Privacy policy

Who we are

Mediterranean Environmental Protection Agency (“MEPA”, “we”, “us”) is an incorporated association in Western Australia, under the Associations Incorporation Act 2015. We work on pollution of the Mediterranean Sea and are based in Limassol, Cyprus.

Email: admin@mepa.ngo. Registration reference: Application for incorporation no. 1927039, Associations and Charities (Consumer Protection Division), Department of Local Government, Industry Regulation and Safety, Western Australia. We do not yet have an ABN or charity registration, and we do not claim any.

For the purposes of data-protection law (including the EU and UK General Data Protection Regulation where it applies to us, and the Australian Privacy Act 1988), MEPA decides how and why the information described here is used.

What we collect, why, and for how long

Just visiting this site

The site is hosted on Cloudflare. To deliver the pages and protect them from abuse, Cloudflare processes technical information about each request, such as your IP address, browser type and the page requested. We do not use it to identify you and we do not run our own analytics, tracking pixels, advertising or profiling. Basis: our legitimate interest in running and securing the website.

Contact, report, “get involved” and newsletter forms

These forms do not send anything to our servers. When you press the button, your own email app opens with a message to admin@mepa.ngo. We receive only what you choose to send: usually your name, email address and message. We use it to reply, to look into a report you made, or, if you ask to subscribe, to send you occasional updates until you ask us to stop. Basis: your consent (you tick a box before the form opens your email app), and for a report our legitimate interest in checking and following it up. We keep messages only as long as needed to deal with them and any follow-up, and normally delete them within 24 months of the last contact. A report that becomes part of an investigation may be kept longer, without your name unless you agree.

Please do not send us details of people who do not need to be identified, such as names or faces of bystanders. Do not send anything that is illegal to possess.

The donation desk (Donate in Monero)

You do not need an account, a name or an email address. When you start a donation we store: how you chose to give, the coin if you swap, the objective you picked, an approximate amount if you gave one, an optional return address, an optional description, the confirmations you ticked, a record of updates, and any note or picture you add. The private token you receive is stored only as a one-way hash, so we cannot read it or recover it for you. We do not store your IP address: a short-lived keyed hash, changed daily and kept for at most an hour, is used only to limit abuse. Pictures are re-encoded in your browser before upload to remove location and camera data. Basis: our legitimate interest in running the donation desk and keeping the records we need to receive, allocate and, where necessary, return gifts. We aim to delete or anonymise a closed donation record, and its pictures, 24 months after it closes. We may keep information longer if the law requires it. A return address, if you give one, is used only to return a gift.

The Monero blockchain is public and permanent. We do not control it, and information you put on it cannot be deleted by us.

Offering an item

The offer form stores your description of the item, the need it is for, and any country you mention, in the same way as a donation record, under a private token. If we take up your offer we reply on your token page. We never publish an address. We keep these records on the same terms as donation records.

Card payments

Card payments are not available yet. When they are, they will be taken by a payment partner, which collects your card details under its own privacy policy. We will not see your card number.

Needs and gifts

When a need is funded we publish only totals, receipts with personal details blanked out, and pictures of what was bought. We never publish donor names.

Other companies and sites

Cloudflare hosts the site and the donation desk (including its database), and delivers pages worldwide. Our email provider handles the messages you send to admin@mepa.ngo. We do not sell personal information and we do not share it for advertising.

Links. The site links to other sites, for example Instagram and our investigations partner PolarVector, and to sources we cite. They have their own privacy practices. We do not embed their scripts.

We may disclose information where the law requires it, or where it is necessary to protect people or the environment from serious harm and the law allows it.

Where information goes

Our providers run networks in many countries, so information may be processed outside Cyprus, the EU and Australia. Where the law requires safeguards for such transfers, our providers rely on recognised mechanisms. Ask us if you would like details.

Your rights

You can ask us for a copy of the personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, and, where it applies, to receive it in a portable form. Where we rely on your consent you can withdraw it at any time (for example, by asking to be removed from updates); this does not affect what we did before.

To use these rights write to admin@mepa.ngo. We may need to check it is you. We cannot find a donation record without its token, and we cannot recover a lost token, because we do not hold it in readable form.

If you are not satisfied, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), to the supervisory authority where you live, or to the Office of the Australian Information Commissioner (oaic.gov.au). We would like the chance to put it right first.

Security

The site is served over HTTPS only. Donation tokens are stored as hashes and the donation desk limits abuse without keeping IP addresses. No system is perfectly secure, and we cannot promise that information sent over the internet is.

Children

The site is not aimed at children, and we do not knowingly collect information from anyone under 16. If you think a child has sent us information, tell us and we will delete it.

Changes

We will update this page if what we collect changes, for example if we add analytics, a newsletter service or card payments, and we will change the date at the top. Material changes will be made before the new practice starts.