Data Protection Policy

We generally process personal data in the following situations: application forms for our projects and activities, applications to volunteer or to work with us, and contact details collected for newsletters and news updates.

The data we process usually includes your contact details, your name, and your answers to questions that help us select participants where places are limited and a selection process is needed.

We use Google Analytics on an anonymised basis to measure traffic on our websites, without being able to identify visitors personally. It looks at collective information such as time spent on the site, the most visited pages and so on.

We only process data that you give us yourself, for example through an application form, and only with your consent. Consent is always given by opting in, by ticking boxes that are never pre-ticked.

Before collecting any personal data, we tell you what we need and ask for your consent. We do not collect your data from third parties, we do not buy it and we do not sell it.

Collecting data must always have a legal basis. We collect your data on the basis of your consent, our legitimate interest, or our legal and contractual obligations.

We use your data for the purposes set out in this policy, namely:

• managing membership and our databases;
• implementing projects, running recruitment and selection processes, including for mobility projects;
• archiving;
• meeting legal obligations;
• sending newsletters and news updates, where we have your explicit consent;
• general, non-promotional communication;
• volunteer management;
• managing European mobilities — in which case your data may be transferred to the partner organisations hosting the mobility you are going to take part in.

When you take part in our activities funded through European programmes, we are normally required to archive data for up to five years. This data is used strictly for archiving and for the purposes you have already consented to.

You can ask us to update your data or to transfer it, depending on the situation. In time, all of this will be possible automatically, online.

You can ask us to tell you what personal data we currently hold about you. You can expect us to hold only the data you have given us yourself, for example by filling in an application form.

You have the right to ask us to erase and destroy the personal data we hold about you. In certain cases, however, such a request also means withdrawing from an activity. If you ask us to delete your data during a selection process, for example, we will treat this as your withdrawal from that process, because otherwise we would be unable to handle your application. This request cannot be made where we process your data under a legal obligation.

We use online services to store your data, for example, Google Apps / Drive, Dropbox and MailChimp. Other apps might be used, including AI-enabled apps, only with GDPR-compliant services and on organisational licences. Your data is stored in the cloud and we make sure it is protected to high security standards. Dropbox, for example, encrypts files to banking-level security.

We store your data strictly for the purpose you gave us your consent for, and access is granted only to the people whose work directly serves that purpose.

We keep data on paper only where this is mandatory or strictly necessary — for accounting purposes, for instance, when we have reimbursed your travel costs. Where we otherwise need to print data that is stored online, it is used for a very short time, strictly for that purpose, and destroyed afterwards: printing a volunteer application form for a selection interview, for example.

We want a relationship of trust with the people we serve in our community, and we want that trust to work both ways. We are therefore committed to protecting your personal data and using it strictly for the purpose you entrusted it to us for.

Before we use any service to collect, store or process your data, we check whether it complies with the European Union's GDPR. We are committed to using only services that comply with European legislation.

You give us your data because you trust us. We will therefore not transfer your data to countries that do not provide an adequate level of protection, we will not sell it or pass it to another organisation without your consent, and we will not use it for illegitimate purposes or for purposes you have not consented to.