The collection, processing and analysis of (personal) information forms a basis of the research and design activities of Track landscapes.
This creates legal obligations with regard to the handling of this personal data.
In this privacy statement we explain our handling of this data.
A first form of data that we collect is results from online surveys. It is always stated in the introduction what the handling of data is.
A number of guidelines apply here
We do not collect data that can be traced back to an individual person.
We only use the data / results for what it is intended for; research into spatial perception, experiences and use.
A second form of personal data that we collect is public data from activity tracking applications. These are spatial data such as:
A route traveled (longitude-latitude data).
The time when this took place.
The type of activity (running, cycling, etc.).
Personal information such as gender, age and user ID of a relevant user.
With regard to the new privacy legislation, our right to collect this activity tracking data is based on 'necessary for the promotion of legitimate interests'.
In the first place, this means that processing is demonstrably necessary to carry out your business activities. In our case, visualizing the use of space and perception is the core of our business operations, the necessity for collecting this data is beyond dispute. Second, the processing of the personal data must be 'necessary for the representation of the legitimate interest'. The processing must be tested in this respect for two requirements: (1) subsidiarity and (2) proportionality.
Subsidiarity states that the goal cannot be achieved in a way that is less disadvantageous for the persons concerned (persons from whom data are collected). As far as we know, there is no other way to visualize the spatial behavior of our target groups (runners, cyclists, walkers and other recreational users) than the methods we use (collecting data from activity trackers).
Proportionality states that the purpose of the processing is 'in proportion to the infringement for the persons whose personal data you process'. A balance must therefore be made between our interests and the interests of the persons whose personal data we process, and this must then be in proportion to each other. It is fair to say that 'being in proportion' is not a hard-defined boundary of what can and cannot be done. The interests of us vs. the person from whom data is collected are different, different interests cannot be measured against a yardstick to actually determine which are the greatest. What we can do is (a) explain why our importance is important and necessary (already done) and (b) explain how we try to keep the 'violation' of someone's privacy as small as possible. We consider the violation of privacy to be very minor because of the following principles that we apply in our work:
We only collect public data. That is, it is data that is publicly visible on another platform (website). Here each person has the choice whether he / she sets his / her data as publicly accessible / available or not. This data is therefore not newly collected or extracted from a person, it concerns the bringing together of data that is already public at different locations. If a person on a platform chooses to set his / her data to 'private', the data is not collectable for us.
Second, we also collect the data as impersonally as possible. This means, for example, that we collect (if possible) a 'user ID' instead of someone's actual name. This means that the personal data that we possess does not lead to a person that we recognize.
We do not store data longer than is necessary for the intended purpose.
Collected personal information is never examined or visualized on an individual level. We are interested in the (spatial) behavior of various target groups such as 'runners' or 'racing cyclists', the behavior of one or more individuals is not of interest to us from that perspective. The images and publications that we publicly display can therefore never be traced back to an individual.
The administrator / owner of this platform is always asked for permission to collect this information. If no permission is given, we will not collect any data here.
We never share raw personal data with other parties. What we share are visualizations of (spatial) behavior of groups, not the personal spatial data (such as longitude / latitude data of activities).
Duty to inform
Under the new GDPR, there is an obligation to inform the person from whom data is collected. There are a number of exceptions to this, namely if it is impossible to inform the data subject, or if it would require a disproportionate effort. In the case of the data from 'activity tracking applications', it is simply not possible to contact these users directly; we do not have or directly track these users' contact details.
However, we do state in the reports of each study which sources of information were used. These reports can be found both under our 'projects' on the website and under 'publications' on the website. Each person can recognize on this basis whether he / she possibly belongs to this group. Our contact details (namely: firstname.lastname@example.org) are listed on our website, anyone can inquire with us about the information we have about him / her. She / he can be provided with this information and can also demand that this data be deleted. We will of course comply with this.