Volunteer Privacy Notice - Library of Code, Inc.

Last updated: October 2026

This notice explains how Library of Code, Inc. (“LOC”, “we”) handles personal data about the people who volunteer with us and the people who apply to volunteer. It is the Volunteer Privacy Notice referred to in our Volunteer Agreement. Separate notices cover members and users of the services we run.

1. Who Is Responsible

LOC is the controller of your personal data. You can reach us at Library of Code, Inc., 30 North Gould Street, Suite 21543, Sheridan, Wyoming 82801, United States. Privacy requests go to executive@libraryofcode.org.

2. What We Collect

Identity and contact details: your name, email address, Discord identifier, country and time zone, and the role and department you hold with us.
Access and account records: the systems and groups you are given access to, when access was granted or removed, and the multi-factor devices enrolled on your accounts.
Security and audit logs: records of what you do in our systems. As the Volunteer Agreement explains, your actions in our systems are logged, and your access and permissions are reviewed periodically.
Identity verification data, for volunteers who hold privileged access, user-data access, or an officer or director position: the verification result and date; your full, first, and last name; address; the type, issue date, and issuing country of your identity document; the verified email address; and a copy of the identity document. Didit, our verification provider, also holds the document images and selfie you submit, and the IP address and device details it records during verification.
Contribution and conduct records: the attribution of your contributions, including in publicly visible version-control history; and records of conduct matters and corrective action, where any arise.

3. Why We Use It, and on What Legal Basis

We process your personal data to administer your service; to manage access to our systems; to verify your identity where your role requires it; to screen against sanctions and watch lists; to maintain security and audit records and to enforce the Volunteer Agreement and our Code of Conduct; to record and attribute your contributions; and to comply with our legal obligations.

Our legal bases are the performance of the Volunteer Agreement with you; our legitimate interests in operating and securing our systems and protecting the people who use them; compliance with legal obligations; and, where identity verification compares your face with your identity document, your explicit consent.

4. Identity Verification

We verify identity through Didit, to which you submit your identity documents directly. Didit reads your identity document, takes a short selfie to confirm that you are present, compares your face with the photo on the document, and checks your IP address and device for signs of fraud. For some roles it also screens your name against sanctions and watch lists. Didit processes this data on our behalf for the purpose of verification, and also as an independent controller for its own purposes, such as security, fraud prevention, and legal compliance, as described in Didit’s privacy policy.

Verification is required for these roles, and there is no alternative method. Didit will ask for your explicit consent before it compares your face with your identity document. If you do not want to be verified, you can still volunteer in a role that does not require it, but you cannot hold privileged access, user-data access, or an officer or director position.

We hold the verification material listed in section 2 in access-controlled storage limited to the people who need it for verification, security, or compliance purposes. We keep it, and the provider keeps the images, for as long as you serve with us. Within thirty (30) days after your service ends we delete our copy of your identity document and instruct the provider to delete the documents, images, and associated personal data. After that we keep only a record that verification occurred, its date and result, and your verified legal name.

You may ask us to delete your identity documents at any time. If you still hold privileged access, user-data access, or an officer or director position, we may treat that request as a withdrawal from the role that requires verification.

We use service providers that process personal data on our behalf under written terms, including Didit (section 4) and providers of identity, email, hosting, storage, and electronic-signature services. We will provide a current list of our providers on request.

Discord, which we use for day-to-day communication, is an independent platform operating under its own privacy policy, not a provider acting on our behalf.

We disclose personal data where the law requires it, for example in response to a lawful order, and to establish, exercise, or defend legal claims.

6. International Transfers

LOC is established in the United States, and your personal data is stored and processed there. Where we disclose personal data to a service provider in another country, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework and its United Kingdom and Swiss extensions, where the provider is certified) or on Standard Contractual Clauses, a copy of which is available on request.

7. How Long We Keep It

We keep your service record for the duration of your service and for seven (7) years after it ends; the reduced verification record described in section 4 for the same period; and security and audit logs for two (2) years from creation. We keep data for longer only where reasonably necessary to establish, exercise, or defend legal claims or to comply with a legal obligation.

8. Your Rights

If you live in the European Economic Area or the United Kingdom, you have the rights of access, rectification, erasure, restriction, portability, and objection under the applicable General Data Protection Regulation, and you may lodge a complaint with your supervisory authority. If you live elsewhere, you have the equivalent rights available under the data protection law of your country of residence.

Where we rely on your consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

To exercise any of these rights, email executive@libraryofcode.org. We will respond within one month.

9. Changes to This Notice

We may update this notice from time to time. We will publish the current version and tell you by email about any change that materially affects how we handle your data.