13Records and Privacy

13.1 Principles

13.1.1 墨门 / The Mohist Community records only what its work requires and does that work with the least data possible. Every new record must answer one question: if we did not keep this, what could we not do?

13.1.2 A record belongs to the person it describes. The Community is its keeper, not its owner.

13.1.3 This chapter is written with the GDPR and China's Personal Information Protection Law (PIPL) in view. Where local law is stricter, local law governs.

13.2 What is recorded

13.2.1 The Community keeps the following:

1. The membership roll: name, chapter, date of joining, contact details, date of leaving.
2. 职 history: every assignment a Mohist has held, its dates, and any 非攻 Corps training track completed (chapters 7 and 10).
3. Care pairs (兼爱结对): who is paired with whom and the date of each check-in (chapter 8) — dates only, never content.
4. The 兼爱基金 ledger: date, amount, category and handler of every receipt and payment (chapter 9).
5. Attendance counts: how many people came to each meeting, without names.
6. Parental consent forms for youth activities and the protection rules signed by leaders (chapter 11).
7. Written decisions in discipline and appeals (chapter 14).

13.2.2 Each record has a named keeper: the roll and 职 history are kept by a recorder appointed by the 社长 (chapter lead); the ledger by the treasurer; care-pair records by the care-pair coordinator.

13.3 What is never recorded

13.3.1 The following appear in no central record of the Community and in no chapter record:

1. The content of care-pair conversations. A care partner may keep private notes; they are never handed in or filed.
2. A Mohist's health, unless the Mohist writes it down themselves and asks for it to be kept (for instance for emergency contact).
3. A Mohist's beliefs, religion, political views or sexual orientation.
4. Individual contribution amounts, other than in the treasurer's ledger.
5. Absences.

13.3.2 What a leader learns in private conversation goes into no record and is not passed to other leaders, except where the reporting duties of 13.7 or 11.4.5 apply.

13.4 The rights of every Mohist

13.4.1 Access and export: any Mohist may at any time ask to see everything the Community holds about them and to receive it in a common format such as CSV or PDF. The chapter provides it within thirty days.

13.4.2 Correction: a Mohist may ask for an inaccurate record to be corrected. The chapter corrects it within fourteen days or explains in writing why it cannot.

13.4.3 Deletion: when a Mohist leaves the Community, their roll entry, 职 history, care-pair records and contact details are deleted within ninety days. The single exception is the 兼爱基金 ledger: entries involving the member are retained for seven years, because audit and the law require a complete ledger.

13.4.4 A Mohist who stays may also ask for any non-essential information other than contact details to be deleted.

13.4.5 No reason need be given for exercising these rights, and doing so has no effect on membership or on any 职.

13.5 Access by role

13.5.1 A record is open only to those who need it to do their work:

| Record | Who may see it | |--------|----------------| | Membership roll | The chapter's 社长 and recorder; the region sees numbers only | | 职 history | The member, the 社长, the region | | Care-pair list and dates | The member, the care-pair coordinator, the 社长 | | Ledger | The treasurer, the 社长, the reviewer; the quarterly statement is public | | Parental consent forms | Youth leaders, the 社长 | | Discipline decisions | The member, the panel, the appeal body |

13.5.2 The 鉅子 (Juzi) and the 墨门理事会 (the Council) see aggregate figures, not individual records, unless an appeal before them requires it.

13.5.3 Access ends on the day a person leaves the 职 that gave it.

13.6 Retention

13.6.1 A member's records are kept until ninety days after they leave. The ledger is kept for seven years. Parental consent forms are kept until one year after the minor turns eighteen. Discipline decisions are kept for five years and then destroyed; a decision that is overturned is destroyed at once. Attendance counts and quarterly statements may be kept indefinitely, since they contain no personal information.

13.6.2 Expired records are actually deleted or destroyed. They are not kept "as a backup."

13.7 Breach procedure

13.7.1 Anyone who discovers that a record may have reached an unauthorized person, been lost or been sent in error tells the 社长 and the region (墨区) immediately.

13.7.2 Within seventy-two hours the region assesses the impact, notifies the affected Mohists — what was exposed, the likely consequences, what has been done — and notifies the authorities where local law requires.

13.7.3 Every breach is written up and filed with the region, and reported at the next meeting of the Council.

13.8 No selling, no sharing

13.8.1 The Community does not sell, rent, exchange or otherwise give a Mohist's information to any third party, including partner organizations, fundraising platforms and businesses.

13.8.2 Any software or cloud service the Community uses is covered by a written agreement that the data is used only for the Community's purposes and deleted when the Community asks.

13.8.3 Disclosure required by law is handled by the region with legal advice, and the person concerned is told where the law permits.

13.9 Photographs and video

13.9.1 Photographs and video taken at Community activities are published only with the consent of every identifiable person in them; for minors, with a parent's written consent (11.4.4).

13.9.2 Any meeting may set aside a no-photo area. Anyone may ask for a published image of themselves to be removed, and the chapter does so within fourteen days.