Privacy policy

The data controller for this investigation platform is the independent international editorial team operating fadikhalilinvestigations.com ("we", "us", "the investigation"). The investigation operates as a public-interest journalistic and victim-coordination platform serving readers, victims and witnesses worldwide.

Because contributors, witnesses and victims face documented risks of intimidation and retaliation, the personal identities of editorial staff are not published. All data-protection enquiries are handled through a single dedicated contact channel:

Data-protection contact (sole channel): our secure contact form.

We respond to data-protection requests within 30 calendar days (extendable by 60 days for complex requests, consistent with Article 12(3) GDPR, UK GDPR, Swiss FADP, Brazilian LGPD and California CCPA/CPRA timelines). We will never phone you, never appear unannounced and never ask you for money or payment details.

This document is our public privacy policy. It is published at /privacy, linked in the main navigation under Resources, linked from the cookie banner that appears on first visit, and linked from the footer of every page. It covers all personal data processed by this platform — whether collected through the petition, the class-action sign-up, the evidence submission form, the donation flow, or basic analytics — regardless of where in the world the data subject is located.

We process the following categories of personal data:

• Identification data you choose to provide (name, email, country, role).
• Evidence-submission data: free-text descriptions and any files you upload, together with your publication-consent and confidentiality choices.
• Petition and class-action sign-up data: name, email, country, optional message, and the timestamp / IP address used for fraud-prevention only.
• Donation data: only what the payment processor returns to us (name, email, country, amount). We do not see or store card numbers.
• Technical data: language preference, cookie-consent choice, anonymous usage analytics if you opted in via the cookie banner.

This platform serves data subjects worldwide. We comply with — and cite the parallel legal grounds under — every major data-protection regime that applies to our users, including the EU General Data Protection Regulation (GDPR, Regulation 2016/679), the UK GDPR & Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP / revFADP 2023), the Brazilian Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018), the California Consumer Privacy Act as amended by the CPRA, Canada's PIPEDA, Australia's Privacy Act 1988, and equivalent national journalism / public-interest exemptions recognised in each jurisdiction.

The legal bases we rely on (GDPR Article 6 numbering, with international equivalents):

• Consent — Art. 6(1)(a) GDPR / Art. 7 LGPD / §1798.120 CCPA: petition and class-action sign-ups, evidence-submission publication consent, optional analytics cookies, newsletter / update opt-ins.
• Legitimate interests — Art. 6(1)(f) GDPR / Art. 31 Swiss FADP / Art. 10 LGPD: investigative journalism in the public interest, prevention of further fraud, and coordination of cross-border victim support. The public interest in exposing serious financial and sexual-misconduct allegations is balanced against the data subject's rights and freedoms.
• Legal obligation — Art. 6(1)(c) GDPR / Art. 7(II) LGPD: retention and disclosure of evidence to competent national authorities and international law-enforcement bodies (national police, financial regulators, prosecution services, Interpol, Europol) when lawfully requested.
• Vital interests — Art. 6(1)(d) GDPR / Art. 7(IV) LGPD: where urgent disclosure to law-enforcement or emergency services is necessary to protect a person's life or physical safety.

Special-category data (e.g. allegations of sexual misconduct, health data in witness statements) is processed only under Art. 9(2)(d), (f) and (g) GDPR and equivalent provisions — manifestly made public by the data subject, establishment / exercise of legal claims, or substantial public interest. Each EU/EEA Member State, plus the UK, Switzerland, Brazil and other jurisdictions, recognises a specific journalism / freedom-of-expression exemption (e.g. Art. 85 GDPR national derogations, UK DPA 2018 Schedule 2 Part 5, Art. 4(II) LGPD, Swiss FADP Art. 27) on which we rely where applicable.

We implement appropriate technical and organisational measures (Art. 32 GDPR, Art. 8 Swiss FADP, Art. 46 LGPD, and equivalent security obligations under national law), including:

• TLS / HTTPS encryption for all traffic in transit.
• Encrypted storage of submitted evidence files at rest.
• Strict role-based access: raw witness submissions are accessible only to a small core editorial team; access is logged.
• Daily off-site backups of the database; encrypted backup files.
• Hardened, regularly patched server stack; dependency-vulnerability scanning.
• Multi-factor authentication required for all administrative access to the platform and its email channel.
• Separation of contact details from evidence content where requested via the "Only authorities may use my contact details" option on the submission form.

In the event of a personal-data breach, we will notify the competent supervisory authority (or authorities) within 72 hours as required by Art. 33 GDPR and UK GDPR, within the timelines required by Art. 48 LGPD, Art. 24 Swiss FADP and any other applicable regime, and we will notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR and equivalents).

Data is kept only as long as necessary for the purposes for which it was collected:

You may request earlier deletion at any time — see Rights of Data Subjects below. Where deletion would conflict with a legal obligation or an active criminal investigation in any jurisdiction, we will restrict processing instead and explain the reason in writing.

The investigation is operated by the editorial team of fadikhalilinvestigations.com, an independent international public-interest journalism and victim-coordination project. We are not a commercial enterprise; we generate no revenue from advertising or data resale. Donations are used exclusively for legal coordination, translation, document-handling and platform hosting.

The investigation does not currently meet the GDPR thresholds requiring a designated Data Protection Officer (Art. 37 GDPR) and is below the equivalent thresholds under the UK GDPR, Swiss FADP and Brazilian LGPD. Our secure contact form functions as our single point of contact for all privacy matters and supervisory-authority enquiries worldwide.

Your right to lodge a complaint. You always have the right to lodge a complaint directly with the data-protection or privacy supervisory authority of your country of residence, place of work, or place of the alleged infringement (Art. 77 GDPR; Art. 165 UK DPA 2018; Art. 49 LGPD; Art. 49 Swiss FADP; §1798.199.45 CCPA, and equivalents elsewhere). Examples of competent authorities include:

• European Data Protection Board (EDPB) (cross-border coordination across the EU/EEA) — edpb.europa.eu
• United Kingdom — ICO — ico.org.uk
• Ireland — Data Protection Commission (DPC) — dataprotection.ie
• France — CNIL — cnil.fr
• Germany — BfDI (federal) and the Länder DPAs — bfdi.bund.de
• Switzerland — FDPIC / EDÖB — edoeb.admin.ch
• Brazil — ANPD — gov.br/anpd
• United States — California Privacy Protection Agency — cppa.ca.gov
• Canada — Office of the Privacy Commissioner (OPC) — priv.gc.ca
• Australia — OAIC — oaic.gov.au

For any other country of residence, the supervisory authority of your home jurisdiction is the competent body. You do not need to contact us first — you can complain directly.

To request correction or deletion of your personal data:

1. Submit your request via our secure contact form and select "GDPR — Correction request" or "GDPR — Deletion request" as the reason for contact. The same channel handles equivalent requests under UK GDPR, Swiss FADP, LGPD, CCPA/CPRA and other regimes — please mention the law you are relying on if you know it; otherwise we will identify the correct framework for you.
2. Briefly describe what data you want corrected or deleted. You do not need to prove harm; you do not need to explain the reason for deletion.
3. We will verify your identity using the email address on file (or, if you are not in our records, by asking you for the specific submission reference or sufficient context to locate the data). We will not ask you for ID documents unless strictly necessary, and we will never ask you to phone us.
4. We act on the request within 30 calendar days (extendable by 60 days for complex requests, with written explanation, per Art. 12(3) GDPR; comparable statutory windows apply under LGPD, CCPA, Swiss FADP and other regimes).
5. You receive written confirmation of the action taken — correction made, data deleted, or (with reasons) request refused or restricted.

Requests are free of charge unless manifestly unfounded or excessive, in which case we may either charge a reasonable fee or refuse to act (Art. 12(5) GDPR and equivalents), with written reasons and information about your right to complain to the supervisory authority of your country.

Under GDPR Articles 15–22 and 77 — and the directly comparable rights under UK GDPR, Swiss FADP, Brazilian LGPD Art. 18, California CCPA/CPRA §§ 1798.100–1798.150, Canadian PIPEDA and Australian Privacy Principles — you have the following rights at all times, regardless of where you live:

• Right of access (Art. 15 GDPR / LGPD Art. 18(II) / CCPA "right to know") — to obtain a copy of all personal data we hold about you.
• Right to rectification (Art. 16 GDPR / LGPD Art. 18(III)) — to have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17 GDPR / LGPD Art. 18(VI) / CCPA "right to delete") — the "right to be forgotten", subject to legal-obligation exceptions noted above.
• Right to restriction (Art. 18 GDPR / LGPD Art. 18(IV)) — to limit how we process your data while a dispute or verification is pending.
• Right to data portability (Art. 20 GDPR / LGPD Art. 18(V) / CCPA §1798.130(a)(3)) — to receive your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR / CCPA "right to opt out") — to object to processing based on legitimate interests, including for journalistic purposes (a balancing test then applies under the applicable national journalism / freedom-of-expression exemption).
• Right not to be subject to automated decisions (Art. 22 GDPR / LGPD Art. 20) — we make no automated decisions about you. All editorial decisions are made by humans.
• Right to withdraw consent (Art. 7(3) GDPR / LGPD Art. 8 §5) — with effect for the future, at any time.
• Right to non-discrimination for exercising any of these rights (CCPA §1798.125 and equivalent principles under other regimes).
• Right to lodge a complaint (Art. 77 GDPR and international equivalents) — directly with the data-protection / privacy supervisory authority of your country, without going through us first. See Section 6 for a non-exhaustive list of authorities.

All rights are exercised through the same channel: our secure contact form.