Privacy Policy for the Salish Sea Indigenous Archive

Effective Date: October 26, 2023
Website: SalishHeritageArchive.com
Entity: Salish Sea Indigenous Archive

This Privacy Policy describes how the Salish Sea Indigenous Archive ("we," "us," or "our") collects, uses, discloses, and safeguards the Personal Information of visitors ("you," "your") to our website, SalishHeritageArchive.com (the "Site"). We are committed to protecting your privacy and handling your data with transparency, respect, and in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA) and United Kingdom (UK), and other relevant North American legislation.

This Archive is a digital repository dedicated to preserving and sharing the cultural heritage, languages, histories, and knowledge of the Indigenous peoples of the Salish Sea region. We recognize the profound sensitivity of much of the material in our care and extend the highest standards of ethical care not only to the cultural materials but also to the personal data of all our users.

By accessing or using the Site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our policies and practices, please do not use our Site.

1. Definitions

"Personal Information" or "Personal Data" means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
"Data Controller" refers to the entity that determines the purposes and means of the processing of Personal Information. For the purposes of this Policy, the Salish Sea Indigenous Archive is the Data Controller.
"Cultural Contributor" refers to an individual or community who has contributed cultural materials (e.g., stories, photographs, audio recordings) to the Archive.
"Researcher" refers to an individual using the Site for academic, genealogical, or personal research purposes.

2. Information We Collect

We collect several types of information from and about users of our Site, which may include:

2.1 Information You Provide Directly

Contact and Inquiry Information: When you contact us via email, contact forms, or mailing lists, you may provide your name, email address, institutional affiliation, and the contents of your message.
User Account Information: If you register for a researcher account to access certain restricted collections, you may provide a username, password, email address, name, research purpose, and institutional affiliation.
Contribution Information: If you are a Cultural Contributor, you may provide Personal Information as part of the donation or licensing process, including your name, contact details, biographical information, and your connections to the cultural materials. This information is often integral to the historical and cultural record.
Event Registration: If you register for a webinar, workshop, or event, we may collect your name, email, and organization.
Feedback and Surveys: Information you provide when you participate in surveys or provide feedback on the Site.

2.2 Information Collected Automatically

As you navigate through the Site, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns:

Log Data and Device Information: Information such as your IP address, browser type, operating system, referring URLs, pages viewed, links clicked, and the dates and times of your visits. We collect this to monitor and analyze trends, administer the site, and gather demographic information.
Cookies and Similar Technologies: Our Site may use "cookies" and similar tracking technologies. A cookie is a small file placed on your device. You can set your browser to refuse all or some browser cookies, but this may impair site functionality.
- Essential Cookies: Required for the Site to function (e.g., user session management for logged-in researchers).
- Analytical/Performance Cookies: Allow us to recognize and count visitors and see how they move around the Site (e.g., using a privacy-focused tool like Matomo hosted on our own servers). This helps us improve the Site.
- Functionality Cookies: Used to recognize you when you return and personalize content.

2.3 Information from Third Parties

We may receive information about you from other sources, such as partnering cultural institutions, academic collaborators, or community organizations, but only where they confirm they have the lawful basis to share that information with us and it is relevant to the Archive's mission.

3. How We Use Your Information

We use the information we collect for the following purposes, based on the legal bases outlined in Section 4:

To provide, operate, and maintain the Salish Sea Indigenous Archive and our Site.
To manage and facilitate access to archival collections, including creating and managing user accounts for Researchers.
To process and document contributions from Cultural Contributors, including creating metadata and provenance records that are critical for cultural preservation and ethical stewardship.
To communicate with you, including responding to your inquiries, sending administrative information (e.g., changes to our terms), and, with your consent, sending newsletters or updates about the Archive.
To improve our Site and services through analysis of usage patterns.
To ensure the security of our Site, networks, and systems, and to prevent fraud.
To comply with legal obligations and protect the legal rights of the Archive, our users, Cultural Contributors, and the Indigenous communities we serve.
To organize and manage events.

4. Legal Basis for Processing (GDPR)

For users in the EEA and UK, we process your Personal Information under one or more of the following legal bases as defined by the GDPR:

Performance of a Contract: Processing necessary for the performance of a contract with you (e.g., providing access to a registered researcher account) or to take steps at your request before entering such a contract.
Legitimate Interests: Processing necessary for our legitimate interests or those of a third party, provided your interests and fundamental rights do not override those interests. Our legitimate interests include: archiving and cultural preservation, scientific/historical research, administrative functions, network security, fraud prevention, and improving our services.
Consent: Where you have given clear, affirmative consent for specific purposes (e.g., subscribing to a newsletter). You may withdraw consent at any time.
Legal Obligation: Processing necessary to comply with a legal obligation we are subject to.
Vital Interests: Processing necessary to protect someone’s life (this is rarely applicable).
Public Interest or Official Authority: Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us (which may apply to certain archival functions).

For sensitive Personal Information (special category data) that may be present in cultural contributions or research requests, we will rely on additional lawful bases such as explicit consent, or that the processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1) of the GDPR.

5. How We Share and Disclose Your Information

We treat Personal Information with confidentiality and only share it in the following circumstances:

With Your Consent: We may disclose your information for any other purpose with your explicit consent.
For Archival and Research Purposes: Information provided by Cultural Contributors (e.g., donor name, biographical notes) is often made publicly accessible as part of the archival record to establish provenance and context, in accordance with the contributor agreement. Researcher identities are kept confidential unless disclosure is required by law.
Service Providers: We may share information with trusted third-party vendors who perform services on our behalf (e.g., website hosting, data analysis, email delivery). These providers are contractually bound to protect your data and use it only for the purposes we specify.
Legal Requirements and Protection: We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a government request.
Academic and Cultural Partners: In limited cases, and under strict data sharing agreements, we may share anonymized or aggregated data with academic or cultural institution partners for collaborative research or preservation projects.
Community Stewardship: In line with Indigenous data sovereignty principles, we may share information relevant to specific cultural materials with designated community representatives from the Indigenous nations of origin, under agreed protocols.

We do not sell, rent, or trade your Personal Information to third parties for their commercial marketing purposes.

6. Data Security

We have implemented technical, administrative, and physical security measures designed to protect your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. These measures include encryption, access controls, secure servers, and staff training. However, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your information transmitted to our Site.

7. Data Retention

We retain Personal Information only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, reporting, or archival obligations. Retention periods are determined based on:

The ongoing need to provide services.
The nature of the information and sensitivity.
Legal and contractual retention requirements.
Our archival mandate to preserve the historical and cultural record in perpetuity. Contributor information integral to an archival record may be retained indefinitely as part of the permanent archive.

When Personal Information is no longer needed, we will securely delete or anonymize it.

8. Your Rights and Choices (Including GDPR Rights)

Depending on your location, you may have certain rights regarding your Personal Information. We will comply with valid requests in accordance with applicable law.

8.1 For All Users

Access & Correction: You can request access to the Personal Information we hold about you and request corrections if it is inaccurate.
Marketing Communications: You can opt-out of receiving promotional emails by following the unsubscribe link in those emails.
Cookies: You can set your browser to refuse cookies.
Account Information: Registered users can review and update their account information by logging into their account.

8.2 For Users in the EEA, UK, and Other Jurisdictions with Similar Laws

You may have the following rights under the GDPR and similar laws:

Right of Access: To request copies of your data.
Right to Rectification: To request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): To request deletion of your data, subject to certain exceptions (e.g., where we have a legal obligation or archiving mandate to retain it).
Right to Restriction of Processing: To request we suspend processing of your data.
Right to Data Portability: To request a copy of your data in a structured, machine-readable format and/or transmit it to another controller.
Right to Object: To object to processing based on legitimate interests. You also have an absolute right to object to direct marketing.
Rights related to Automated Decision-Making: We do not engage in automated decision-making with legal effects.

To exercise these rights, please contact us using the details in Section 12. We may need to verify your identity before responding. You have the right to lodge a complaint with a supervisory authority in your country of residence.

9. International Data Transfers

The Salish Sea Indigenous Archive is based in Canada. If you are accessing our Site from outside Canada, please be aware that your information may be transferred to, stored, and processed in Canada, where our servers are located and our central database is managed. Canada has been recognized by the European Commission as providing an adequate level of data protection. We take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy. For transfers to other countries, we rely on appropriate safeguards such as standard contractual clauses approved by relevant authorities.

10. Children's Privacy

Our Site is not directed at children under the age of 16. We do not knowingly collect Personal Information from children under 16. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us. If we learn we have collected information from a child under 16, we will delete that information promptly.

11. Links to Other Websites

Our Site may contain links to websites operated by third parties, such as partner museums, academic institutions, or community organizations. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or to exercise your legal rights, please contact our designated Data Steward:

By Email: privacy@SalishHeritageArchive.com
By Postal Mail: Data Steward, Salish Sea Indigenous Archive, [Mailing Address, City, Province, Postal Code, Canada].

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. The updated version will be posted on this page with a revised "Effective Date." We encourage you to review this page periodically for the latest information on our privacy practices. Your continued use of the Site after any changes constitutes your acceptance of the updated Privacy Policy.

14. Indigenous Data Sovereignty & Ethical Stewardship

The Salish Sea Indigenous Archive operates under guiding principles of Indigenous Data Sovereignty (IDSov), which asserts the right of Indigenous peoples to govern the collection, ownership, and application of data about their communities, peoples, lands, and resources. While this Privacy Policy addresses individual privacy rights, our stewardship of community-held and culturally sensitive knowledge is also guided by specific protocols developed in partnership with the Indigenous nations of the Salish Sea region. These protocols may govern access, use, and reproduction of cultural materials in ways that supersede or complement general site policies. We are committed to honoring these relationships and protocols.