To whose personal information does this Notice apply?

This Notice describes our practices when using:
• the personal information of individuals who use the GANHRI Fuse Knowledge Management Platform (“the Platform”);
• the personal information of the stakeholder contacts of GANHRI (for example, employees of GANHRI members, conference and event attendees, employees of suppliers etc.); and
• the personal information of individuals who may visit our websites or social media sites.

Data collection and usage

We will collect store and use your personal information for the purposes set out in more detail in this section.
Certain types of personal information are more sensitive than others. “Sensitive information” about you includes information about health, disability, race, ethnicity, criminal offences (or alleged offences), political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data and data concerning sex life or sexual orientation.
We may collect and receive sensitive information about you. We have identified here the types of sensitive information we may collect or receive, how we will use it and why we will use it.
Your information may be shared with some third parties as is set out in more detail below.

Information we collect about Platform users

We collect personal information (which does not contain sensitive information) directly from Platform users and from National Human Rights Institutions who are proposing users for the Platform including:
• contact information such as name, job/academic title, address, email, telephone number and employer;
• images uploaded by Platform users for the purposes of identifying each other;
• information about your communications sent through the Platform, including contact details, details of the content of your communications, details about when you sent a communication and when we received it;
• information provided as part of your Platform account, such as username, password, account settings, account preferences and email address;
• information we collect through your use of the Platform including device information, hardware and browser settings, date and time of requests, the requests you make, the pages you visit and IP address; and
• information captured by our cookies.

How we use the personal information we collect about Platform users

We use personal information from Platform users for certain activities, including:
• to decide whether to accept an individual as a Platform user and to on-board you as
a Platform user;
• to verify your Platform user login details;
• to identify how you would like to use your account;
• to promote formal training, informal learning and knowledge sharing through the
Platform;
• to develop new Platform services based on what we learn from your activity and the
activity of other users, as well as the feedback you provide and the information and
feedback provided by others;
• to improve the services provided through the Platform and efficiency of service
delivery to help us meet your needs and expectations;
• to understand and respond to user feedback and answer any issues or concerns, to
communicate with you regarding your account and our services and to monitor
communications with you for quality and training purposes;
• to administrate, monitor and manage the activities taking place on the Platform;
• to monitor, investigate and report any attempts to breach the security of the Platform;
• to monitor the way the Platform is used (including locations it is accessed from,
devices it is accessed from, understanding peak usage times and analysing what
functionality and information is most and least accessed);
• to maintain and build relationships with Platform users and the organisations
represented by Platform users; and
• to provide newsletters and mailings about our activities.

Why we use the personal information of Platform users

We use this information because:
• it is necessary to enter into or perform our contract with you – for example, using a
Platform user’s contact details and to supply the training they want to take part in;
• it is necessary to comply with legal or regulatory requirements – for example,
disclosure of information to law enforcement;
• we have collected your consent – for example, in order to send you newsletters and
mailings about our activities and to use cookies when you visit our Platform. You can
withdraw your consent at any time (in your account preferences or settings) or by
contacting us using the contact details in the “Who we are” section above or by or
unsubscribing from our newsletters and mailings;
• it is necessary for the purposes of our or a third party’s legitimate interests. A
legitimate interest will apply only where we consider that it is not overridden by a
Platform user’s interests or rights which require protection of their personal data. We
have legitimate interests to use your information in:
• allowing GANHRI members to exchange good practices, knowledge and
training on a regular basis;
• understanding how our members use the Platform;
• monitoring, investigating and reporting any attempts to breach the security of
the Platform;
• improving the performance and user experience of the Platform;
• performing our obligations under our contracts with our users;
• managing our business by responding promptly to complaints;
• sending newsletters and mailings about our activities to Platform users;
• maintaining suppression records to ensure we have a record of your objection
to newsletters and mailings about our activities (if given); and
• building and maintaining ongoing relationships with the individuals and
human rights organisations who use the Platform.
If you require further information regarding our legitimate interests, please contact us using
the contact details in the “Who we are” section above.

Recipients of Platform user information

We may disclose Platform user information as follows:
• to other individuals or organisations who are members of GANHRI (for the full list,
please visit: https://nhri.ohchr.org/EN/Contact/NHRIs/Pages/default.aspx)
• to our United Nations partners, including our Secretariat, the Office of the High
Commissioner for Human Rights, and the United Nations Development Fund;
• to third parties who work on our behalf to service or maintain the Platform, and
systems processing account information, such as supplier systems supporting the
Platform;
• to our professional advisers or suppliers (such as auditors and lawyers);
• to competent authorities such as tax authorities, courts, regulators and security or
police authorities where required or requested by law or where we consider it
necessary; and
• if we are defending a legal claim your information may be transferred as required in
connection with defending such claim.

Information we collect about our stakeholder contacts

We may collect personal information directly from our stakeholder contacts, such as
professional advisers, staff consultants, suppliers and event attendees and also from third
parties such as National Human Rights Institutions. This information may include:
• contact information such as name, job/academic title, address, email, telephone
number;
• identification information such as date of birth, gender, passport and visa details;
• financial information including bank account details for reimbursements for event
attendees and payments made to suppliers;
• image capturing, such as photos taken at events, videos and CCTV footage;
• communications with our stakeholder contacts;
• events data, including which stakeholder contacts have attended events;
• information that we collect incidentally from other sources or public sources, including
information available in the media, information presented on our social media or
wider social media platforms including Facebook, Twitter and Instagram and
information collected by security systems; and
• sensitive information such as certain dietary requirements that imply specific religious
beliefs or medical conditions and health data concerning disabilities.

How we use the personal information we collect about stakeholder contacts

We use personal information from our stakeholder contacts for certain activities, including:
• to organise conferences, workshops, training sessions and other events, including
reimbursements for event attendees;
• to communicate about our activities;
• to maintain and build upon member and supplier relationships;
• for internal analysis and research to help us improve our services;
• to decide whether to accept any person as a member or supplier;
• to keep records of transactions for the purpose of ensuring that the required
payments and/or deliveries are made or services provided;
• to comply with contractual, legal and regulatory obligations;
• to ensure the security of our premises, our event premises and our employees, and
to prevent crime;
• to fulfil a transaction initiated by us or a stakeholder contact; and
• to facilitate the smooth running of the organisation through communication about the
goods and services we obtain from our suppliers.

We use the sensitive information we collect from you for certain activities, including:
• to organise logistics for our events, for example, to provide for accessibility needs for
attendees living with disabilities or to cater for specific dietary requirements; and
• to comply with security requirements for events, including for events held in United
Nations premises.

Why we use the personal information of our stakeholder contacts

We use this information because:
• it is necessary to enter into or perform our contract with you – for example, using your
contact details and payment details to pay for or receive payment for goods and
services;
• it is necessary to comply with legal or regulatory requirements – for example,
disclosure of information to law enforcement;
• we have collected your consent – for example, in order to send you newsletters and
mailings about our activities. You can withdraw your consent at any time by contacting
us at the contact details in the “Who we are” section above or unsubscribing from our
newsletters and mailings; or
• it is necessary for the purposes of our or a third party’s legitimate interests. A
legitimate interest will apply only where we consider that it is not overridden by a
stakeholder contact’s interests or rights which require protection of their personal
data. We have the following legitimate interests to use your information:
• understanding how our stakeholder contacts use and provide our services;
• providing and improving our services, including understanding and
responding to feedback from event attendees;
• personalising our services so we are better able to provide services and ideas
that are relevant to our stakeholder contacts;
• organising events, including to ensure adequate representation and/or
quorum for meetings of governance bodies and to comply with security
requirements at certain event premises;
• ensuring the security of our organisation and premises;
• developing and maintaining relationships with suppliers and our member
institutions;
• ensuring network and information security;
• newsletters and mailings about our activities to stakeholder contacts;
• maintaining suppression records to ensure we have a record of your objection
to newsletters and mailings about our activities (if given); and
• verifying stakeholder contact (including supplier) details.
If you require further information regarding our legitimate interests, please contact us using
the contact details in the “Who we are” section above.
We will use your sensitive information (including health data) where:
• we have your explicit consent for the relevant purpose. You can withdraw your
consent at any time by contacting us using the contact details in the “Who we
are” section above;
• this is necessary to protect your vital interests in an emergency or those of another
person;
• the relevant information has been made public by you;
• this is necessary or in connection with legal claims or court proceedings.

Recipients of stakeholder contact information

We may disclose personal information of stakeholder contacts to third parties as follows:
• to other individuals or organisations who are members of GANHRI (for the full list,
visit: https://nhri.ohchr.org/EN/Contact/NHRIs/Pages/default.aspx)
• to our United Nations partners, including our Secretariat, the Office of the High
Commissioner for Human Rights, and the United Nations Development Fund;
• to our professional advisers, suppliers or service providers (such as auditors, lawyers,
hotels and travel agents);
• to third parties including for the purpose of event management;
• to assignees and payees;
• to suppliers and/or providers of goods and services and other third parties who work
on our behalf to service or maintain stakeholder contact databases and other IT
systems, such as suppliers of the IT systems which we use to process personal
information, or who provide other technical services, such as printing;
• to competent authorities such as tax authorities, courts, regulators and security or
police authorities where required or requested by law or where we consider it necessary; and
• if we are defending a legal claim your information may be transferred as required in connection with defending such claim.

Information we collect about our website and social media site users

The categories of information we collect about users of our website and social media sites
directly from the users and through our United Nations partners include:
• information users provide when they enter information on our website, such as when they provide contact details (for example, through a “Contact Us” form), fill out feedback forms or applications for employment, including the content of communications to and from you;
• information provided when users subscribe to email newsletters and other mailings, such as name, email address, job title and mailing preferences;
• information users provide when posting content on social media sites and information in their social media bio;
• information captured on our web logs such as device information, unique identification numbers (e.g. IP addresses), browser information, the date and time of requests, the requests you make, the pages you visit and search engine terms you use;
• information captured by our cookies.

How we use the personal information we collect about our website and social media site users

We use personal information from our website and social media site users for certain activities, including:
• to connect our member institutions and encourage collaboration and knowledge sharing;
• to organise events through the website and social media;
• to enable website and social media site users to sign up to newsletters and mailings about our activities;
• to compile contact lists of publicly available contact details of individuals at our member institutions;
• to provide information about our work and activities;
• to monitor social media content to manage relations with our members and promote GANHRI;
• if there is an interaction on a social media site with a third party social media user that we consider that we should react on;
• to enable individuals to submit online applications for jobs to our organisation;
• to manage applications for employment received through our website;
• to administer the website, respond to questions and feedback and to investigate any complaints;
• to monitor the way our website is used (including locations it is accessed from, devices it is accessed from, understanding peak usage times and analysing what functionality and information is most and least accessed);
• to provide website users and individuals accessing our web pages on social media sites with information about our services that may be of interest to them and to manage their preferences; and
• to perform statistical and trend analysis to improve the user experience and performance of our website.

Why we use the personal information of our website and social media site users

We use this information because:
• it is necessary to comply with legal or regulatory requirements – for example, disclosure of information to law enforcement;
• we have collected your consent – for example, in order to send you newsletters and mailings about our activities and to use cookies when you visit our website. You can withdraw your consent at any time by contacting us at the contact details in the “Who we are” section above or unsubscribing from our newsletters and mailings; or
• it is necessary for the purposes of our or a third party’s legitimate interests. A legitimate interest will apply only where we consider that it is not overridden by a website or social media user’s interests or rights which require protection of their personal data. We have the following legitimate interests to use your information:
• promoting our services and the work we do through our website and other communications;
• monitoring, investigating and reporting any attempts to breach the security of our websites;
• improving the performance and user experience of our website;
• maintaining a public profile through our website and on social media;
• assessing the number of visitors, posts, page views, reviews and followers in order to understand the services our website and social media users are interested in and to optimise future marketing campaigns;
• developing and maintaining relationships with our member institutions;
• managing our organisation by monitoring our public profile and responding promptly to complaints or feedback;
• sending newsletters and mailings to website and social media users for the legitimate purposes of promoting our organisation; and
• maintaining suppression records to ensure we have a record of your objection to newsletters and mailings about our activities (if given).
If you require further information regarding our legitimate interests, please contact us using the contact details in the “Who we are” section above.

Recipients of website and social media site user information

We may disclose personal information of website and social media users as follows:
• to other individuals or organisations who are members of GANHRI (for the full list, visit: https://nhri.ohchr.org/EN/Contact/NHRIs/Pages/default.aspx)
• to our United Nations partners, including our Secretariat, the Office of the High Commissioner for Human Rights, and the United Nations Development Fund;
• to third parties providing services to us, such as our professional advisors (e.g. auditors and lawyers);
• to competent authorities such as tax authorities, courts, regulators and security or police authorities where required or requested by law or where we consider it necessary;
• to third parties who work on our behalf to service or maintain our website and social media sites, such as supplier systems; and
• if we are defending a legal claim your information may be transferred as required in connection with defending such claim.

Legal requirements

In certain circumstances, where a Platform, website or social media user or stakeholder contact does not provide personal information which is required (for example, login details to access the Platform or payment details in the case of sole trader suppliers), we will not be able to perform our obligations under the contract with them or may not be able to provide them with our services. We will make it clear if and when this situation arises and what the consequences of not providing the information will be for you.
Your personal information may also be processed if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency or in the defence of a legal claims. We will not delete personal information if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

Security

We are committed to keeping your personal information safe. We have physical, technical and administrative measures in place to prevent unauthorised access or use of your information. For more information about the security measures please contact our office at: info@ganhri.org

How long do we keep your information

We will keep your information for as long as it is reasonably necessary. It will depend on factors such as whether you are registered to attend events with us in the future or whether have responded to or interacted with our recent communications. We will also retain your information as necessary to comply with legal, accounting or reporting requirements. If you would like more information on our data retention periods, please contact us using the contact details in the “Who we are” section above.
We will also routinely refresh our information to ensure we keep it up-to-date.

Where your information will be held

Your information may be transferred outside the European Economic Area (EEA). We will store information on cloud servers located in Ireland and the United States. There is an adequacy decision by the European Commission in respect of any US cloud storage vendor in the form of the EU-US Privacy Shield Framework. In addition, there is a Swiss-US Privacy Shield Framework. If a vendor is a member of the Privacy Shield Framework, this means that the organisation to which we transfer your data is deemed to provide an adequate level of protection for your personal information.
Your personal information may also be transferred to our member institutions, including via the Platform. For the full list of GANHRI members and the countries that they are based in, visit: https://nhri.ohchr.org/EN/Contact/NHRIs/Pages/default.aspx.
If you would like more information on our safeguards for transferring your data outside of Switzerland or the EEA, please contact us using the contact details in the “Who we are” section above.

Your Rights

You may have certain rights in relation to your information – in particular, if you are based in the European Economic Area. The availability of these rights and the ways in which you can use them are set out below in more detail.
Some of these rights will only apply in certain circumstances. If you would like to exercise, or discuss, any of these rights, please contact us using the contact details in the “Who we are” section above.
• Consent: you have the right to withdraw your consent at any time by using the contact details in the “Who we are” section above.
• Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you and certain other information about it.
• Correction: you are entitled to request that any incomplete or inaccurate personal information we hold about you is corrected.
• Erasure: you are entitled to ask us to delete or remove personal information in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.
• Restriction: you are entitled to ask us to suspend the processing of certain of your personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Transfer: you may request the transfer of certain of your personal information to another party.
You also have a right to lodge a complaint with a supervisory authority, in particular in the Member State in the European Economic Area where you are habitually resident or where your place of work is based, where we are based or where an alleged infringement of data protection law has taken place.Right to object

Right to object

You have a right to object to us processing your information in certain circumstances. Where we are processing your personal information based on a legitimate interests you may challenge this. However we may be entitled to continue processing your information based on our compelling legitimate grounds or where this is relevant to legal claims. You also have the right to object where we are processing your personal information for direct marketing purposes, such as sending newsletters and mailings about our activities (see also the “Newsletters and Mailings” section below). You can ask us to stop processing your information at any time. In certain circumstances we may not be able to do this or may not be required to do this. For example, if the information is relevant to legal claims.

Newsletters and Mailings

We may use the information you give us on our website, social media sites and Platform to provide newsletters and mailings about our activities. We will only do this with your consent (where required by law).
You can opt-out of receiving newsletters and mailings from us at any time. You can do this by changing your preferences, clicking on the “unsubscribe” link included at the end of any email we send to you, or by contacting us using the contact details in the “Who we are”section above.

Links to third party website

Our website, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others including our member institutions and/or social networks as offered to you and supported by your browser.
The personal data that you provide through these websites is not subject to this Privacy Notice and the treatment of your personal data by such websites is not our responsibility. If you follow a link to any of these websites, please note that these websites have their own privacy notices which will set out how your information is collected and processed when visiting those sites. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy notices of entities through which you chose to share.

Children

We do not knowingly collect information from children or other persons who are under 18 years old. If you are under 18 years old, you may not submit any personal information to us or subscribe for the services. If you believe we might have any personal information from or about a person under the age of 18, please contact us using the contact details in the “Who we are” section above.