Legal
Privacy Policy
How we handle your personal data — and the special care we take to protect anyone who contacts us as a source.
Last updated: July 2026
The International Association of Investigative Journalism (“IAOIJ”, “we”, “us”) is committed to protecting your privacy. We are a journalism organisation, so protecting people who share information with us is part of who we are — not an afterthought. This policy explains, in plain language, what personal data we collect through our website and services, why, and what rights you have.
1. Who we are & scope
The IAOIJ is a non-profit association founded in 2011 and headquartered at the Secretariat, Maison de la Presse, Rue de Varembé 3, 1202 Geneva, Switzerland. We are the data controller for personal data processed through iaoij.com and our membership, donation, newsletter and tip services. This policy covers those services. It does not cover independent websites we link to, which have their own policies.
2. Data we collect
We try to collect as little as possible. Depending on how you use our services, that may include:
- Website analytics & advertising: information about your visit — pages viewed, approximate region, referring site, device and browser type, and interactions — collected using Google Analytics 4 and Google Ads (including conversion measurement and remarketing). Depending on your consent choice these tools may set cookies and similar identifiers and share data with Google. See section 6 for the full detail and how to control it.
- Membership applications: your name, contact details, professional information and the material you provide so we can verify your eligibility.
- Donations: your name, email and the details needed to process and acknowledge a gift. Card and bank details are handled by our payment processor, not stored by us.
- Newsletter: the email address you give us, and whether our emails are opened or links clicked, so we can improve them.
- Tip and source submissions: whatever you choose to send us. We ask you to send only what is necessary, and we treat this data with the heightened protection described in section 5.
- Correspondence: messages you send to us and our replies.
3. How we use your data
We use personal data to run the Association and its journalism: to verify and manage memberships; to process donations and issue receipts; to send newsletters and updates you have asked for; to respond to enquiries and tips; to keep our services secure; to understand how our site is used and to measure and promote our public-interest campaigns (analytics and advertising, only where you have consented in regions that require it); and to meet our legal and accounting obligations. We never sell your personal data, and we never use the content of source communications for advertising.
4. Legal basis
Where data-protection law (including the GDPR and Swiss law) applies, we rely on: your consent (for example, to send you the newsletter, which you can withdraw at any time); performance of a contract (to provide membership you have applied for); our legitimate interests in running a secure, effective non-profit and carrying out journalism in the public interest; and legal obligation (for example, financial record-keeping). Journalism carries specific protections in law, and we rely on them where appropriate.
5. Special protection for sources & tips
Information from sources receives the strongest protection we can give it. We encourage encrypted, low-metadata channels — Signal, SecureDrop, PGP email and post — precisely so that we hold as little identifying data about you as possible. We minimise what we collect, store sensitive material encrypted and separately, restrict access to the reporters working on a story, and delete material when it is no longer needed. We do not disclose source information to third parties, and we resist legal and other demands to identify sources to the fullest extent the law permits. See our Leak to us page for how to contact us safely.
6. Cookies, analytics & advertising
We use cookies and similar technologies in three categories:
| Category | Purpose | Set only with consent? |
|---|---|---|
| Essential | Make the site work, remember your cookie choice, and keep it secure. | No — always active |
| Analytics | Google Analytics 4 (measurement ID G-HJ651G4BG3) — helps us understand which pages and investigations are useful, in aggregate. | Yes |
| Advertising | Google Ads (ID AW-18304547909) — measures conversions from, and lets us reach people with, our public-interest and membership campaigns, including remarketing. | Yes |
Analytics and advertising services are provided by Google Ireland Ltd / Google LLC, which acts as our processor (for measurement) and, for advertising, as an independent controller under its own Privacy Policy. Google may set cookies and process identifiers (including your IP address and device data) to provide these services; this can involve a transfer to the United States under appropriate safeguards (see section 8).
Your consent controls this. We use Google Consent Mode v2. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising cookies are disabled by default and are only enabled if you choose “Accept all” on our cookie banner. Elsewhere they are enabled by default, and you may opt out with “Reject non-essential.” You can change or withdraw your choice at any time using the Cookie preferences link in the footer of every page. You can also block or delete cookies in your browser; essential functions may be affected, but you can still read the site. To opt out of Google Analytics specifically, you can install Google’s opt-out browser add-on, and you can manage ad personalisation in your Google Ad Settings.
7. Sharing your data
We do not sell or rent personal data. We share it only with trusted service providers who process it on our behalf and under contract — for example, a payment processor for donations, an email provider for the newsletter, hosting and infrastructure providers, and Google for website analytics and advertising (see section 6). These providers may act only on our instructions, except where, for advertising, Google acts as an independent controller under its own terms. We may also disclose data if strictly required by law, but we will resist any demand that would compromise a source and will challenge overbroad requests.
8. International transfers
We are a global organisation and some of our providers operate in other countries. Where personal data is transferred across borders, we take steps to ensure it remains protected — for example, using providers in countries with recognised protections or contractual safeguards such as standard data-protection clauses.
9. Retention
We keep personal data only as long as we need it for the purpose it was collected, or as long as the law requires (for example, financial records). Newsletter data is kept until you unsubscribe. Source and tip material is kept only as long as it is needed for the reporting and is then securely deleted, unless retaining it is necessary to protect the source or the public interest.
10. Your rights
Depending on where you live, you have rights over your personal data, which may include the right to access the data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, to withdraw consent, and to data portability. To exercise any of these, email privacy@iaoij.com. We will respond within the time the law allows. Some data is exempt where it relates to journalistic activity or the protection of a source. You also have the right to complain to your local data-protection authority.
11. Security
We use technical and organisational measures to protect personal data, including encryption in transit, access controls, and heightened safeguards for the most sensitive material. No system is perfectly secure, but we design our processes so that a breach exposes as little as possible — and this is exactly why we ask sources to reach us through encrypted channels.
12. Children
Our services are intended for adults and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you. Continued use of our services after a change means you accept the updated policy.
14. Contact us
Questions about this policy or your data? Email privacy@iaoij.com or write to: Data Protection, IAOIJ Secretariat, Maison de la Presse, Rue de Varembé 3, 1202 Geneva, Switzerland. For our terms, see the Terms of Use.