Digital Privacy Policy · Transparency by Default · Consent Receipt Enabled

What happens first

You can verify who is accountable, what identifiers may be used, and how to exercise rights before any identification is demanded. This is a public standard implementation of a digital-consent-capable privacy policy, in which Global Privacy Rights holds a digital identity (provided instead of user-IDs) so you can see who controls your data before visiting, and object to being identified and tracked online prior to being digitally identified.

Standards note

A standard implementation

This is a standard digital privacy policy implementation using Part 1 of the Universal Notice Receipt Profile. For general internet transparency conformance, it uses Open-Digital Public Network (0PN) standards based on the ISO/IEC TS 27560:2023 consent record information structure profile, which is free and safe to use as standard digital privacy infrastructure.

Who is accountable

Controller identification

Controller name
Global Privacy Rights
Business Number (BN)
78344 5505
Controller address
Transparency Lab, Montréal, Québec, Canada
Jurisdiction
Québec, Canada
Operating location
Montréal, Québec, Canada
Representative
Digital Privacy Officer
Website
https://globalprivacyrights.org

Machine-readable transparency endpoints

These are the canonical, machine-readable endpoints for automated verification:

notice.txt (fallback)
/.well-known/notice.txt
Controller Identification Record (CIR)
/.well-known/transparency/cir.json
This policy reconciles to CIR version 0.3.1.

Rights access

Human-readable rights instructions and access point — including the right to object prior to processing, for meaningful digital consent:

What identifiers may be collected (PII-i) and why

Current service bundles

Below is the plain-language rendering of the current machine readable digital privacy service bundles.

Necessary runtime (site continuity)

Purpose
maintain site delivery and runtime continuity
PII-i
ip_address (transient, edge logs)
Legal basis
legitimate interest
Service
Cloudflare Pages (static hosting)

Transfer and foreign law exposure

Hosting
Cloudflare Pages. Cloudflare is incorporated in the United States and operates a global edge network, so requests may be served from outside Canada.
What that means
Edge logs containing an IP address may be processed outside Canada, and a United States provider may be subject to United States legal process regardless of where data is stored.
What we hold
No account, no profile and no analytics identifier. The records on this site are public transparency artefacts, not personal records.
Why it is disclosed
We ask other organisations to state foreign law exposure where it is relevant. This is ours.

Contact (inquiries)

Purpose
respond to inquiries and provide requested information
PII-i
name, email_address, message_content
Legal basis
consent
Service
direct email to info@globalprivacyrights.org

Payments (sponsorship / donation checkout)

Purpose
process payments and administer sponsorship
PII-i
email_address, payment_token, billing_details (processor-side), ip_address, device_id (fraud signals)
Legal basis
contract
Services
Ghost + Stripe (planned; online checkout not yet live; sponsorship is currently by email, no payment data collected on this site)
Your control

Consent, withdrawal, and objection

If consent is used as the legal basis for a specific purpose, withdrawal must be as easy as giving consent. Where objection is available as a right, requests can be submitted through the rights access point above.

Default response SLA (operational)

Integrity / verification

Verify the served bytes

The canonical integrity values are published at, and reproducible from, the machine-readable transparency endpoints. To verify, fetch an endpoint and hash the served bytes:

curl -s https://globalprivacyrights.org/.well-known/transparency/cir.json | shasum -a 256

The resulting digest must match the integrity value published in the CIR / notice chain. The endpoints above are the source of truth; this human-readable page links to them rather than duplicating a digest that could drift.