Privacy Notice

1. Controller

ESN — Europe of Sovereign Nations
Group in the European Parliament
Rue Wiertz 60, B-1047 Bruxelles, Belgium
E-mail: info@underattack.info

2. What data we collect

When you sign the petition, we process the following data:

• First and last name
• E-mail address — to confirm your signature via double opt-in
• Country and postal code (optional) — to gauge regional distribution
• Topic focus (free speech / cash / both)
• IP address — hashed with HMAC-SHA256 before storage and kept only in that form. It cannot be traced back to the original IP without the secret server salt.
• Browser identifier (user agent) — to detect automated sign-ups
• Timestamps of the sign-up and confirmation
• Source of the sign-up (technical origin, e.g. which page you signed from).
• whether you want to receive campaign update e-mails (only if you tick the optional box; see section 6).

For signatures collected offline on paper lists and entered by us later, we process name, country/postal code and, where applicable, an internal note on the origin (e.g. place and date of collection). The legal basis here is the consent given on the respective paper form.

3. Legal basis

We process your data on the following legal bases of Regulation (EU) 2018/1725:

• Art. 5(1)(d) of Regulation (EU) 2018/1725 — your explicit consent when submitting the form (checkbox).
• Art. 5(1)(a) of Regulation (EU) 2018/1725 — preventing abuse (repeated fake sign-ups, bot spam) through IP hashing and rate limiting, in the public interest of an untampered, verifiable petition.
• Art. 10(2)(a) of Regulation (EU) 2018/1725 — your explicit consent to the processing of your political opinion. By signing this petition you reveal a political opinion; this is a special category of data, and you explicitly consent to its processing when submitting.

4. How we use the data

• Sending the confirmation e-mail (double opt-in)
• Compiling the signature list and handing it to the relevant EU institutions: the European Parliament, the European Commission and the European Central Bank. This is the purpose of the petition.
• Protection against abuse (rate limiting, honeypot, IP hash)

We do not sell or rent your data, do not share it with third parties for advertising, and do not use it for other initiatives.

5. Retention period

• Unconfirmed sign-ups: the confirmation link is valid for 24 hours. If it is not clicked, the entry is automatically deleted after at most 7 days.
• Confirmed signatures: kept until the list is handed to the institutions, then for a maximum of a further 3 months, after which the personal data is deleted. Anonymised statistics (total count, country/postal-code distribution) may be kept beyond that.
• Audit logs (actions such as submitting and confirming) with ipHash + timestamp are kept for 12 months, then deleted.
• Rate-limit records are deleted daily (older than 24 h).
• Sending queue: to reliably deliver the confirmation e-mail, your name and e-mail are held temporarily in a queue and removed after successful sending (within 48 hours at the latest) or when your entry is deleted.

6. Recipients of the data

Your data is not sold and not shared with third parties for advertising. It is disclosed only in the following cases, which are necessary for the petition:

• Handover of the signature list to the relevant EU institutions — the European Parliament, the European Commission and the European Central Bank. This is the purpose you consented to (Art. 5(1)(d) of Regulation (EU) 2018/1725).
• Hosting: the website and database are operated with Hostinger International Ltd. on a server in Germany (Frankfurt am Main). A data-processing agreement is in place.
• E-mail delivery: confirmation e-mails are sent via the SMTP server of Hostinger International Ltd. (EU). Only the data required for delivery (recipient, content) is processed.
• Newsletter / update e-mails (only with your consent): only if you ticked the optional box for update e-mails when signing do we additionally process your name and e-mail to keep you informed about the campaign (Art. 5(1)(d) of Regulation (EU) 2018/1725). You can withdraw this consent at any time with effect for the future — via the unsubscribe link or by e-mail to petition@underattack.info. Your signature remains unaffected. Delivery is handled by the e-mail marketing service Hostinger Reach (Hostinger International Ltd.); a data-processing agreement is in place with it.

7. Cookies

For visitors of the petition pages we set only one strictly necessary cookie: “lang” stores your language choice (max. 1 year, sameSite: strict, secure). In the protected admin area (/admin) and in maintenance mode, additional strictly necessary session cookies are used, which regular visitors never receive.

We use no tracking or analytics cookies, no external advertising pixels and no social-media plugins. Our reach measurement (section 8) is cookieless. No ePrivacy consent is therefore required.

8. Server logs & reach measurement

When the website is accessed, technical server logs may arise at the hosting/proxy layer (Caddy, Hostinger); their retention and deletion follow the hosting provider’s rules. We ourselves do NOT store any raw IP address permanently — in our database the IP is kept solely as an HMAC-SHA256 hash. Legal basis: Art. 5(1)(a) of Regulation (EU) 2018/1725 (security and stability of the service).

In addition, we run our own cookieless reach measurement (no third party). We record only: the page requested, a rough device category (mobile/tablet/desktop), language and — if present — the domain name of the referring website. Your IP address is not stored. To count unique visitors we generate a daily-rotating pseudonym that prevents recognition beyond the day. Deleted after at most 180 days. Legal basis: Art. 5(1)(a) of Regulation (EU) 2018/1725.

9. Your rights

You have the right, at any time, to:

• access (Art. 17 of Regulation (EU) 2018/1725), rectification (Art. 18), erasure (Art. 19), restriction of processing (Art. 20), data portability (Art. 22), objection (Art. 23), and withdrawal of your consent (Art. 7(3)) with effect for the future.
• lodge a complaint with the European Data Protection Supervisor (EDPS) — the supervisory authority for EU institutions and bodies (Art. 63 of Regulation (EU) 2018/1725): European Data Protection Supervisor, Rue Wiertz 60, B-1047 Bruxelles, e-mail: edps@edps.europa.eu, web: edps.europa.eu. You may also contact the Data Protection Officer of the European Parliament: data-protection@europarl.europa.eu.

To delete your signature or exercise your rights, a simple message to petition@underattack.info is enough — we will then delete your entry promptly and completely.

10. Technical & organisational measures

• TLS/HTTPS encryption of all data transfer
• IP addresses only as an HMAC-SHA256 hash with a server-side salt
• Confirmation tokens with 256-bit entropy, valid for 24 h; rate limiting and honeypot against mass sign-ups
• Content-Security-Policy, HSTS and further security headers; regular encrypted backups

11. Minimum age

The petition is aimed at people aged 16 or over. By signing, you confirm that you meet this age requirement.

12. Changes

We reserve the right to amend this notice where necessary due to new features or changed legal requirements. The version published on this page applies.

Last updated: July 2026