Version of 12.10.2026

Privacy Policy

This policy clearly explains which personal data may be processed as part of OpenMyOrganization and its derivative software (EasyPV, EasyCIRCLE, EasyMEMO, and the entire Easy range), why they are processed, how long they are retained, and what your rights are.

OpenMyOrganization and its derivative software form a non-profit digital common, organized under multi-organization governance. The project does not rely on data sales, targeted advertising, or commercial profiling.

1. Data Controller and Scope

The data controller is the entity or organization operating the relevant instance of OpenMyOrganization or one of its derivative software. For privacy-related inquiries, you can contact webmaster@omo2.org.

This policy applies to the instance hosted and managed by the OpenMyOrganization project. When an organization installs OpenMyOrganization or one of its derivative software itself, it becomes responsible for its own instance, its users, its hosting, its backups, and compliance with applicable obligations.

2. Project Principles

Data are processed in accordance with the principles of lawfulness, good faith, proportionality, and purpose. We only collect and retain information useful for the operation of OpenMyOrganization and its derivative software, cooperation among members, and the security of the instance.

Data are neither sold, rented, nor used for advertising purposes. They are not used to create commercial profiles and are not reused for purposes unrelated to the operation of OpenMyOrganization and its derivative software, except for legal obligations or explicit agreement regarding a specific integration.

3. Data That May Be Processed

Depending on the applications used and your organization's choices, the following categories may be involved:

  • account and identity data: first name, last name, username, email address, photo or initials, preferences, and organizational affiliations;
  • content entered in the software: structure, spaces, responsibilities, projects, documents, minutes, calendars, indicators, processes, rules, decisions, proposals, votes, and discussions;
  • data related to public participation: email address used to gain access, personal code or link, participant status, pseudonym, or anonymity choice when this function is used;
  • necessary technical data: session, security logs, connection information, and elements essential for diagnosis, maintenance, and abuse prevention;
  • communication data when you contact us or request access, as well as the information necessary to send the requested message.
  • responses to surveys, assessments, or consultations when an organization activates these features;

4. Processing Purposes and Legal Grounds

These data are processed only to the extent necessary to:

  • create and secure accounts, authenticate individuals, and manage access rights;
  • enable cooperation, organizational documentation, preparation, and follow-up of decisions;
  • send invitations, access codes, notifications, and other messages requested by users or organizations;
  • prevent fraudulent access, abuse, data loss, and security incidents;
  • comply with legal obligations and respond to legitimate requests from data subjects.
  • produce statistics and conduct scientific studies to support research on the impact of governance modes, only from anonymized data and within the framework of academic research.

5. No Resale or Commercial Exploitation

We do not sell, rent, or monetize any personal data or content. We do not use information entered in OpenMyOrganization or its derivative software for advertising, targeting, prospecting, or commercial analysis.

The technical statistics necessary for service availability and security are not used to track individuals for advertising purposes. No advertising device or commercial profiling tool is integrated by default into the instance.

Some data may be aggregated and anonymized for statistical purposes to conduct scientific studies to support research on the impact of governance modes. These data remain anonymized, are never sold, and their use is limited to academic research.

6. Hosting and Recipients

The instance hosted by the project is operated at Infomaniak, an independent Swiss provider. This choice is based on its published commitments regarding privacy, security, sovereignty, and sustainability. Infomaniak states that its data and services are hosted in Switzerland and that its data centers are operated under its control.

The host, the individuals responsible for operation, and authorized technical providers can only access data to the extent necessary for their mission, security, or incident resolution. No data is transmitted to third parties for sale or commercial exploitation.

Optional services activated by an organization, such as email sending or external integration, may involve the corresponding providers. Only the data necessary for the concerned function should be transmitted to them, and the organization activating this function must inform the concerned individuals when required.

7. Open Source and Self-Hosting

OpenMyOrganization and its derivative software (EasyPV, EasyCIRCLE, EasyMEMO, and the entire Easy range) are open-source software. Any organization wishing to do so can install and operate its own instance to retain control over its hosting and data.

A self-hosted instance is, however, under the responsibility of the organization that installs it: server choice, updates, backups, access control, security, subcontractors, retention periods, and user information. This policy does not automatically apply to these independent installations.

8. Retention and Deletion

Account data and organizational content are retained as long as they are necessary for the service or the organization managing them needs them. Temporary access codes and short-lived technical data are deleted or renewed according to their function.

When data is no longer needed, it is deleted, anonymized, or made inaccessible within a reasonable time, subject to technical backups and legal obligations. Backups are retained for the necessary restoration cycle and are then overwritten or deleted.

9. Security

We implement technical and organizational measures proportionate to the risks: access control, protected sessions, organization separation, backups, maintenance, and incident monitoring. The official hosting also benefits from the infrastructure and security measures published by Infomaniak.

No system connected to the Internet can guarantee absolute security. We therefore ask administrators and users to choose strong passwords, limit rights to what is necessary, and promptly report any suspicious access or incident.

10. Your Rights

You can request access to your personal data, their rectification, deletion when conditions are met, and information about their processing. You can also object to processing or request its restriction when applicable law allows.

When legal conditions are met, you can request the delivery or transmission of the data you have provided in a commonly used electronic format. To process a request, we may verify your identity and consider the rights of others as well as retention obligations.

To exercise your rights or ask a question, use webmaster@omo2.org. If you believe that the processing of your data does not comply with applicable law, you can also contact the Federal Data Protection and Information Commissioner (FDPIC).

11. Policy Updates

This policy may be updated when the software, its hosting, its integrations, or legal requirements evolve. The date of the latest version is indicated at the top of the document. In case of significant changes, we will seek to inform the affected individuals through appropriate means.