This privacy notice explains how we process personal data in our operations.
If you have any questions about this privacy notice, feel free to contact us at:
Organization: Future Earth
Address: PO Box 270046, Fort Collins, CO 80527, United States
We take your privacy seriously and we have taken several steps to ensure that we provide you with clear and transparent information on how we process your data, and also inform you about your rights. If you feel that any information is unclear, or missing, please do not hesitate to contact us.
At a glance:
- Your data protection rights
- How we get your personal data
- Purpose, lawful basis and retention periods
- Details on the processing of your personal data
- Whom we share your personal data with
- Transfer of personal data outside the EU/EEA
Your data protection rights
- Your rights of access and rectification: You may request access to or a copy of the information we process about you and ask us to rectify any incorrect data.
- Your right to erasure or restriction: In some circumstances, you may ask us to delete and/or restrict our processing of your data, but we cannot delete any data we are required to process.
- Your right to object to processing: In some circumstances, you may ask us to stop processing your data.
- Your right to data portability: In some circumstances, you may ask us to transfer your data to you or to another organisation.
- Also, if you’re unhappy about how we process your data, you have a right to complain to a national data authority. We hope, however, that you will contact us first so that we can try to resolve the matter for you in a satisfactory way.
Please contact us if you have any questions about or want to exercise one of your rights. You are entitled to a reply within 30 days.
How we get your personal data
We typically process personal data about:
- Members, participants, customers
- Job applicants, employees, former employees
- Current and potential funders and donors
- Vendors, partners
- Website visitors
We process personal data when you:
- serve or participate in a committee, network, or standing/ad-hoc work group
- join our membership
- subscribe to our newsletter
- sign up for or attend our events
- respond to one of our surveys
- receive funding or support from us
- provide us with your contact details, e.g. give us your business card
- contact us via phone, text, email, social media or our website
- buy our products or services
- otherwise use our website
We receive personal data from
- our networks, such as when they nominate you for a leadership role in a committee or to be part of a delegation for an event
- our partners, in order to fulfill an agreed upon activity such as processing event registration or travel on your behalf
It is voluntary to provide us with personal data, but if you choose not to, we may not be able to provide you with our services. We do not rent, buy or sell personal data from or to others, use automated decisions or profiling in the processing of your personal data or process special category data.
Purpose, lawful basis and retention periods
We only process your personal data when we have a purpose and a lawful basis for doing so. Under the GDPR Article 6-1, the lawful bases we rely on, are:
- Your consent
- We have a contractual obligation (contract)
- We have a legal obligation
- We have a legitimate interest
As a rule, personal data should not be processed and kept for longer than necessary to fulfill the purpose for processing.
Your personal data is only retained for as long as we have a purpose and a lawful basis:
- Until you withdraw your consent (e.g. for email and SMS marketing)
- For as long as we have a contractual obligation, and, if applicable, in accordance with accounting and bookkeeping rules and regulations (e.g. for sales)
- For as long as we have a legal obligation; in accordance with accounting and bookkeeping rules and/or other legal requirements and regulations (e.g. for employment)
- For as long as we have a legitimate interest or until you ask us not to process your data in such a way (e.g. marketing to existing customers)
You can always withdraw your consent for any data processing based on consent, and you can also reach out to us at any time if you’d like us to stop processing and/or ask us to delete any of your data.
We have routines in place to ensure that personal data is deleted from all relevant systems when we no longer have a purpose and/or legal basis to continue to process them.
Details on the processing of your personal data
In this section we describe in detail when and how we process your data, for what purposes and our legal grounds to do so (lawful bases). We also specify the retention periods for the processing.
We process personal data when:
You participate in our networks
When you apply, are nominated, or serve on a committee or group within the Future Earth network, we store and process personal data. Depending on the nature of your participation and collaboration, this may include your name, contact details, IP address, and demographic information (such as gender, job position, country of citizenship/residence, research expertise, resume/CV).
The purpose is to be able to organize and mobilize our networks. The lawful basis is f), where the legitimate interests are to be able to contact and collaborate with you, and to inform you of opportunities that we think are of interest to you. We can keep this type of personal data on your involvement for up to 10 years in order to provide a reference/verification should you request it.
You communicate with us
When you contact us or we contact you through our website (contact form, blog comments, chat), e-mail, phone (call, text message), social media and/or give us your business card, we process personal data. Depending on where and how you contact us, this may include your name, contact details, IP address and other information you choose to send to us. We use a CRM (Customer Relationship Management) to process personal data on potential and existing constituents, members, donors, and funders. The CRM includes integrated analytics showing email opens and clicks.
The purpose is to be able to respond to your inquiries and, on some occasions, to keep records in case of complaints or legal claims. The lawful basis is f), where the legitimate interests are to be able to respond to your inquiries and, on some occasions, to keep records in case of complaints or legal claims. We review this data at our annual (internal) GDPR audit day and delete personal data as appropriate. Due to the nature of our operations, we can keep this type of personal data up to 3 years, or 7 years if we have a legal obligation in accordance with accounting and bookkeeping rules.
You receive funding or support from us
When you receive scholarship, grants, or other financial or in-kind support from us, we may store your personal data in order to fulfill our service agreement. We may additionally share your personal information with third parties such as banks, travel agencies, or funders in order to complete transactions.
You purchase our products and services
When you purchase products and services from us, we process personal data such as your name, contact details, order and payment details as well as purchase history. If your purchase includes digital delivery, for example over video (recorded or not), either one to one between us and you, or one to many between us and a group of people, we also process personal data such as profile picture, video (picture and sound), messages (chat) and IP address.
The purpose is to be able to fulfill our obligation to deliver products and services you have purchased and to manage the customer relationship. The lawful bases are b) contract and c) legal obligation related to accounting, tax and other business rules and regulations we are required to abide by.
We process the data for as long as we have a legal obligation as per any applicable rules and regulations we are bound by. E.g. we are required by law to store business records, which could include personal data, for 7 years for accounting, tax and other business purposes. Please contact us if you would like to know what is applicable in your case.
You receive marketing as an existing customer or contact
If we have an existing customer relationship with you, we may send you marketing via e-mail and text messages. Depending on the medium used to submit such marketing, the personal data we process include your name, email address, IP address and/or phone number. The purpose is to provide you with good customer service and the lawful basis is f), where the legitimate interest is to offer our relevant products and services to provide excellent service to our customers. The lawful basis may also be a), where you have given us your consent to such marketing.
You can easily opt out of the marketing at any time by unsubscribing in any marketing email or text message you receive. We process the data for as long as we have a customer relationship with you, or, if the processing is based on your consent, until you withdraw it. The data will then be deleted at our next GDPR audit day. Please note that it is only personal data related to marketing efforts that will be deleted. We are still required to process data for accountancy, tax and other business purposes if you are our customer.
You apply for a job or work at our organization
When applying for a job with us, we process personal data such as your name, contact details, CVs, references, and other relevant information. The purpose is to be able to assess your application. The lawful basis is b) necessary for the performance of a contract, and possibly GDPR Article 9 (2) b) and h) if your application contains special categories of personal data.
For employees, we process personal data as mentioned above, in addition to other general employment data (for payroll, insurance, sick leaves etc.). The purpose is to be able to manage the employment relationship. The lawful basis for this is b) contract, and possibly Article 9 (2) (b) and (h) for special categories of personal data, as well as c) legal obligation related to labour laws.
As a rule, employee information is deleted when the employment relationship ends. However, some extraordinary reasons, such as a dismissal or dismissal dispute, may make it necessary to keep employment data for a longer time period. Job applicants can ask us to retain their data for other applications in the future, otherwise the information is deleted when a candidate has been selected, at the latest at our next GDPR audit day.
You subscribe to our email newsletters
We regularly send out email newsletters which sometimes contain updates and opportunities within our network. When you become a subscriber, we process personal data such as your name, email address and IP address. The purpose is to share updates, articles, and other useful content. The lawful basis is a) consent and you can easily unsubscribe at any time by clicking the “unsubscribe” link in any such newsletter.
Our email service provider has integrated analytics showing email opens and clicks. This functionality is native in our system and cannot be disabled. If you do not want your data to be analysed in this way, please do not subscribe to our newsletter. We use this data to analyse the performance of our newsletters and to tailor our content to you. The lawful basis is f), where the legitimate interest is to be able to offer you electronic newsletters and to continuously improve our products and services.
We process the data for as long as you subscribe, after which it will be deleted at our next GDPR audit day.
You attend our events
When you attend our events, we process personal data such as your name, audio and/or video recording of you, contact details and, sometimes, dietary and/or access requirements. For paid events, we also collect order and payment information. The purpose is to be able to process your registration and attendance, and, if applicable, your payment. The lawful basis is a) consent, or, for paid events, b) contract and c) legal obligation related to accounting, tax and other business rules and regulations we are required to abide by. If we collect any information about dietary and/or access requirements, we also need your consent under GDPR Article 9 (2) (a).
We may also use your data to send you an evaluation of the event you attended, or to invite you to other relevant events we think you might be interested in. The lawful basis is f), where our legitimate interest is to analyse and run our business effectively and to provide you with good customer service. If you do not wish to receive such messages, you will have an easy way to opt out, e.g. through an unsubscribe link in our emails.
We review this data at our annual GDPR audit day and delete personal data as appropriate, however no later than 3 years following the event.
You respond to our evaluations or surveys
Responding to our evaluations and surveys are voluntary. We process personal data such as your name, contact details and other information you choose to share with us. Some evaluations or surveys may be anonymous, and in such cases, we do not process any personal data.
The purpose is to gather your feedback and expertise so that we can continuously improve our operations and intellectual outputs. The lawful basis is a) consent. We review this data at our annual GDPR audit day and delete personal data as appropriate, however no later than 5 years after you responded to the survey.
You supply services to or collaborate with us
When you enter into an agreement with us either as a vendor, partner or data processor, we process personal data such as your name, contact details and correspondence. The purpose is to be able to enter into this agreement and to respond to your inquiries and the lawful basis is b) contract. We review this data at our annual GDPR audit day and delete personal data as appropriate, however no later than 7 years after the contract has been terminated. We process other communication data as per the first paragraph in this chapter, please see above.
You use our website
When you use our website, we may process personal data such as IP address and other technical data collected via cookies and analytics tools. The purpose is to run our website and business effectively, promote our activities and services and to respond to any inquiries from website visitors. The lawful basis for processing personal data through cookies that are strictly necessary, is f), where the legitimate interests are to be able remember your preference on additional cookies.
Whom we share your personal data with
To carry out our activities efficiently and securely, we sometimes will have to share your personal data with other parties such as:
- Public authorities we are obliged to report to
- Members of our networks who review and evaluate your submission
- Partners who we collaborate with to organize events or create intellectual products
- Our accountant, auditor, lawyer and others helping us in a professional capacity
- Data processors: providers of services that process your personal data on our behalf
- IT support, if necessary
- We require that all such recipients secure data in accordance with good information security. We enter into a data processing agreement/addendum with anyone who processes data on our behalf, as per the requirements in the GDPR Article 28-3.
We use data processors for:
- Email, calendar and digital meetings
- Event planning and management
- Accounting/bookkeeping and invoicing
- Cloud storage
- Websites and portals
- Business receipts
- Project management, timekeeping, digital notebook and scheduling
- Signing documents electronically
- Surveys and form submissions
To protect our operations we don’t publish further details (like names) of our data processors. If you’d like to know more about our processing and whom we share your personal data with, please contact us.
Transfer of personal data outside the EU/EEA
In some cases, your personal data will be transferred outside the EU/EEA, e.g. where we use data processors to manage cloud storage, email services, web hosting, contact databases.
We only use data processors we trust, that are well known and that we have a data processing agreement/addendum with. We check whether a country outside the EU/EEA offers an adequate level of data protection (has obtained an EU “adequacy decision”) or, if this is not the case, that other necessary safeguards are in place like the EU Standard Contractual Clauses (“SCC”, also called Model Clauses) or Binding Corporate Rules. If you would like to know where your particular data is processed, which safeguards we have for this and what other measures we have taken to protect your data, please contact us.
Please note that this entire document is protected by copyright and you may not copy any text from it.