Summary of how we use your data
- The Mozilla Foundation uses your personal data for the purposes of managing its business and recruiting and managing you as a volunteer, and ensuring the safety and security of its events..
- Data is shared with our service providers and may also be captured and published as part of your participation in filmed or photographed events, or shared with media partners.
- We may process details of your health to ensure we provide any reasonable adjustments required by law, and we may process information relating to your criminal record if we ask you to undergo a DBS check to comply with legal requirements. We will do this to comply with applicable employment laws.
- Our privacy policy sets out more details of this processing, including details of your data protection rights, including your right to object to certain processing.
What does this policy cover?
This policy describes how the Mozilla Foundation (also referred to as "Mozilla,” "we" or "us") will make use of your data when managing your role as an applicant and volunteer working for Mozilla at one of our events.
It also describes your data protection rights, including a right to object to some of the processing which Mozilla carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.
What information do we collect?
As a data controller we may collect and process the following types of personal data about you in connection with your application or ongoing volunteering role with Mozilla (to the extent permitted by law and as appropriate to your role):
- Contact information: such as your name, home address and postcode, personal email address, phone numbers and other similar information.
- Information required for background checks: such as identification number(s), home address history and copies of identity documentation, as permitted or required (we will also receive details of the outcome of your check from our vendor);
- Any other information you submit to us (including during the course of any correspondence with us): such as signatures, opinions, details of expenses claims and payment details, and any other information you provide.
How do we use this information, and what is the legal basis for this use?
Mozilla collects, uses and stores your personal data for the following purposes:
- As required to conduct our business and pursue our legitimate interests, in particular:
- reviewing applications from volunteers, hiring volunteers and managing our relation with volunteers. This will include managing their work and performance, and arranging appropriate insurance as necessary;
- planning our business and managing our events;
- protecting our legitimate business interests and legal rights. This includes but is not limited to, use in connection with legal claims, compliance, regulation, audits, investigations and disciplinary procedures (including sharing this information with other third parties for these purposes);
- managing the performance and security of our equipment, facilities, intellectual property and electronic platforms. This includes administering access rights and monitoring compliance with Mozilla Foundation policies; and
- using your information, including your image, in recordings, news and promotional content produced to record and promote Mozilla Foundation events.
- Where necessary to comply with a legal obligation, such as:
- complying with equality requirements requiring us to provide reasonable adjustments; and
- requiring volunteers to undergo background checks where taking certain roles, typically those interacting with children;
- Where you have given your consent, we will process data as described in any future consent you give us, for example in adding your to mailing lists so that you can be invited to volunteer at future events.
Where we process your sensitive data, this will typically be carried out for all the purposes above to ensure that we comply with employment laws or with your consent. We may also process criminal offense data for the purposes of preventing and detecting unlawful activity, for example in our monitoring of our IT systems.
Withdrawing consent
Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. You can do this by contacting us using the details set out below. Any circumstances in which we seek your consent will be truly voluntary, and there will be no detriment to you if you refuse consent. This may not be the case for consent you have given us to use your images, where we rely instead on our legitimate interests to use your likeness, images and recordings we have obtained.
Who will we share this data with, and where?
We will share your personal data with companies providing services under contract to The Mozilla Foundation, such as training providers and IT service providers including providers who host our software. Your personal data will also be shared with trusted third parties, such as our professional advisers and auditors, insurers, banks and other organizations which advise us. We may also share it with our travel vendor Egencia, where you seek our assistance with travel.
When the law requires it. We follow the law whenever we receive requests about you from a government or related to a lawsuit. We'll notify you when we're asked to hand over your personal information in this way unless we're legally prohibited from doing so. When we receive requests like this, we'll only release your personal information if we have a good faith belief that the law requires us to do so. Nothing in this policy is intended to limit any legal defenses or objections that you may have to a third party's request to disclose your information.
In the event that the Mozilla Foundation is sold or integrated with another business, your details will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.
Where information is transferred outside the EEA, except for the initial collection of information by the Mozilla Foundation in the United States as the event organizer, and where this not as a result of contractual necessary or to a third party in a country subject to an adequacy decision by the EU Commission, your data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Data Privacy Framework certification or a vendor's Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request to compliance@mozilla.com.
What rights do I have?
You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling the request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in local laws such as the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make. In some instances, this may mean that we are able to retain data even if you withdraw your consent.
Where we require personal data to comply with legal or contractual obligations, then provision of such data is mandatory: if such data is not provided, then we will not be able to manage our relationship with you or to meet obligations placed on us. In all other cases, provision of requested personal data is optional.
We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at compliance@mozilla.com or by writing to Mozilla, Attn: Legal Notices - Privacy, 149 New Montgomery Street, 4th Floor, San Francisco, CA 94105, USA. If you have unresolved concerns you also have the right to complain to a relevant data protection authority. The relevant data protection authority may be the supervisory authority where you live, work or where processing takes place.
How long will you hold my data?
We will hold the various details relating to your volunteering and your application with the Mozilla Foundation consistent with our data retention policies..
We may also hold other information about you where required by law, such as for health and safety records. In these cases, we will hold information for as long as necessary for these purposes or as required by law, and will ensure your data is reviewed over time to ensure it is not held where no longer necessary.
We may retain details of your participation in events indefinitely, particularly where captured in photographs or footage of events retained as a record of the event or in order to promote the event.