This notice explains how PRISMA uses personal information in its communications, membership, events, website and organisational relationships. We respect your privacy, your choices and your right to participate without disclosing your health status.
PRISMA — European Community-Driven Observatory on Ageing and HIV — is an international non-governmental organisation constituted as an international non-profit association (AISBL) in Belgium. PRISMA is the controller responsible for the processing described in this notice.
You can contact us by email or by post at our registered office, marking your letter “Privacy”. Our commitment to community leadership includes transparency, confidentiality and respect for the people whose information we hold.
This notice covers our website, enquiries, newsletter, membership, advisory and volunteer involvement, events and webinars, professional outreach, donations and relationships with funders and partners. Our general membership and public engagement activities are intended for adults aged 18 and over.
Research and monitoring projects involving personal data will have a separate notice provided before the data are collected. That notice will explain the project, the data involved, the relevant legal grounds and safeguards.
Joining PRISMA, receiving our communications, supporting us or attending an event does not imply that you are living with HIV. We do not require disclosure of HIV status for newsletter subscriptions or ordinary event registration.
We collect only information needed for a stated purpose. The legal bases below refer to Article 6 of the General Data Protection Regulation (GDPR). Where information reveals health or another special category of personal data, we also need an applicable condition under Article 9, as explained in section 4.
We may process IP addresses, browser and device information, request times and technical logs to deliver the website, diagnose faults and prevent misuse. Our legal basis is legitimate interests in operating a reliable and secure website. Proposed retention: 30 days for routine logs; relevant records may be retained longer to investigate a specific security incident.
We use your name, contact details and the information in your message to respond and manage the exchange. Our legal basis is legitimate interests in responding to enquiries and maintaining necessary correspondence. Routine enquiries are retained for 12 months after the last exchange. Records relating to membership, grants, accounting or legal matters follow the relevant retention arrangements below.
We use your email address and, where supplied, your first name and language preference to send updates you have subscribed to. Our legal basis is consent. You can unsubscribe using the link in each newsletter or by contacting us. After unsubscribing, we retain only the minimum information necessary to record your objection or withdrawal and prevent further unwanted mailings, based on legitimate interests in respecting your choice. Event registration does not automatically subscribe you to the newsletter.
We use your name, email address, optional organisation, registration details and attendance information to administer registration, provide access and send materials connected with the event. Our proposed legal basis is legitimate interests in organising public engagement events; where processing is necessary to fulfil an actual event agreement with you, we may instead rely on performance of that contract. The applicable basis will be stated at registration. Routine registration and attendance records are retained for 12 months after the event. Optional accessibility information follows section 4 and is deleted promptly after the event unless you separately agree to its retention for future support. Recordings and photographs follow section 5.
We use contact details, membership category, role, availability and necessary administrative correspondence to manage membership, advisory groups and volunteering. Performance of a contract applies only where the processing is necessary to fulfil a membership or other agreement with you. Otherwise, we rely on legitimate interests in coordinating community involvement, where appropriate. Proposed retention: involvement or membership plus two years for routine administrative records. Any records subject to statutory duties or a specific legal claim follow the relevant requirements. Optional lived-experience or health information follows section 4.
We use the professional contact details, roles and correspondence of individual representatives to develop and administer organisational relationships. Our legal basis is legitimate interests in cooperation, fundraising and managing those relationships. Routine records are retained for the relationship plus two years. Relevant grant records are retained for the period required by the specific grant agreement or applicable law.
We may obtain names, professional roles, organisations and business contact details from public professional sources, organisational websites or introductions by partners. We use them to make relevant professional contact, including invitations to PRISMA activities, where permitted by applicable communications law. Our proposed GDPR basis is legitimate interests in relevant professional engagement, following an assessment of your interests and reasonable expectations. This does not itself authorise every marketing email. We explain the source and provide this notice at first contact, or within one month of obtaining the information if earlier disclosure is not otherwise required. You can object at any time.
If you donate or receive a payment or reimbursement, we process the contact details, amount, transaction reference, bank details and supporting information needed to administer the transaction. Payment providers may collect payment information directly under their own notices. We rely on legitimate interests for ordinary donor administration, performance of a contract where necessary to fulfil a payment agreement, and legal obligation for required accounting and tax records. Donations do not subscribe you to marketing. Donor names are published only with specific permission unless legally required. Retention of financial evidence is explained below.
We normally retain accounting books, invoices, bank transaction evidence, expense claims, reimbursement forms and other necessary financial supporting records for seven years. For accounting books, this period runs from 1 January following closure of the relevant accounting year; tax and VAT records are retained for the statutory period calculated under the applicable rules. We retain only the personal information necessary to support the transaction and comply with these obligations. We do not retain an entire membership or event file merely because one document supports a payment.
A longer period may apply where required by another law, a specific grant or audit obligation, or where necessary for an ongoing dispute or legal claim. Any extended retention is limited to relevant records, with restricted access and a documented reason. At the end of the applicable period, we securely delete or anonymise personal information unless a further lawful reason remains. Special VAT rules may require longer retention for certain investment assets, including property.
Where PRISMA arranges travel, accommodation or catering, we collect only the information needed for that arrangement. This may include your legal name, contact details, itinerary, dietary preferences and, only where required for a booking or visa application, passport details. Where an agreement with you requires the arrangement, we rely on contractual necessity; otherwise we identify an appropriate lawful basis for the specific activity. We explain the booking recipients before sharing information. Travel providers may act as independent controllers for their own booking and legal obligations.
We do not routinely collect passport copies. Where a copy is genuinely necessary, access is restricted and it is deleted when the booking or visa purpose is complete, unless a specific legal obligation requires retention. Dietary details revealing health or religion are handled under section 4. Administrative travel information is deleted when no longer needed; financial evidence follows the seven-year retention rule above.
Membership applications and updates are reviewed only by people authorised to administer or decide on membership, under confidentiality duties. Access to sensitive information is narrower and based on actual need; a Board role does not automatically provide access to everyone’s health information. If an application is unsuccessful, the full application is normally deleted within six months of the decision. A minimal decision record may be kept for up to two years where necessary to handle review requests or demonstrate fair administration, on the basis of legitimate interests.
Where a role requires a declaration of interests, we use relevant professional affiliations, financial interests and relationships to assess and manage conflicts. We rely on legitimate interests in transparent governance, or a specific legal obligation where applicable. Access is limited to authorised reviewers. We normally retain declarations during the relevant role and for two years afterwards; declarations forming part of a governance or legal record may follow a separately justified period. We explain any required publication before collecting the declaration and do not publish sensitive or unrelated details.
Please avoid including unnecessary health information in general website forms or ordinary email. If your enquiry needs sensitive information, contact us first so we can explain an appropriate way to share it. We recognise that lived experience can be central to community participation, and we respect your choice about disclosure.
Where we invite you to share health information or other special-category data, we explain the specific purpose, who will have access and how long it will be retained. We identify an Article 6 legal basis and an applicable Article 9 condition before processing. Where we rely on explicit consent, we ask for a separate, clear statement of consent. You can withdraw it at any time without affecting processing that was lawful before withdrawal.
Accessibility information that reveals health or disability is collected only where needed to arrange support. Our proposed bases are consent under Article 6(1)(a) and explicit consent under Article 9(2)(a), unless another applicable legal basis and condition are identified and explained. We share only necessary information with people arranging the adjustment. Declining to provide health details does not prevent ordinary registration, although it may limit the support we can arrange.
Sending us unsolicited sensitive information does not, by itself, establish explicit consent. We restrict access, assess whether we can lawfully use the information and remove or delete unnecessary details promptly. If further processing is needed, we identify a valid legal basis and Article 9 condition and explain these to you. We do not use the information for publicity, fundraising or unrelated purposes.
Registration information is not a public participant directory. We do not disclose attendee contact details to other attendees or sponsors for their marketing. Invitations and group communications use systems that protect recipients’ email addresses, such as BCC or an appropriate mailing platform.
Before an event, we explain whether sessions will be recorded or photographed, the purpose, intended audience, publication channels, legal basis and retention period. We distinguish speaker recordings from identifiable audience contributions. Where consent is the appropriate basis, we obtain it before recording or publishing the contribution; special-category disclosures require additional safeguards and an applicable Article 9 condition.
We explain the available participation options, including whether display names, cameras, microphones, chat messages and questions are visible to others or included in recordings. We provide private participation options where technically available, such as keeping your camera off or submitting a question privately. We minimise incidental capture of attendees and explain how to raise a privacy concern or request removal.
We request a separate choice for optional publicity photographs, identifiable audience recordings and public participant lists. Refusing these uses does not prevent attendance. At in-person events, we offer a discreet way to communicate a no-photography preference, such as informing the photographer or using an agreed indicator if you choose. At online events, we explain available privacy settings in advance. Attendees are asked to respect others’ choices and not to photograph, record or share identifiable contributions without permission.
We do not circulate travel departure lists, contact lists or attendee directories without a necessary lawful purpose and clear prior information; optional directories require permission. A name badge is handled according to the event’s stated arrangements and privacy options. Consent to publication is separate from consent to receive a newsletter.
We review publicity photographs and recordings at least annually and normally remove identifiable audience material within three years unless a longer use has a specific, documented justification and lawful basis. Speaker recordings have a defined retention period agreed and explained before recording. We do not retain all identifiable footage indefinitely merely to preserve organisational history. Where practicable, historical reporting uses anonymous summaries or material that does not identify attendees.
We aim to use only cookies and similar technologies strictly necessary to provide requested functions or protect the website. Our cookie information will identify the technologies actually used, their purpose, provider and duration. Necessary cookies do not require consent, but we explain their use.
If we introduce analytics or other non-essential technologies, we will explain them and obtain consent before they operate where required. You will be able to refuse them and withdraw consent as easily as you gave it. Third-party forms, videos and other embedded services are included in our checks.
We do not sell personal information or provide it to sponsors or other organisations for their independent marketing. Access within PRISMA is limited to people who need the information for their role and are bound by appropriate confidentiality duties.
We use service providers for functions such as email, hosting, forms, databases, newsletters, webinars and payments. Where they act as processors, they process information under our instructions and an appropriate written data-processing agreement. Some providers, banks or professional advisers may act as independent controllers for particular functions; we explain this where relevant.
The services identified for PRISMA’s website, communications and membership administration are listed below. Where an additional service is used for an event, payment or other activity, we identify it in the information provided for that activity.
We may disclose necessary information to competent authorities where legally required, and to professional advisers or other appropriate recipients where necessary to establish, exercise or defend legal claims. We do not provide identifiable membership or attendee lists to funders merely to demonstrate participation; we use aggregate reporting wherever possible.
Some providers or their subprocessors may process personal information outside the European Economic Area. Before a transfer, we check the destination and applicable safeguards. These may include a European Commission adequacy decision, including the EU–US Data Privacy Framework where the actual US recipient is certified and the transfer falls within its certification, or European Commission standard contractual clauses supported by a transfer assessment and additional safeguards where necessary.
You can contact us for information about the safeguards applicable to your data and a copy of the relevant safeguards, subject to necessary redactions.
The periods in section 3 apply to routine records. We retain information longer only where a specific legal duty, grant requirement or the establishment, exercise or defence of a legal claim justifies it. We restrict access to retained records and delete or anonymise information when it is no longer needed. Backup copies follow a defined deletion cycle.
We use technical and organisational measures appropriate to the risks, including access restrictions, account protection, confidentiality requirements and secure handling of sensitive information. We assess personal-data breaches and notify the competent supervisory authority within the applicable legal timeframe where required. If a breach is likely to result in a high risk to you, we inform you without undue delay unless a lawful exception applies.
We do not make solely automated decisions producing legal or similarly significant effects on you. We do not build advertising profiles of website visitors.
Depending on the circumstances and legal basis, you can ask to access your personal information, correct inaccuracies, have information erased, restrict processing or receive eligible information in a structured, commonly used, machine-readable format. Portability applies to qualifying automated processing based on consent or contract. These rights are subject to the conditions and exceptions in the GDPR.
You can object to processing based on legitimate interests on grounds relating to your situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims. You can object to direct marketing at any time, and we will stop processing for that purpose. You can withdraw consent at any time by contacting us or using the relevant unsubscribe or withdrawal mechanism.
Requests are normally free of charge. We respond without undue delay and normally within one month of receiving your request. Where permitted because of complexity or the number of requests, we may extend the period by up to two further months; we will explain the extension within the first month. We may ask for proportionate information to verify your identity where necessary.
Contact privacy@prisma-eu.org or write to our registered office. You do not have to complain to PRISMA before contacting a supervisory authority. You may complain to the Belgian Data Protection Authority (APD/GBA), Rue de la Presse 35, 1000 Brussels, Belgium, https://www.dataprotectionauthority.be, or the competent supervisory authority in the EU/EEA country where you habitually live or work, or where the alleged infringement occurred.
We review this notice when our activities or processing arrangements change. We publish the updated version with its effective date. Where a change materially affects you, we provide an appropriate notification; where required, we obtain fresh consent before introducing the changed processing.