Last updated: January 2026
The European Center for Investigative Journalism (ECIJ) is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding your data. It applies to our website (ECIJ.org), newsletters, tip submission systems, email communications, and any other services we provide.
1. Who we are
The data controller is:
European Center for Investigative Journalism (ECIJ)
Rue de la Loi 227, 1040 Brussels, Belgium
Email: hello@ecij.org
We are a non-profit organization focused on investigative journalism exposing corruption in European politics.
2. Information we collect
We collect only the minimum data necessary to carry out our journalistic mission and provide our services.
a. When you visit our website
– Technical data: IP address, browser type/version, operating system, referring page, pages visited, time and date of visit, time spent on pages (collected via server logs and privacy-friendly analytics).
– We do not use tracking cookies for advertising or cross-site profiling. We may use minimal first-party cookies only for essential functionality (e.g., remembering newsletter subscription preferences or language choice).
b. When you subscribe to our newsletter
– Email address (required)
– First name (optional)
– Country (optional)
– Preferences for email frequency/content (optional)
c. When you send us a tip or story lead
– Email address or anonymous submission details (if you choose to remain anonymous)
– Any personal information you voluntarily include in your message
– Metadata of uploaded files (we strip most metadata before storage)
d. When you apply to work with us or collaborate
– Name, email, CV/portfolio details, cover letter, phone number (if provided)
– Any additional information you share in your application
e. When you donate
We do not process payments directly. Donations are handled by trusted third-party platforms (e.g., Stripe, PayPal, or foundation grant systems). We receive only your name, email, donation amount, and date — never full payment card details.
3. How we use your information
We use your data only for the following purposes:
– To send you our newsletter and updates about investigations (if you subscribed)
– To communicate with you about tips you submitted
– To review and respond to job/collaboration applications
– To improve website functionality and security
– To generate aggregated, anonymized statistics about site usage
– To comply with legal obligations (e.g., accounting for donations)
We never sell, rent, or trade your personal data to third parties for marketing purposes.
4. Legal basis for processing
– Newsletter subscription → Consent (you can withdraw at any time)
– Tip submissions → Legitimate interest (protecting sources and fulfilling journalistic purpose) + Consent (where you provide contact details)
– Job applications → Steps taken at your request prior to a potential contract
– Website analytics (minimal) → Legitimate interest (understanding how our site is used to improve public-interest journalism)
5. How long we keep your data
– Newsletter subscribers: Until you unsubscribe or request deletion
– Tip submissions: As long as necessary for journalistic purposes (may be kept indefinitely if part of an active or archived investigation; anonymized where possible)
– Job applications: 12 months after the recruitment process ends (unless you consent to longer storage for future opportunities)
– Server logs: Up to 12 months
6. Who we share data with
We share personal data only when strictly necessary:
– With our email service provider (e.g., Mailchimp or similar privacy-respecting platform) for sending newsletters
– With secure hosting and cloud storage providers located within the EU/EEA
– With legal authorities only if required by law and after careful legal review
– In extremely rare cases, with journalistic partners when a tip directly relates to a collaborative investigation (we always protect source identity unless you explicitly authorize sharing)
All third parties we work with are bound by strict data protection agreements and are located in the EU/EEA or provide equivalent safeguards.
7. International transfers
We strive to keep all data within the European Economic Area (EEA). If a service provider is located outside the EEA, we use Standard Contractual Clauses or other approved safeguards.
8. Your rights
Under the GDPR you have the right to:
– Access your personal data
– Correct inaccurate data
– Request deletion (“right to be forgotten”)
– Restrict processing
– Object to processing
– Data portability
– Withdraw consent at any time (does not affect lawfulness of prior processing)
To exercise these rights, email us at: privacy@ecij.org
We will respond within one month (extendable in complex cases). Verification may be required to protect your data.
9. Security
We take reasonable technical and organizational measures to protect your data, including:
– Encryption in transit (HTTPS/TLS) and at rest where appropriate
– Access controls and minimal staff access
– Regular security reviews
– Secure tip submission options (encrypted channels, SecureDrop when available)
However, no system is 100% secure. If a breach occurs that poses a high risk to your rights, we will notify you and the relevant supervisory authority as required by law.
10. Children
Our services are not directed to children under 16. We do not knowingly collect data from children.
11. Changes to this policy
We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Significant changes will also be announced via newsletter.
12. Contact
Questions, concerns or rights requests:
Data Protection Officer (DPO): We are not legally required to appoint a DPO, but privacy matters are handled directly by our core team.
Thank you for trusting ECIJ with your information while we work to make European politics more transparent and accountable.
