How we handle your data
Your vote is anonymous
- 1. One check, when you create your account. We only check that you are a real person, that you don't have an account yet and how old you are. This stops anyone voting more than once.
- 2. Your name and address are never stored. We only store your national register number in encrypted form, to prevent duplicate accounts. It is never linked to your votes.
- 3. Your vote is stored separately from your account. A vote has no name and no account attached, only a voting code. That code is created with a secret key that is stored separately. The system only looks up your votes when you are logged in, so that you can see and change them. Administrators have no function at all to look up or view a person's votes.
- 4. We only show totals, only once there are 50 votes and with a delay, so that no one can work out individual votes.
- 5. You can delete everything at any time. If you withdraw your consent while logged in, the system looks up your votes at that moment and deletes them together with your account.
- 6. How we pay for this. Media and researchers can use our totals, sometimes for a fee. Never individual votes, and never figures about groups smaller than 50 people.
More information in the privacy statement.
Draft text for the MVP: have this text legally reviewed before the public launch.
The technical details, for those who want to know
What we store
- A pseudonymous citizen ID: a cryptographic derivative (HMAC) of the ID your login provider gives us. No name, email address or national register number.
- The time at which you gave your consent.
- Your votes, kept apart from your account: a separate voting token per proposal, with no link to your citizen ID and no timestamp.
What is and isn't possible
With the database alone, no one can see who voted for what. Someone with full access to the server and to the secret voting key could technically work out a particular person's votes. That is why we keep that key separately, with strictly limited access, and we build no function that does this, not even for administrators.
Why do it this way?
A vote on a law is a political opinion, a special category of personal data (Art. 9 GDPR). We only process it with your explicit consent, and in such a way that no one can see who voted for what from the database alone.
What we publish
Only rounded totals per proposal, once there are at least 50 votes, and updated with a delay. Never individual votes.
Who gets our figures?
At the moment we do not give or sell our figures to anyone. Everyone sees the same public totals on the site. Individual votes, accounts or national register numbers are never shared or sold.
Signing in with a passkey
After the one-time check with your eID, you sign in with a passkey. The secret key stays on your device; we only store the public part. We store no password and no email address. Once a year we ask you to confirm your identity again with your eID.
Following and notifications
Following works without an account. Clicking "Follow" gives you a cookie with a random key; we only store that key hashed. We store what you follow and, if you turn on notifications, the push address your browser gives us (encrypted). No name, no email address, no IP address. Notifications go through your browser's push service (e.g. Google, Mozilla or Apple). On the Notifications page you can delete everything in one click.
AI summaries
The summaries are made with Google Gemini based on the official parliamentary documents. No data about citizens is sent to the AI.
Who is responsible?
The data controller is the operator of OpenDemocratie.
What data, why and for how long?
| Data | Why and on what basis | How long |
|---|---|---|
| Your account: pseudonym, age group, province and large municipality, time of your consent | To be able to vote. Your explicit consent (Art. 6.1.a and 9.2.a GDPR). | Until you withdraw your consent. |
| Your votes, separate from your account | To show and share totals. Your explicit consent. | Until you withdraw your consent. |
| Encrypted link with your eID | To prevent anyone from creating two accounts. Your consent. | Until you withdraw your consent. |
| What you follow and your browser's push address | To send you the notifications you asked for (Art. 6.1.b GDPR). | Until you delete them, or 2 years after your last visit. |
| Technical server logs (e.g. error messages) | To keep the site safe and working. Legitimate interest (Art. 6.1.f GDPR). | At most 14 days. |
| A message sent through the contact form, and your email address if you enter it (encrypted) | To answer your question. Your consent (Art. 6(1)(a) GDPR). | One year. |
| A report that a summary is wrong (without name or account) | To correct mistakes. Legitimate interest (Art. 6(1)(f) GDPR). | One year after it has been handled. |
Who processes data for us?
- Our hosting provider, in the European Union: this is where the site runs and the database is stored.
- Google Cloud (Vertex AI, in the EU) writes the summaries. It only receives official documents, never data about citizens.
- Your browser's push service (Google, Mozilla, Apple or Microsoft) delivers the notifications you turned on. That service receives the notification encrypted and cannot read it. It may be located outside the EU.
- We verify your identity with your eID card, directly in your browser.
Your rights
You can view your data, have it corrected or erased, have processing restricted, take your data with you and object to processing. On My account you can see what we keep about you and delete everything in one go. For other questions, you can email us.
Not happy with how we handle your data? You can lodge a complaint with the Data Protection Authority (Drukpersstraat 35, 1000 Brussels).
Cookies
We only use cookies that are needed for the site to work, not cookies to track you. Read which cookies we use
Withdraw consent
You can withdraw your consent at any time: log in, then go to ‘My account’. We then delete your account, the encrypted link to your eID and all your votes.