Privacy Policy

Introduction

Indigenia Foundation (“we,” “our,” or “us”) respects Indigenous rights to data sovereignty and is committed to protecting the privacy and cultural knowledge of Indigenous communities. This Privacy Policy outlines our commitment to handling data in alignment with Indigenous data sovereignty frameworks, specifically the CARE Principles and OCAP® Principles, ensuring Indigenous control over cultural knowledge, intellectual property, and personal information.

This policy has been developed in consultation with Indigenous communities and will continue to evolve through ongoing dialogue and partnership. We recognize that true respect for Indigenous data sovereignty requires both strong policy frameworks and meaningful implementation.

Data Collection and Use

Personal Data Collection

We collect personal data voluntarily provided by donors, program participants, applicants for scholarships or business support, and event attendees. Information collected may include name, contact details, demographic information, and relevant cultural affiliations.

Cultural Data Collection

Any collection of cultural knowledge, oral histories, language data, and traditional practices will adhere strictly to the cultural protocols and collective consent processes determined by the Indigenous communities involved. We recognize that:

• Cultural knowledge exists within specific contexts and relationships
• Documentation of such knowledge requires adherence to cultural protocols
• Different types of knowledge may have different levels of restriction
• Some knowledge may be seasonally or contextually restricted

Data Sovereignty Principles

Indigenia Foundation adheres to the CARE Principles and OCAP® framework:

CARE Principles:

• Collective Benefit: Data collected will primarily serve the benefit of Indigenous communities, supporting education, economic development, and cultural preservation.
• Authority to Control: Indigenous communities maintain authority over their data and cultural information.
• Responsibility: We commit to transparency, clearly informing communities how their data supports Indigenous self-determination.
• Ethics: Indigenous rights and well-being remain our highest priority throughout the data lifecycle.

OCAP® Principles:

• Ownership: Indigenous communities own data related to their cultural knowledge.
• Control: Communities control all aspects of data management and dissemination.
• Access: Communities have unrestricted access to their data.
• Possession: Communities maintain physical control and protection of their data.

Indigenous Governance Structures

To ensure Indigenous leadership in data governance, Indigenia Foundation will:

1. Establish an Indigenous Data Governance Council with actual decision-making authority regarding data policies, collection procedures, and usage.
2. Ensure diverse community representation on the Council, with members selected through processes determined by the communities themselves.
3. Hold regular governance reviews with communities (at minimum annually) to assess and improve data governance practices.
4. Implement consensus-based decision-making for significant data-related decisions, honoring Indigenous governance traditions.
5. Provide resources and support for Council members to effectively fulfill their governance responsibilities.
6. Create community-specific governance protocols that respect the unique governance structures of each partnering community.

Consent and Governance

Collective Consent

We employ community-level consent processes, ensuring broader collective authorization rather than solely individual consent. This includes:

• Consulting with recognized community authorities and knowledge keepers
• Following community-specific protocols for seeking consent
• Allowing sufficient time for communities to consider consent requests
• Recognizing that consent may be layered or limited to specific contexts
• Acknowledging that consent may be withdrawn at any time

Data Governance Agreements

Formal agreements outlining data ownership, control, access, and protection will be established with each Indigenous community we work with. These agreements will:

• Be developed in collaboration with communities
• Use clear, accessible language
• Clearly articulate community rights and organizational responsibilities
• Include remedies for potential breaches
• Be regularly reviewed and updated

Data Classification Framework

Recognizing that different types of knowledge have different levels of sensitivity, we will work with communities to implement appropriate classification systems:

General Classification Levels:

1. Open Access – Information appropriate for broad sharing with minimal restrictions
2. Community-Shared – Information that can be shared within the community but not externally
3. Restricted – Information with specific access limitations (by gender, role, season, etc.)
4. Sacred/Ceremonial – Highly sensitive information with strict protocols

Each community may adapt this framework according to their own knowledge systems and traditions. The classification of information will always be determined by the source community, not by Indigenia Foundation.

Protection of Cultural Knowledge and Intellectual Property

We recognize the unique nature of Indigenous intellectual property, acknowledging collective ownership and respecting customary laws that govern Indigenous knowledge. Protection mechanisms include:

• Applying Traditional Knowledge (TK) and Biocultural (BC) Labels as determined by communities
• Recognizing and formally acknowledging Indigenous cultural authorities and knowledge holders
• Including specific clauses in agreements that affirm Indigenous intellectual property rights beyond conventional IP frameworks
• Implementing digital protections that respect community-determined access restrictions
• Advocating for broader recognition of Indigenous intellectual property rights in policy and legal forums

Benefit-Sharing Provisions

Indigenia Foundation is committed to ensuring Indigenous communities receive tangible benefits from the use of their data and knowledge:

1. Financial Benefit-Sharing:
   
   • Revenue-sharing for any projects generating income from Indigenous data or knowledge
   • Financial support for community-led data initiatives
   • Scholarships and grants for Indigenous data practitioners
2. Capacity Building:
   
   • Training programs to build community data management capacity
   • Technology transfer to support Indigenous data sovereignty
   • Support for Indigenous-led research and data collection
3. Attribution and Recognition:
   
   • Formal attribution of knowledge contributions in all materials
   • Co-authorship in any publications using Indigenous data
   • Public recognition of Indigenous knowledge systems and methodologies
4. Community-Determined Benefits:
   
   • Flexibility to define benefits according to community priorities
   • Regular assessment of benefit-sharing effectiveness
   • Adjustment of benefit models based on community feedback

Data Security Measures

Technical Security

• Data is securely stored using encrypted digital storage systems
• Access to sensitive cultural and personal data is strictly limited to authorized personnel
• Regular audits and reviews of data handling practices ensure compliance with Indigenous protocols and security standards
• Multi-factor authentication for access to sensitive cultural data
• Regular security updates and vulnerability assessments

Indigenous-Specific Security Measures

• Options for local data storage on Indigenous territories where possible
• Community-controlled access management for cultural data
• Specialized security protocols for highly sensitive cultural knowledge
• Regular security audits with Indigenous participation
• Disaster recovery plans that prioritize cultural data protection

Third-Party Sharing and Transparency

• Information will not be shared with third parties without explicit collective consent from affected Indigenous communities
• Any necessary sharing of data (e.g., with funding agencies or research partners) will be transparently communicated and subject to community oversight
• Third parties receiving data must agree to abide by this privacy policy
• We will maintain a register of all third-party data sharing arrangements, accessible to the source communities
• Communities will be promptly notified of any changes to third-party agreements

Children’s Privacy

• We comply with the Children’s Online Privacy Protection Act (COPPA), not knowingly collecting information from individuals under 13 years without explicit parental or guardian consent
• Special protections are implemented for data relating to Indigenous youth
• Youth-specific data is handled according to both community protocols and applicable legislation
• Youth engagement processes will be developed with community input to ensure age-appropriate consent processes

Community Verification and Reporting

• Data interpretations and outcomes derived from Indigenous data will be verified by communities before public dissemination
• Regular reporting to communities ensures transparency about data usage and outcomes
• Communities will have opportunities to correct, contextualize, or withdraw information
• Reporting formats will be adapted to community preferences, including oral, visual, or written formats

Data Repatriation and Legacy Data

Indigenia Foundation recognizes the importance of returning Indigenous data and knowledge to their communities of origin:

1. Repatriation Commitment:
   
   • Active support for communities seeking to repatriate their data from other institutions
   • Development of protocols for digital repatriation of cultural materials
   • Technical assistance for communities receiving repatriated data
2. Legacy Data Review:
   
   • Audit of existing data holdings to identify materials requiring community consultation
   • Retroactive application of this policy to previously collected data
   • Prioritization of high-value cultural materials for repatriation discussions
3. Institutional Advocacy:
   
   • Partnering with communities to advocate for repatriation from museums, archives, and research institutions
   • Supporting community-led repatriation initiatives
   • Developing best practices for digital repatriation

Historical Context and Relationship-Building

• We recognize past exploitation and power imbalances in research and data collection involving Indigenous peoples
• Our approach emphasizes relationship-building, addressing historical harms, and fostering trust through collaborative and respectful partnerships
• We acknowledge the ongoing impacts of colonization on Indigenous data rights
• We commit to practices that support decolonization and Indigenous self-determination
• We will regularly examine our own practices for colonial assumptions

Dispute Resolution Mechanisms

To address concerns or potential policy violations in a culturally respectful manner:

1. Community-Determined Processes:
   
   • Prioritizing dispute resolution approaches determined by the affected communities
   • Respecting traditional conflict resolution methods where appropriate
   • Ensuring cultural protocols are observed throughout the process
2. Structured Resolution Pathway:
   
   • Initial concern raised with primary organizational contact
   • Escalation to Indigenous Data Governance Council if not resolved
   • Option for neutral third-party mediation if requested
   • Final determination by community leadership for matters of cultural protocol
3. Timelines and Transparency:
   
   • Initial acknowledgment of concerns within 3 business days
   • Regular updates throughout resolution process
   • Documentation of process and outcomes
   • Implementation of remedial measures as determined
4. Continuous Improvement:
   
   • Using dispute patterns to identify policy improvements
   • Regular review of dispute resolution effectiveness
   • Adaptation of processes based on community feedback

Accessibility of Policy

To ensure this policy is accessible to all community members:

1. Multiple Formats:
   
   • Plain language companion version
   • Visual representation of key principles
   • Audio recordings of policy content
   • In-person explanation sessions when requested
2. Indigenous Language Versions:
   
   • Translation into Indigenous languages of partnering communities
   • Culturally appropriate adaptations as needed
   • Work with fluent speakers to ensure accuracy
3. Regular Communication:
   
   • Annual policy review meetings with communities
   • Regular updates on policy implementation
   • Open channels for questions and clarification

Changes to This Policy

This Privacy Policy will be regularly reviewed and updated in consultation with Indigenous communities to ensure continued alignment with Indigenous data sovereignty principles. Any substantive changes will require review and approval by the Indigenous Data Governance Council.

Implementation Timeline and Resources

Indigenia Foundation commits to implementing this policy through the following phased approach:

Phase 1 (Immediate – 3 months):

• Establish initial Indigenous Data Governance Council
• Create plain language and accessible versions of this policy
• Conduct audit of current data practices

Phase 2 (3-6 months):

• Develop community-specific data governance agreements
• Implement enhanced security measures
• Begin data classification process with participating communities

Phase 3 (6-12 months):

• Complete implementation of all policy components
• Conduct comprehensive review of effectiveness
• Make adjustments based on community feedback

Ongoing Resources:

• Dedicated staff for policy implementation
• Training for all staff on Indigenous data sovereignty
• Community capacity-building resources
• Regular implementation progress reports

Contact Information

For any questions or concerns regarding our Privacy Policy or data handling practices, please contact us:

Indigenia Foundation
Santa Fe, New Mexico
Email: policy@indigenia.com
Phone: (505) 216-2234

Data Sovereignty Officer: Ben Guerrero, dataofficer@indigenia.com

We commit to ongoing dialogue with Indigenous communities to ensure our practices remain respectful, transparent, and accountable.