1. What Personal Data is processed
Personal Data is all information relating to an identified or identifiable natural person. The Personal Data processed by the Association includes: First name and last name, email address, institution / or organisation and country of residence, for student members : the name and email address of their academic supervisor or department head, any information voluntarily submitted through our contact form, any supporting documentation voluntarily submitted for the purpose of verifying student membership eligibility, payment-related information processed by our payment provider, Stripe (the Association itself does not store any card or bank details).
2. What Personal Data processing means
Any operation relating to Personal Data, regardless of the means or process used, including collection, recording, storage, use, modification, disclosure, archiving, deletion, or destruction of data.
3. Who processes the Personal Data
The data controller is the International PBPK Nexus, [non-profit organization], registered at [Faculté de Médecine, Centre Médical Universitaire, 1 rue Michel Servet, 1206 Genève, Switzerland].
Email: [info@pbpknexus.com]
4. Why we collect and process Personal Data
Personal Data is collected only for specific purposes recognisable to the User and is processed in a manner compatible with those purposes. The Association ensures, through appropriate default settings, that processing is limited to the minimum required for the purpose pursued. The Personal Data collected may be used to:
Process and manage membership applications and renewals;
Verify student membership eligibility, including by reviewing supporting documentation submitted for this purpose;
Maintain the Association's membership records;
Process membership payments via our payment provider, Stripe;
Communicate with members regarding the Association's activities, including the annual International PBPK Conference;
Respond to enquiries submitted through our contact form;
Comply with any applicable legal or regulatory obligation;
Establish, exercise, or defend the legal rights of the Association.
5.Who we are the recipients of Personal Data
5.1 The Association. Authorised administrators of the Association may access Personal Data strictly to manage memberships and respond to enquiries.
5.2 Sub-processors. The Association relies on the following third-party service providers to operate its Services:
Stripe (payment processing for membership fees) — Stripe acts as an independent data controller for payment data; please refer to Stripe's own privacy policy at stripe.com/privacy. Personal Data processed by Stripe may be transferred to and processed in the United States. Stripe has certified its compliance with the Swiss-U.S. Data Privacy Framework, which provides the applicable safeguard for transfers of personal data from Switzerland to the United States.
Fillout (form creation and processing of membership, registration and contact form submissions). Fillout stores Personal Data relating to end users in the United States.
Microsoft (Microsoft Excel Online, with files stored on SharePoint, for the storage and management of membership, registration and contact form data and, where applicable, uploaded supporting documents). Personal Data processed by Microsoft may be transferred to and processed in the United States. Microsoft Corporation has certified its compliance with the Swiss-U.S. Data Privacy Framework, which provides the applicable safeguard for transfers of personal data from Switzerland to the United States.
Framer (website hosting) Framer's hosting infrastructure includes servers in the United States, with additional hosting infrastructure in Europe and Asia-Pacific. Where Personal Data is transferred outside Switzerland or the EEA, Framer applies an appropriate transfer mechanism, including the Swiss-U.S. Data Privacy Framework or the Standard Contractual Clauses, as applicable.
These providers process Personal Data on behalf of the Association where applicable and are subject to appropriate contractual and/or legal data protection safeguards.
A full list of sub-processors is available upon request at [info@pbpknexus.com].
5.3 Legal authorities. The Association may disclose Personal Data to public authorities, law enforcement agencies, or courts where reasonably necessary to comply with a legal obligation or a binding legal request.
5.4 No commercial use. Personal Data is never sold, rented, or disclosed to third parties for marketing or advertising purposes.
5.5 Cookies and similar technologies. To optimise your experience on our Website, cookies and similar tracking technologies may be used. These are small files saved in your browser to store certain configurations and data. They are never used to store your Personal Data directly. You may refuse the use of non-essential cookies via the cookie banner displayed on our Website, or in your browser settings. Disabling cookies may affect certain functionalities of the Website. For more details, please refer to our [Cookie Policy] section below.
6. What level of security applies to Personal Data
The Association takes all reasonable and necessary technical and organisational measures to ensure that Personal Data is processed and stored securely, in accordance with this Privacy Policy. Access to membership data is restricted to authorised administrators only.
7. Where is Personal Data processed
Personal Data may be processed in Switzerland, the European Economic Area, the United States and other countries where the Association's service providers operate. In particular:
Stripe may transfer and process Personal Data in the United States. Stripe relies on its certification under the Swiss-U.S. Data Privacy Framework for transfers from Switzerland to the United States.
Fillout stores Personal Data relating to end users in the United States.
Microsoft may transfer and process Personal Data in the United States. The Association uses Microsoft Excel Online, with files stored on SharePoint, for the storage and management of membership, registration and contact form data. Microsoft Corporation relies, where applicable, on its certification under the Swiss-U.S. Data Privacy Framework for transfers from Switzerland to the United States.
Framer hosts its services primarily using AWS infrastructure in the United States, with additional infrastructure in Europe and Asia-Pacific. For applicable international transfers, Framer uses the Swiss-U.S. Data Privacy Framework where available, or Standard Contractual Clauses and other appropriate safeguards where required.
The Association seeks to ensure that any international transfer of Personal Data is carried out in accordance with the applicable requirements of the nFADP and, where applicable, the GDPR.
8. How long Personal Data is retained
The Association retains Personal Data only as long as necessary for the purposes described above — namely, for the duration of an individual's membership, plus a reasonable period thereafter to comply with administrative or legal obligations. Data relating to non-renewed memberships will be deleted or anonymised within [a reasonable period, e.g. 24 months] of the membership's expiry, unless retention is required by law.
9. What rights Users have regarding their Personal Data
Subject to applicable law, Users may request the Association to:
Provide access to their Personal Data;
Rectify inaccurate Personal Data;
Delete their Personal Data;
Obtain their Personal Data in a commonly used electronic format.
Requests can be sent to [info@pbpknexus.com]. The Association will respond within a reasonable timeframe and in accordance with applicable law.
The Association does not knowingly collect sensitive personal data (such as data relating to health, religious or political opinions, or biometric data) through its Services.
This Privacy Policy may be amended at any time. The latest version is always available on this page.
10. Miscellaneous
Users are responsible for the accuracy of the Personal Data they provide and must inform the Association promptly of any change (e.g. change of email address). The Association cannot be held responsible for any consequence resulting from inaccurate, outdated, or incomplete data provided by the User.
If you have any questions or requests regarding this Privacy Policy, please contact us at [info@pbpknexus.com].