Last updated: 22 September 2025

The Under the Brush Stroke (“we,” “our,” or “us”) website aims to raise awareness of the environmental and human rights impacts linked to fossil fuel projects and institutions supported by the global financial services company UBS. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

By accessing or using our website and services, you consent to the data practices described in this Privacy Policy.

Our contact details are:

Center for Energy, Ecology, and Development (CEED)

117 Matatag St.100 Quezon City, Philippines

contact@underthebrushstroke.org

1. Who is concerned by this privacy policy

Every visitor of our website, as well as people who contact us.

2. What information do we handle about you and why?

We handle the hereunder mentioned personal data that we collect directly from you or via cookies (see our cookie policy below).

The data processings which we conduct are there because either you have consented to it, or for our legitimate interests. You can find those reasons and legal bases hereunder.

2.1. When you make use of our website

We use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of our website. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google Analytics to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

This data processing is based on your consent (article 6.1.a of the GDPR).

You have the right to withdraw your consent at any time (see Your Rights hereunder).

You can read more about how we use cookies on our cookie policy.

2.2. When you email us, chat with us or otherwise contact us

We process your contact details, when required, in order to provide you with the requested support. This data processing is based on your consent (article 6.1.a of the GDPR).

Those data are kept as long as you do not oppose it.

2.3. We can also collect data that you otherwise made public in order to contact you when we think it is relevant for your and our business (journalists, service providers, etc.)

This data processing is based on our legitimate interests and aims at creating collaboration in our fields of activities (article 6.1.f of the GDPR).

We retain those data as long as they are relevant.

2.4. When you contact us to make use of your data subject rights

We process your contact details and the proof of your identity you send us in order to address your request. We can also, depending on your request, process other personal data we have collected in order to address your request.

This data processing is for compliance with legal obligations to which we are subject (article 6.1.c of the GDPR).

We will store those data for the duration of one year. This duration aims at having history of the case in case the data subject comes back with further requests. Further, all our emails are achieved for audit purposes for the duration of our audit obligations.

2.5. Reach-out

To deliver our public interest campaign messages, we use advertisement tools provided by social media platforms. These tools offer target-based advertising options including interests, geographical position, age and gender that may be of relevance to reach out to likely interested audiences. When making use of those target-based advertising options, we do not collect the data used by these ads tools. Please note that those tools are not operated by us, therefore, we strongly advise you to review the privacy policies of those websites, too, as we have no control over the content, privacy policies or practices of any third-party sites or services.

This data processing is based on our legitimate interests (article 6.1.f of the GDPR).

2.6. Links to other sites

This website may contain links to third-party websites. We have no control over such websites, do not review them and will not be held responsible for their content. Users who decide to access these third-party links, do so entirely at the user’s own risk and judgement. Users specifically acknowledge that they are solely responsible for what they post or share on this website, as well as on third-party websites and platforms. We have no control over and are not responsible in any way for the content of posts or information shared by users on this website and third-party websites and platforms.

‍

3. How do we protect your personal data?

Your personal data are handled in full confidentiality. We make all necessary effort to take technical and organisational measures that might be required so as to ensure security of your personal data.

‍

4. Use of service providers and transfer to third parties

We do have recourse to service providers to deliver our service.

Those service providers, otherwise referred to as data processors, are third parties who provide elements of support to us. We have contracts in place with our data processors. They cannot do anything with your personal information unless we have instructed them to do so. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. We do not transfer any of your personal data collected, as mentioned above, to any third party for commercial purposes.

‍

5. Your rights

Under the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC) (“GDPR”), you have rights as an individual which you can exercise in relation to the information we hold about you:

Right to request access to your data and rectification of your personal data.
Right to request erasure of your data (right to be forgotten) in the cases described in article 17 of the GDPR.
Right to obtain from us restriction of processing where there is contestation about the data processing for a period enabling to solve the issue.
Right to data portability.
Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Withdrawing your consent means that we will not make use of your data any longer. However, use made of your data in the past remains valid.

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on our legitimate interests (article 6.1.f of the GDPR). To exercise your rights, please send us an email address to contact@underthebrushstroke.org together with a proof of your identity. Please note that you always have the right to lodge a complaint with the Data Protection Authority of the European country of your choice.

‍

Cookie Policy

This Cookie Policy explains what cookies are and how we use them, the types of cookies we use i.e, the information we collect using cookies and how that information is used, and how to manage the cookie settings.

‍

What are cookies?

Cookies are small text files that are used to store small pieces of information. They are stored on your device when the website is loaded on your browser. These cookies help us make the website function properly, make it more secure, provide better user experience, and understand how the website performs and to analyze what works and where it needs improvement.

‍

How do we use cookies?

As most of the online services, our website uses first-party and third-party cookies for several purposes. First-party cookies are mostly necessary for the website to function the right way, and they do not collect any of your personally identifiable data.

The third-party cookies used on our website are mainly for understanding how the website performs, how you interact with our website, keeping our services secure, providing advertisements that are relevant to you, and all in all providing you with a better and improved user experience and help speed up your future interactions with our website.

‍

Types of Cookies

‍

Manage cookie preferences

You can change your cookie preferences any time by clicking the cookie setting button. This will let you revisit the cookie consent banner and change your preferences or withdraw your consent right away.

In addition to this, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/delete the cookies. Listed below are the links to the support documents on how to manage and delete cookies from the major web browsers.

If you are using any other web browser, please visit your browser’s official support documents.