Privacy Notice — Gambia Decides
Version 1.0 · Cubixio Limited
Who we are
Gambia Decides is operated by Cubixio Ltd, a company registered in England and Wales. Cubixio is the data controller for the processing described in Part A and Part B, except where Part C says a Partner Organisation is a joint controller. Contact for privacy matters: privacy@cubixio.co · Cubixio Limited, Collingwood Buildings, 38 Collingwood Street, Newcastle upon Tyne NE1 1JF. Cubixio is registered with the UK Information Commissioner's Office under registration reference ZC220575 (Data Protection Officer: Muhammed Njie, privacy@cubixio.co).
Gambia Decides is a media-monitoring service used by independent civil-society and election-observer organisations in The Gambia ("Partner Organisations") during the 2026 election cycle. It is not a government service and not connected to any political party.
Part A — People whose public statements we monitor (and field observers, see Part B)
This Part is addressed to you if you have posted publicly about Gambian politics on Facebook, X/Twitter, TikTok or YouTube, spoken on Gambian broadcast media (GRTS, QTV, Star TV and others), been quoted or discussed in Gambian news outlets, or are a public figure (candidate, party official, office-holder, journalist, commentator).
Why we can't tell you individually (UK GDPR Article 14(5)(b)). We collect this information from public sources, not from you. The content is high-volume (thousands of posts and comments a day across dozens of pages, groups and outlets), most authors are identifiable only by a handle or page name, and there is no reliable way to reach each author. Notifying each person individually would take disproportionate effort and, for many, would itself require collecting more data about them (contact details) than we otherwise hold. So we publish this notice instead, and we take the extra steps below to protect your interests.
What we collect. Public posts, comments, replies, captions and their metadata (handle, display name, timestamps, engagement counts); public news articles; transcripts of public broadcast bulletins and public video/podcast content; the names and roles of public figures as they appear in that content. We do not collect private messages, private-group content, or anything requiring a login to see, and we do not buy data from brokers.
What we do with it. Automated systems (including AI language models) classify content by topic, tone (sentiment), whether it constitutes an attack, hostility or incitement against an institution or public figure, and how much airtime or coverage each party or candidate receives ("share of voice"). Human analysts at Partner Organisations then review flagged items. Some items may be recorded as incidents or, where they concern the conduct of an institution or public figure (a broadcaster, outlet, party, or office-holder — never a private individual), as possible breaches of electoral or media standards, and may be included in evidence provided to the Independent Electoral Commission or international observer missions.
Special category data. Public political statements can reveal political opinions, and content about inter-community tension can relate to ethnicity. We process this on the basis that you have manifestly made the information public (Article 9(2)(e)), and, for the recording of possible unlawful acts such as incitement or intimidation, on the basis of substantial public interest — preventing or detecting unlawful acts (Article 9(2)(g); Data Protection Act 2018, Schedule 1, Part 2). Our Appropriate Policy Document is available on request.
Lawful basis. Our legitimate interests (Article 6(1)(f)) — and those of Partner Organisations and the Gambian public — in a transparent, peaceful and fairly reported election, and in independent scrutiny of media conduct. We have carried out a legitimate-interests assessment and a data protection impact assessment; summaries are available on request.
What we don't do. We do not make automated decisions about you with legal or similarly significant effects. AI outputs are suggestions to human analysts. We do not sell data. We do not use it for advertising or campaigning. We do not name private individuals in evidence records — the record concerns the responsible institution.
How long. Raw post and comment text: 12 months after the official declaration of results, then deleted; aggregate statistics may be kept indefinitely. Broadcast transcripts and audio: 12 months after the declaration. Records of possible standards breaches by institutions/public figures, and evidence packages: retained as a record of the election cycle in the public interest.
Who sees it. Analysts and staff of Partner Organisations (access-controlled, per organisation); Cubixio staff for operating the service; our processors (Part D). Certified evidence may be shared with the Independent Electoral Commission of The Gambia and, when a Partner Organisation decides to escalate, international observer missions.
Part B — Field observers
If you are a field observer registered by a Partner Organisation, we hold: your Telegram user ID and/or WhatsApp number, your name as registered, your organisation and region, and the reports (text, photos, voice notes) you send. Reports are AI-classified for location, event type and severity, then reviewed by an analyst at your organisation. Your identity is not included in anything that leaves the Platform (escalations show only your organisation and region). Your reports and identifiers are kept for 24 months after the declaration, after which your identifiers are removed. Basis: legitimate interests as above; you can ask to be removed from the observer list at any time via your organisation or privacy@cubixio.co. Observers must be 18 or over.
Part C — Platform users (analysts, administrators, viewers)
We hold your login email, name, organisation, role, and records of your actions on the Platform (what you verified, certified, exported, and when), plus your acceptance of the Terms of Use. Basis: performance of a contract (the Terms) and legitimate interests (security, accountability). Your email address is never visible to other organisations. Data is kept for the life of your account plus 12 months for audit. Your organisation is a joint controller with Cubixio for the field reports, verifications, verdicts and fact-checks your organisation's users create; the arrangement between us is summarised on request.
Part D — Where your data goes
Data is stored and processed in the UK/EU (London) by our database and hosting providers, with website delivery and some processing in the US. AI text analysis is performed by Anthropic, Google and OpenAI: content is sent to them for classification only, and under those providers' API terms it is used to provide the service to us, not for other purposes. We also use messaging providers for observer channels and public-web collection services. Transfers outside the UK are made under UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum, as applicable. The full list of processors and locations is available on request from privacy@cubixio.co.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to our processing, and to complain to the ICO (ico.org.uk) or, in The Gambia, to the Information Commission once operational. Email privacy@cubixio.co; tell us the handle/name we would know you by. We may need to verify your identity. Some rights are limited where the data is public-interest evidence of election-related conduct or is needed for legal claims; we will explain if that applies.
Last updated: 18 August 2026 · Version 1.0