This privacy- and cookie policy (the “Privacy- and Cookie Policy”) governs the way AIESEC Hong Kong Limited, registered as a private limited company by guarantee under Companies Ordinance (Cap. 622) and having its registered office at Room 913, Youth Square, 238 Chai Wan Road, Chai Wan, Hong Kong (“AIESEC”, “we”, “us”, or “our”), as data controller, processes (collects, uses, maintains and discloses) your personal data in relation to the https://aiesec.hk/  websites (“Sites”) and in relation to the services we provide through these Sites. For any other website affiliated with AIESEC, please refer to their respective privacy policy. As you read our Privacy and Cookie Policy, keep in mind that it applies to all AIESEC services available on our Sites unless otherwise indicated.

Please refer to the following definitions that will be used in the document: 

• “Active User”: A user who completed his or her profile and has logged into the website in the past 6 months or a user who is on an Exchange Experience.
• “Customers”: users that sign up and/or find an Opportunity and go on exchange via our Platform.
• “Exchange Experiences”: The service that is being offered on the Platform. A social or professional work experience in the organization of an Opportunity Provider.
• “Members”: all persons who are (voluntarily) working for or on behalf of AIESEC.
• “Opportunity Listings”: The posting and description of an opportunity that a user can apply to for an Exchange Experience.
• “Opportunity Providers”: Organizations and other third parties that offer Exchange Experiences on our Platform.
• “Partners”: users that offer Opportunities on our Platform.
• “Platform”: our platform on the Sites to which a user may register as Opportunity Provider, Customer, or Member for the purpose of offering or engaging in Opportunities.
• “Profile Preferences”: The Preferences section under
  https://aiesec.org/profile/preferences [ensure you add your website links] where the user manages consent of use of personal data.
• “Review”: A public review about an Exchange Experience that includes a rating on a scale from 1-10 (“Rating”).
• “User”: all users of the Platform, both Opportunity Providers and Customers.

To the extent that we process personal data of individuals located in the European Economic Area and the United Kingdom in relation to the offering of goods or services to these individuals or the monitoring of their behaviour, this Privacy and Cookie Policy contains the information required to be conveyed to these individuals pursuant to the European Union’s general data protection regulation (the “EU GDPR”) as applicable in the European Economic Area (“EEA“) and as retained in the laws of the United Kingdom further to the European Union (Withdrawal) Act 2018 (the “UK GDPR” and, together with the EU GDPR, the “GDPR“).For the purposes of article 27 of the EU GDPR, our representative in the European Union is Stichting  Aiesec International (Rijn 12 85272491BG ‘s-Gravenhage, The Netherlands). For the purpose of article 27 of the UK GDPR, our representative in the United Kingdom is A.I.E.S.E.C. (U.K.) LIMITED (Allia Future Business Centre, 18-20 London Lane, London, England, E8 3PR; [email protected]).

1. Information we collect

Our Platform aims to connect Opportunity Providers with Members and Active Users in the context of Exchange Experiences. Our Platform is accessible via our Sites. There are three general categories of how we collect information about our Members, Customers, Partners and visitors to our Sites.

1.1 Information You Give Us

We collect information you share with us when you use the AIESEC Platform 

• Account Information. When you sign up for an AIESEC Account, we require certain information such as your name, email address, phone number, country of residence, and

date of birth.-

• Profile Information. To use certain features within the AIESEC Platform, we may also ask you to complete a profile, which may include your skills and qualifications, professional activities, personal details, academic curriculum, professional adequacy, professional experience, membership of professional committees, current employment information, image recordings, and gender. For support in visa-processing, we might require a copy of the passport. Sensitive data not required for the visa process (such as national social security numbers) will be blacklined. As an Active User, you can approach Opportunity Providers via your profile. By default, your public profile will be anonymous. If you are an Active User you may consent to include certain parts of your profile (like your profile picture, first name, and qualifications) as part of your public profile page, making it publicly visible to others and allowing Opportunity Providers to approach you directly. You can choose to opt-in by enabling POP Profile Visibility in your Profile Preferences. You may be free to withdraw your consent at any time by disabling the same in your Profile Preferences.

• Payment Information. We collect your financial information (like your bank account or

credit card information) when you use Payment Services to process payments.  

• Communications with AIESEC and other Users. When you communicate with AIESEC or use the AIESEC Platform to communicate with other Users, we collect information about the time and date of your communication to research and gain insight into our Users’ use of the communication feature and to determine whether any open queries have not been followed up by AIESEC. Our Platform offers a chat function for communication purposes, which is secured by our service provider Amazon Webs services. Only selected employees of AIESEC International and of our IT vendor Commutatus to have access to the database. The chat feature includes multiple conversations that can include multiple people: Partner representatives and AIESEC representatives, if their participation is needed to ensure, manage and/or process the application. AIESEC ensures that you are always aware of who is included in the conversation. All messages are secured at database-level by encryption.

• Other Information. You may otherwise choose to provide us information when you fill in a form, conduct a search, update or add information to your AIESEC Account, respond to surveys, post to community forums, participate in promotions, email us or use other features of the AIESEC Platform.

1.2 Information We Automatically Collect from Your Use of the AIESEC Platform

When you use the AIESEC Platform, we collect information about the services you use and how you use them. 

• Usage Information. We collect information about your interactions with the AIESEC Platform, such as the pages or other content you view, your searches for Opportunity Listings, applications you have sent, and other actions on the AIESEC Platform.

• Location Information. When you use certain features of the AIESEC Platform, we may collect different types of information about your IP address (such as your location).

• Log Data. We automatically collect log information when you use the AIESEC Platform, even if you have not created an AIESEC Account or logged in. That information includes, among other things: details about how you’ve used the AIESEC Platform (including links to third party applications), IP address, access times, hardware and software information, device information, device event information (e.g., crashes, browser type), and the page you’ve viewed or engaged with before or after using the AIESEC Platform.

• Cookies and Similar Technologies. We use cookies and other similar technologies, such as web beacons, pixels, and mobile identifiers subject to, when this is not strictly necessary for operating our website, obtaining your consent before collecting information through cookies stored on your terminal equipment and information obtained from your terminal equipment. Subject to the same qualification, we may also allow our Partners to use these tracking technologies on the AIESEC Platform, or engage others to track your behavior on our behalf. You may disable performance and/or marketing cookies using the Cookies control panel. You may alternatively disable the usage of cookies through your browser settings.  An HTTP header “Do Not Track” signal will however not operate. For further information about the use of cookies, please be referred to paragraph 9 of this Privacy- and Cookie Policy

1.3 Information We Collect from Third Parties

We collect information that others provide about you when they use the AIESEC Platform, or obtain information from other sources and combine that with information we collect through the AIESEC Platform. 

• Third Party Services. If you link, connect, or login to your AIESEC Account with a third party service (e.g., Facebook, LinkedIn), the third party service may send us information such as your registration and profile information from that service. This information varies and is controlled by that service or as authorized by you via your privacy settings at that service.

2. How we use information we collect

2.1 Purposes and legal grounds for processing

We use your personal data only for the following purposes or purposes compatible therewith and pursuant to the following legal bases under the GDPR (the legal basis identified at the top of each column applies to the purposes set forth in that column):

3. Sharing & Disclosure [The following text you need to adapt according to the information you collect, ex]

3.1 Sharing between Opportunity Providers and Exchange Participants

To help facilitate the application process, we share your information with other Users as follows:

• When you as an Exchange Participant apply for an Opportunity, certain (Profile) information (such as a copy of your passport, your photo, financial identification data, data regarding your professional activities, personal details, academic curriculum, professional adequacy, professional experience, membership of professional committees and current employment information) about you is shared with the Opportunity Provider, including your full name and your qualifications.

• When you as an Opportunity Provider post your Opportunity Listing, certain information is shared with the Users to showcase your Opportunity and Organization.

• When you as an Opportunity Provider accept an application to your Opportunity, certain information is shared with the Exchange Participant to facilitate the further process.

We do not share your billing and payout information with other Users.

3.2 Profiles, Opportunity Listings, and other Public Information

The Applications Platform let you publish information that is visible to selective groups of users. For example:

• By default your public profile will be anonymous. If you are an Active User you may consent to include certain parts of your profile (like your profile picture, first name, last name and qualifications) as part of your public profile page, making it publicly visible to others and allowing Opportunity Providers to approach you directly. You can choose to opt-in by enabling POP Profile Visibility in your Profile Preferences. You may be free to withdraw your consent at any time by disabling same in your Profile Preferences.

• Opportunity Listings are publicly visible and include information such as the requirements or details about the Exchange Experiences, Opportunity Listing description, calendar availability and any additional information the Opportunity Provider chooses to share.

• After completing an Exchange Experience, Exchange Participants write reviews and rate the Opportunity. Reviews are a part of your Opportunity Listings profile page.

• If you submit content in a public forum or social media post, or use a similar feature on the AIESEC Platform, that content is publicly visible
  

Information you share publicly on the AIESEC Platform can be indexed through third party search engines. In some cases, you may opt-out of this feature in your Account settings. If you change your settings or your public-facing content, these search engines may not update their databases. We do not control the practices of third party search engines, and they may use caches containing your outdated information.

3.3 Service Providers

We use a variety of third party service providers to help us provide services related to the AIESEC Platform, such as IT service providers (i.e. Google Analytics and Google Search Console), consultants and payment service providers. For example, service providers may help us to provide customer service, advertising, or payments services. These providers have limited access to your information and only in case this is necessary to perform these tasks on our behalf.

3.3.1 Google Analytics

As a data processor acting on our behalf, Google Analytics collects data from your websites and apps, then analyzes your use of our website and/or product and tracks our relationship by way of cookies and similar technologies, so that we can improve our service to you subject to obtaining your consent before collecting information through cookies stored on your terminal equipment and information obtained from your terminal equipment. 

3.3.2 Google Search Console

As a data processor acting on our behalf, Google Search Console tools and reports help us measure your usage of our website that reflect the traffic and our performance. It fixes issues on our sites and polishes our appearance in Google Search results. 

3.4 Safety and Compliance with Law

AIESEC discloses your information to courts, law enforcement or governmental authorities, or authorized third parties, if and to the extent that we are required to do so by law or if such disclosure is reasonably necessary: (i) to comply with legal process and to respond to claims asserted against AIESEC, (ii) to respond to verified requests relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our Users to legal liability, (iii) to enforce and administer our Terms & Conditions or other agreements with Users, (iv) for fraud investigation and prevention, risk assessment, customer support, product development and debugging purposes, or (v) to protect the rights, property or personal safety of AIESEC, its employees, its Members, or members of the public.

We will attempt to notify Users about these requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon AIESEC’s property, it’s Users and the Platform (collectively, “Risk Scenarios”). In instances where we comply with legal requests without notice for these reasons, we will attempt to notify that Users about the request after the fact if we determine in good faith that we are no longer legally prohibited from doing so and that no Risk Scenarios apply.

3.5 Corporate Affiliates

[The following text you need to adapt according to the entity reality,. ex]

We may share your information with AIESEC’s affiliates and branches abroad when this is necessary to ensure that AIESEC is able to provide the Exchange Experiences (as required on the basis of AIESEC’s contractual obligations). We will share your information with (i) the legal AIESEC entity in the country you are residing in (which you choose during the Account creation) or (ii) the legal AIESEC entity that the Opportunity you are applying is based. This concerns the following countries and territories:

3.6. Operating globally 

As described in this Privacy and Cookie Policy, we may sometimes share your information with affiliates or branches of AIESEC or with third parties. Individuals protected by the Personal Data (Privacy) Ordinance (Cap.486) (PDPO) are informed that their personal information can be transferred to other countries where such service providers are located. 

It is noted that we must explicitly inform you of the purpose for which your personal information is to be used and the classes of persons to whom your personal information may be transferred. We are not allowed to transfer your personal information for new purposes without your prescribed consent. We must also adhere to the direct marketing requirements of PDPO and remain liable for any act done by agents with their authority. We are recommended to include contractual clauses that ensure our responsibilities to take all reasonable precautions in transferring data to the transferee that is an entity outside Hong Kong

You may get access to these agreements or request a copy thereof by sending an email to [email protected]. 

4. How long do we store your personal data?

Your personal data will be stored no longer than necessary for the purposes for which they are collected. Only where we are legally obliged to, or where this is necessary for defending our interests in the context of judicial proceedings (e.g. in case of a dispute), we will store the personal data for a longer period of time.

More specifically, the following storage periods apply in terms of personal data:

• Account information (i.e contact details, age, nationality, location data, professional experiences): 24 months after the last activity or until the user deletes their account 
• Profile Information (i.e user data connected to an application): 24 months after last activity or until the user deletes their account 
• User behavior data of the logged user (i.e the user data connected to an action taken): 24 months after last activity or until the user deletes their account 
• Aggregated data or logged user: 24 months after collection 
• Notification data of logged user: 24 months after last activity or until the user deletes their account 
• Payment information: 13 months as from the relevant payment transaction (expect for CSV number which is deleted after the payment transaction), it is noted that accounting data; accounting data can however kept for the required time period under Canadian Law. 
• Copy of your passport: 24 months after last activity or until the user deletes their account 
• Communication data: 24 months after last activity or until the user deletes their account 
• Contractual data: Inactive database 24 months after last activity or until the user deletes their account or any outstanding payment has been made (whichever the latest); after this time period, we will archive this information for the purposes of using it should we need it to assert our legal rights before an administrative or judiciary authority and keep it until the latest between the expiry of the applicable limitation period or the date a final decision is made which is not subject to any recourse.

5. Your rights 

5.1 Access and Update

You may review, update or delete the information in your AIESEC Account by logging into your AIESEC Account and reviewing your Account settings and profile.

5.2 Account Cancellation

You may cancel your account at any time on our Site in the Profile Preferences section. Note that information that you have shared with others (like Reviews or forum postings) may continue to be publicly visible for up to 2 years (after last activity or until you delete your account) on the AIESEC Platform in association with your first name.

Once your account is cancelled, we are removing any personal data attached to your user account (such as, but not limited to contact information). Instead, we will display anonymous identifiers to all our key stakeholders. All business critical information, such as statistical data connected to applications you may have created on the Platform will be retained in such an anonymous way.

5.3 What are your rights and how you can exercise them? 

Under the PDPO, as data subjects, you have the right to:

• access their personal data; 
• make corrections to their data; 
• request for easure of personal data; 
• complain about our failure to erase your personal data; 
• withdraw your consent on our use of your data by giving written notice; and
• seek compensation by civil actions for any damages caused by our contravention of PDPO. 
• erasure of their personal data (‘right to be forgotten’) in limited circumstances;
• restriction of processing of their personal data in limited circumstances;
• object to the processing of their personal data based on legitimate interests, in the absence of compelling grounds for continuing such processing (including the right to object to processing for direct marketing purposes);
• receive their personal data in a structured, commonly used and machine-readable format and to (have) transmit(ted) your personal data to another organization.
• Although we are required by the GDPR to grant these rights only to individuals in the European Economic Area and the United Kingdom and only in respect of processing activities relating to the offering of goods or services to these individuals or the monitoring of their behaviour, we are keen to treat equally all our Customers.

You may request your personal information held by us on the Platform in your Profile Preferences in the Download Personal Data section. We will provide you with a copy of the personal information held by us as soon as possible and will respond to your request within one month; that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. 

Requests in this section should be addressed to: https://aiesec.hk/. AIESEC will handle the aforementioned requests within a period of 3 months.

Finally, you have the right to lodge a complaint with the relevant data protection authority relating to the processing of your personal data by AIESEC

6. Security

We are continuously implementing and updating administrative, technical, and physical security measures to help protect your information against unauthorized access, loss, destruction, or alteration. However, the Internet is not a 100% secure environment so we can not guarantee the security of the transmission or storage of your information.

More specifically, we have taken the following measures:

• Authentication system through a separate authentication server and database disconnected from the remaining website server and database

• Confidentiality and Information Management training 
• Deployment of new code to the system only possible by authorized personnel of Commutatus
• Servers and databases are on a virtual private cloud that restricts access only to users that have access to the cloud through the usage of private keys.
• Contingency plan is in place for the event of a private key being compromised.
• Storage of access logs for databases, API and authentication for up to 7 days.
• Monitoring systems allow for routine manual checks.
• Periodically backup of the database.
• Read more about our cloud provider (Google) here: https://policies.google.com/privacy?hl=en-US  

Further, we seek to ensure that we keep your personal data accurate and up to date. In view thereof, we kindly request you to inform us of any changes to your personal data (such as a change in your contact details).

7. Use of cookies

AIESEC uses “cookies” in conjunction with the Platform to obtain information. A cookie is a small data file that is transferred to your device (e.g. your phone or your computer) for record-keeping purposes. For example, a cookie could allow the Platform to recognize your browser, while another could store your preferences and other information.

There are two types of cookies used on the Platform, namely “persistent cookies” and “session cookies”. Session cookies will normally expire when you close your browser, while persistent cookies will remain on your device after you close your browser, and can be used again the next time you access the Platform.

Your browser may allow you to set how it handles cookies, such as declining all cookies or prompting you to decide whether to accept each cookie. But please note that some parts of the Platform may not work as intended or may not work at all without cookies.

Disabling cookies

You may disable performance and/or marketing cookies using the Cookies control panel. Alternatively, you can modify your browser setting to decline specific cookies by visiting the Help portion of your browser’s toolbar. If you choose to decline cookies, please note that you may not be able to sign in, customize, or use some of the interactive features of the Platform. 

Other technologies

We also use other technologies with similar functionality to cookies on the Platform, such as web beacons and tracking URLs to obtain Log Data about Users, subject to, when this is not strictly necessary for operating our website, obtaining your consent before collecting information through cookies stored on your terminal equipment and information obtained from your terminal equipment. We also use web beacons and tracking URLs in our messages to you to determine whether you have opened a certain message or accessed a certain link, subject to the same qualification.

7.1 AIESEC cookies

Strictly necessary cookies. We use cookies that are strictly necessary to operate our website without your specific consent, including:

• user‑input cookies (session-id) such as first‑party cookies to keep track of the user’s input when filling online forms, shopping carts, etc., for the duration of a session or persistent cookies limited to a few hours in some cases;
• authentication cookies, to identify the user once he has logged in, for the duration of a session;
• user‑centric security cookies, used to detect authentication abuses, for a limited persistent duration;
• multimedia content player cookies, used to store technical data to play back video or audio content, for the duration of a session;
• load‑balancing cookies, for the duration of session;
• user‑interface customisation cookies such as language or font preferences, for the duration of a session (or slightly longer);
• third‑party social plug‑in content‑sharing cookies, for logged‑in members of a social network.

Performance cookies. We use performance cookies enabling us to tell how users use our Website, such as: 

7.2 Third party cookies [If necessary, the following text you can adapt according to your platform-website].

We may also allow our business partners to place cookies on your device. For example, we use Google Analytics for web analytics, so Google may also set cookies on your device. As further explained below, Third Parties may also place cookies on your device for advertising purposes, subject to obtaining your consent for this purpose.

Our partners’ cookies are intended to obtain information to help them provide services to AIESEC. For example, Third Parties we engage to provide services to us may track your behavior on our

Platform to market and advertise AIESEC listings or services to you on the Platform and Third-party websites. Please note that even if you choose not to receive targeted advertising, you may still receive advertising on or about the Platform – it just will not be tailored to your interests.

Google Analytics

This website uses features of the web analytics service Google Analytics. Provider is the Google Inc. 1600 Amphitheater Parkway Mountain View, CA 94043, USA. For more information on how Google Analytics collects and processes information, as well as how you can control the information sent to Google, please review Google’s site “How Google uses data when you use our partners’ sites or apps” located at www.google.com/policies/privacy/partners/. 

7.3 Third party partners & integration

The AIESEC Platform contains links to third party websites or services, such as third party integrations, co-branded services, or third party-branded services (“Third Party Partners”). AIESEC doesn’t own or control these Third Party Partners and when you interact with them, you may be providing information directly to the Third Party Partner, AIESEC, or both. These Third Party Partners will have their own policy regarding the collection, use, and disclosure of information. We encourage you to review the privacy policies of the other websites you visit.

Google Maps/Earth

Parts of the AIESEC Platform use Google Maps/Earth services, including the Google Maps API(s). Use of Google Maps/Earth is subject to Google Maps/Earth Additional Terms of Use and the Google Privacy Policy.

Typeforms

We use TypeForms to create and conduct customer surveys and User surveys to improve our services. The data collected using a Typeform will be stored on Google’s “Google Drive” cloud for us. We also collect data and files that you can upload through other forms that are also stored in Google Drive. For more information about Typeforms, please refer to Typeform’s privacy policy https://admin.typeform.com/to/dwk6gt?typeform-source=www.google.com. For more information about Google Drive and its data processing, please refer to Google Drive’s private policy: https://support.google.com/drive/answer/10375054?hl=en. For more detailed guidance on how to manage your own data related to Google products, visit Google’s https://www.dataliberation.org/. 

7.4 Social Sharing Features

The AIESEC Platform offers social sharing features and other integrated tools (such as the Facebook “Like” button), which let you share actions you take on our Sites with other media, and vice versa. The use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature.

Facebook

Facebook places a cookie via the Platform that allows Facebook to obtain aggregated, non-Personal Information to optimize their services. For example, if an advertisement for the AIESEC mobile app on Facebook and subsequently installs the app, this cookie will inform Facebook that a User (who is not personally identified) has installed the app after clicking on the advertisement. This cookie may also inform Facebook that a User is using the app, without identifying the specific actions taken by the User in the app.

Instagram

On our pages, functions of the Instagram service are integrated. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. If you are logged into your Instagram account, you can link the contents of our pages to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate the visit of our pages with your User account. We would like to point out that as a provider of the pages we are not aware of the content of the transmitted data as well as their use by Instagram. For more information, see the Instagram Privacy Statement: http://instagram.com/about/legal/privacy/ 

LinkedIn

Our website uses the functions of the LinkedIn network. Is the LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. Each time you visit one of our sites that contain LinkedIn, LinkedIn connects to LinkedIn servers. LinkedIn is informed that you have visited our Internet pages with your IP address. We would like to point out that as a provider of the pages we have no knowledge of the content of the transmitted data as well as their use by LinkedIn. For more information, see LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy. 

Youtube

Our website uses plugins from Google’s YouTube site. The site is operated by YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our YouTube-enabled sites, you will be connected to YouTube’s servers. The Youtube server is informed which of our pages you have visited. When you are logged in to your YouTube account, you enable YouTube to map your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. For more information on how to deal with User data, see the YouTube Privacy Policy at https://www.google.com/intl/en/policies/privacy 

• Changes to this Privacy and Cookie policy

AIESEC reserves the right to modify this Privacy- and Cookie Policy at any time in accordance with this provision. If we make changes to this Privacy- and Cookie Policy, we will post the revised Privacy- and Cookie Policy on the AIESEC Platform and update the “Last Updated” date at the top of this Privacy- and Cookie Policy.

• Contact

If you have any questions or complaints about this Privacy- and Cookie Policy or AIESEC’s information handling practices, you may contact us at the address indicated at the beginning of this Privacy- and Cookie Policy. You may also email [email protected]. Please expect a response within 1 month after we receive your letter or email.                                                                                                            

Hong Kong – Date [20/06/2023]

Name: Disheng Cheng