may include providers of:
• identity management and authentication services, including Microsoft Entra External ID;
• community platform services, including the dedicated Hive Mind community hosted on Circle;
• transactional and technical email services, including SendGrid;
• newsletter and mailing-list services, including Mailchimp;
• integration and workflow services, including Zapier where used;
• hosting, system administration, monitoring and IT security services; and
• technical support and software-development services.
The Controller will determine and document the role of each recipient in relation to the specific processing activity. Where an entity processes personal data on behalf of the Controller, an agreement meeting the requirements of Article 28 GDPR will be maintained. Where another entity independently determines the purposes and means of its processing, it acts as a separate controller and Users will be informed accordingly. Where the parties jointly determine purposes and essential means, their respective responsibilities will be allocated in accordance with Article 26 GDPR.
3)
4) Personal data will also be made available to entities conducting particular Events, i.e. the Controller’s Partners listed here: https://hive-mind.community/terms_of_use, in order to enable them to conduct particular Events, including contacting the User in connection with their course. At each Event, the Controller places information on the organiser of a given event. The Controller’s Partners are separate personal data controllers.
11.
User Rights. 1) The User has the right to: access the content of the data and request their rectification, erasure, restriction of processing, the right to data portability and the right to object to data processing.
2) To the extent that the User's data are processed based on a consent, this consent may be withdrawn at any time by contacting the Controller. The withdrawal of consent does not affect the lawfulness of the processing of personal data before its withdrawal.
3) The scope of the User's rights depends on the purpose and legal basis of personal data processing. Please, contact the Controller in order to exercise any of the rights specified above using email: privacy@techsoup.org
4) At any time, the User has the right to lodge a complaint with the local supervisory authority, which in Poland is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
A request concerning a Hive Mind account may require action in more than one system, including the Hive Mind content management system, Microsoft Entra External ID and Circle. The Controller will coordinate the response and will not treat the deactivation of access as equivalent to full erasure or anonymisation of personal data.
Where personal data are retained after an erasure request, the Controller will inform the User of the applicable legal basis, purpose, scope and retention period or criteria used to determine that period. Personal data retained for the establishment, exercise or defence of legal claims, compliance, security or mandatory reporting will be restricted to the extent required.
5) We encourage you to contact us first by sending an e-mail to the following address:
contact@hive-mind.community or using the contact form available on the Website to solve any problems or doubts.
12.
Period of storage of personal data. The period of data processing by the Controller depends on the purpose of the processing. As a rule, data are processed until the consent is withdrawn or an effective objection is raised against data processing in cases where the legal basis for data processing is the legitimate interest of the Controller. If the User uses the contact form, their data will be processed no longer than necessary to provide an answer. Personal data of the registered User will be stored for the duration of the User's account, and after this period they may be stored for the period of limitation of possible claims to the necessary extent or in specific cases for documentation or reporting purposes, for the period during which the entity supporting the Event may request their presentation.
Authentication and access logs are retained only for the period necessary for security, troubleshooting, fraud prevention, compliance and protection against claims. Microsoft Entra audit and sign-in log retention depends on the applicable licence, configuration and any lawful extended archival implemented by the Controller. The period applied to the Hive Mind SSO environment is documented and reviewed periodically.
Circle account, profile and activity information is retained for the duration of the account and thereafter only for a documented period justified by the applicable purpose and legal basis. A request to delete or deactivate an account will be assessed separately for the Hive Mind content management system, Microsoft Entra External ID and Circle.
Where community content must remain to preserve the integrity of discussions, reporting or the rights of other Users, the Controller will remove or anonymise personal identifiers unless continued identification is necessary and legally justified.
Backups containing personal data will be deleted or overwritten in accordance with the documented backup cycle. Data that cannot be immediately removed from a backup must be isolated from ordinary use and must not be restored into active processing after an erasure request without reapplying the deletion or anonymisation.
13.
Transmission of data outside the European Economic Area. 1) The Controller will transfer personal data to third countries, i.e. countries outside the European Economic Area.
2) The User’s personal data are transferred to the Controller’s Partners who are responsible for organising the Events.
3) Personal data is stored on servers located in the United States by TechSoup Global with its registered office at 435 Brannan Street, Suite 100, San Francisco, CA 94107, USA.
4) Personal data may be stored or otherwise processed outside the European Economic Area in connection with the use of global hosting, identity management, authentication, community platform, integration, email communication and IT security services. These providers may include TechSoup Global, Microsoft, Circle, SendGrid, Mailchimp, Zapier and other providers supporting the relevant functions.
Before relying on a provider involving an international transfer, the Controller will identify the relevant data importer, transfer location, categories of data, purpose of transfer and appropriate transfer mechanism. Where required, the Controller will implement the European Commission’s Standard Contractual Clauses, conduct a transfer impact assessment and apply supplementary technical, contractual or organisational safeguards.
A reference to a provider’s global infrastructure does not by itself establish the transfer mechanism or the location in which Hive Mind data are stored. The Controller will maintain current records of provider locations, subprocessors and applicable safeguards.
5)
6) The personal data of the newsletter subscribers are transferred to MailChimp (The Rocket Science Group LLC d/b/a MailChimp, 675 Ponce de Leon Ave NE, Suite 5000 Atlanta, GA 30308 USA) – the newsletter provider that stores data on servers in the United States.
7) At each Event, the Controller places information on the organiser of a given event, i.e. the Controller’s Partner.
8) The User's personal data may be transferred to third countries or entities for which an adequate level of data protection has been determined by the European Commission.
9) In the absence of a decision of the European Commission stating an adequate level of protection specified in Article 45(3) of the GDPR, personal data of the User may be transferred to a third country only on the basis of standard data protection clauses adopted by the European Commission (Article 46 of the GDPR).
10) The Controller does not rely on explicit consent under Article 49(1)(a) GDPR as a routine or structural mechanism for ongoing transfers connected with the operation of the Website. Any reliance on an Article 49 derogation will be exceptional, interpreted restrictively and documented for the specific transfer.
11)
12) In connection with the transfer of data outside the EEA, the User may request information about the safeguards applied in this respect, obtain a copy of these safeguards or information about the place where they are made available by contacting us at the address indicated in point 2.
14.
Risk related to transferring data to third countries in the absence of a decision of the European Commission stating an adequate level of protection specified in Article 45(3) of the GDPR or lack of appropriate safeguards specified in Article 46 of the GDPR, including standard contractual clauses adopted by the European Commission. 1) In connection with the User's participation in a specific Event, the User's personal data may be transferred to the Controller's Partner having its registered office in a third country, which does not ensure an adequate level of data protection resulting from generally applicable regulations in Poland, in particular from the provisions of the GDPR.
2) In connection with the impossibility to conclude standard contractual clauses with the Controller’s Partner (data recipient), we would like to inform you that there is a risk of insufficient protection of the User’s personal data, in particular such data may be processed without observing the rules resulting from the GDPR. For example, this may mean that the legal systems of such third countries may, for example, not provide an independent supervisory authority competent to deal with data subjects' complaints, not provide the possibility to exercise the rights described in point 10, or not contain provisions limiting the interference of state authorities with the fundamental rights and freedoms of data subjects.
In such a situation, the basis entitling us to transfer personal data of the User to the Controller’s Partner is the User’s explicit consent to such transfer.
15.
Privacy Policy Amendment. 1) The Policy is reviewed on an ongoing basis and updated as necessary.
2) The Policy has been published in the Polish and English language versions. The Policy may also be published in the languages of the countries where the Controller’s Partners are established. In case of language differences, the English version prevails.
3) Any changes to the Privacy Policy will be published on the Website and will enter into force when the amended Privacy Policy is posted on the website.
4) The current version of this Policy reflects the use of Microsoft Entra External ID and the dedicated Hive Mind community hosted on Circle. References to connected TechSoup platforms apply only where the relevant integration has actually been implemented. Any future connection with TechSoup.org, Engagement Hub or another platform that materially changes the purposes, categories of data, recipients or account lifecycle will be assessed, and this Policy will be updated before the changed processing begins.
5) The current version of the Policy has been adopted and has been in force since October 12, 2026