Privacy Policy

This Policy applies to all individuals whose personal data is collected, received, processed or otherwise handled by GEAF in connection with its activities and operations. This includes, without limitation, applicants to the GEAF Ambassador Programme, appointed Ambassadors and Facilitators, individuals who register for or participate in GEAF webinars or events, volunteers and participants in environmental initiatives, newsletter subscribers, donors, website visitors, and individuals who interact with GEAF through advertising, social media or other third-party platforms.

This Policy also applies where personal data relating to an individual is provided to GEAF by a third party, including, for example, where an Ambassador provides the details of another individual as an emergency contact.

The GEAF Ambassador Programme is available only to individuals who are eighteen (18) years of age or older. GEAF does not knowingly accept applications to the Ambassador Programme from individuals under the age of eighteen (18).

GEAF may process personal data, as applicable, for the following purposes:

• assessing Ambassador Programme applications, communicating with applicants and administering the application process;
• administering Ambassador and Facilitator appointments and agreements, verifying identity, maintaining relevant records, and processing payments;
• registering and coordinating individuals for webinars, events, environmental initiatives and volunteer activities, including providing joining instructions, reminders and relevant materials;
• using emergency contact information where reasonably necessary in connection with an actual or reasonably anticipated emergency concerning the relevant individual;
• administering donations and related payment transactions;
• sending newsletters, information regarding opportunities, invitations and other communications where the necessary consent has been provided or another lawful basis permits such communications;
• operating, maintaining, securing, analysing and improving GEAF’s website, programmes and services;
• maintaining transaction, accounting and other records to the extent required or permitted by applicable law, including applicable Swiss record-keeping requirements; and
• establishing, exercising or defending legal claims and complying with applicable legal or regulatory obligations.

Depending on the relevant processing activity and the applicable law, GEAF may process personal data on the basis of consent, the performance of or steps relating to an agreement, compliance with a legal obligation, legitimate interests, or another lawful basis available under applicable law.

Where processing is based on consent, consent may be withdrawn at any time. Withdrawal of consent shall not affect the lawfulness of processing undertaken prior to such withdrawal.

Where applicable law requires consent for the use of particular cookies or similar technologies, GEAF shall obtain such consent before those technologies are activated.

Following completion of an application process, GEAF may retain anonymised information concerning applicants’ interests, motivations and programme preferences for statistical, research and future programme-planning purposes. Where information has been effectively anonymised so that an individual is no longer identifiable, it is no longer treated as personal data under this Policy.

GEAF may engage appropriately selected third-party service providers for purposes including communications and email management, webinar hosting, file storage, information technology, office administration and payment processing. Where such providers process personal data on behalf of GEAF, GEAF shall take appropriate steps to ensure that the processing is subject to applicable contractual, confidentiality and data protection requirements.

• 5.1. Ambassadors and Facilitators

  Where a GEAF initiative or event is administered or coordinated by an Ambassador or Facilitator, GEAF may provide that Ambassador or Facilitator with limited personal data reasonably necessary to coordinate an individual’s participation, including the individual’s name, email address and information regarding the manner in which the individual wishes to participate.

  Such information shall be used solely for the relevant initiative or event and retained only for so long as reasonably necessary for that purpose. Appropriate confidentiality and data protection obligations shall be established prior to disclosure.

  Where an Ambassador or Facilitator independently determines the purposes and means by which personal data is processed, that individual may have separate responsibilities under applicable data protection law. Individuals may nevertheless contact GEAF regarding concerns relating to personal data disclosed by GEAF, and GEAF shall provide reasonable assistance where appropriate.

  GEAF shall not provide Ambassadors or Facilitators with an individual’s identity documents, CV, project proposal or emergency contact information unless such disclosure is separately authorised or otherwise permitted or required by applicable law.

• 5.2. Other Disclosures

  GEAF may disclose personal data where required or permitted by applicable law, regulation, court order or competent governmental authority, or where reasonably necessary for the establishment, exercise or defence of legal claims.

  GEAF does not sell personal data or disclose personal data to third parties for their independent direct-marketing purposes.

GEAF operates internationally, including through Ambassadors, Facilitators and service providers located in different jurisdictions. Accordingly, personal data may be transferred to, accessed from or otherwise processed in countries outside Switzerland.

Where personal data is transferred to a jurisdiction recognised by the competent Swiss authorities as providing an adequate level of data protection, the transfer may be undertaken in accordance with the applicable adequacy framework.

Where personal data is transferred to a jurisdiction that is not recognised as providing an adequate level of protection, GEAF shall implement appropriate safeguards as required by applicable law, which may include recognised standard contractual clauses, contractual safeguards or other legally permitted transfer mechanisms.

Where the GDPR applies, GEAF shall additionally ensure that transfers of personal data subject to the GDPR are conducted in accordance with the applicable requirements governing international data transfers.

GEAF may retain the following categories of personal data, where applicable:

• applications and supporting information submitted by applicants to the Ambassador Programme;
• application materials and records relating to appointed Ambassadors and Facilitators;
• Ambassador and Facilitator agreements and related contractual records;
• identity verification records, including any redacted identity document retained in accordance with this Policy;
• banking, payment and transaction records;
• emergency contact information;
• webinar and event registration and attendance records;
• volunteer and initiative participation records;
• newsletter subscription and communications records;
• donation and related payment records;
• advertising, social media and third-party platform interaction records, where retained by GEAF; and
• website usage and related technical data.

GEAF shall retain personal data only for as long as reasonably necessary to fulfil the purposes for which such personal data was collected or otherwise processed, or for such longer period as may be required or permitted under applicable law.

In determining the appropriate retention period, GEAF shall take into account the nature and purpose of the personal data, the duration of the relevant relationship, programme, activity or engagement, and any applicable legal, regulatory, contractual, accounting, audit and record-keeping requirements, including where retention may be necessary for the establishment, exercise or defence of legal claims.

Where GEAF is subject to a specific statutory or regulatory retention requirement in respect of particular records, such records shall be retained for the period prescribed by applicable law.

Upon expiry of the applicable retention period, or where personal data is no longer reasonably necessary for the purposes for which it was collected or otherwise lawfully retained, GEAF shall securely delete, destroy or anonymise such personal data, unless continued retention is required or otherwise permitted under applicable law.

GEAF shall implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, disclosure or access, having regard to the nature, scope, context and purposes of the processing and the risks presented to individuals.

Access to personal data shall be restricted to individuals who require such access for legitimate organisational purposes. Access rights shall be reviewed and withdrawn when no longer required. GEAF may implement security measures including password protection, multi-factor authentication, access controls and encryption during transmission, where appropriate.

Personnel, volunteers and other persons authorised to process personal data on behalf of GEAF shall be subject to appropriate confidentiality obligations.

Identity documentation shall be subject to enhanced access and security controls and shall be accessible only to specifically authorised persons.

Where GEAF becomes aware of a personal data breach, GEAF shall assess the nature and potential consequences of the breach and shall notify the competent supervisory authority and affected individuals where, and within the timeframe, required by applicable data protection law.

Subject to the conditions, limitations and exemptions provided under applicable data protection law, individuals may have the right to:

• request information regarding, and access to, personal data processed by GEAF and obtain a copy thereof;
• request the rectification of inaccurate or incomplete personal data;
• request the erasure or deletion of personal data;
• request restriction of processing in certain circumstances;
• object to certain processing activities, including, where applicable, processing for direct-marketing purposes;
• request the portability of eligible personal data in a structured, commonly used and machine-readable format; and
• withdraw consent at any time where GEAF relies upon consent as the legal basis for processing.

The exercise of these rights may be subject to applicable statutory conditions, limitations and exemptions. In particular, GEAF may be required or permitted to retain certain personal data notwithstanding a request for deletion, including where retention is necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.

Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

Requests relating to the exercise of data protection rights may be submitted to [contact email]. GEAF shall respond within the timeframe prescribed by applicable data protection law.

Individuals also have the right to lodge a complaint with the competent data protection or supervisory authority in accordance with applicable law.

GEAF does not currently make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.

GEAF’s website or communications may contain links to websites, platforms or services operated by third parties. GEAF does not control the privacy practices of such third parties, and this Policy does not apply to personal data processed independently by them.

Individuals are encouraged to review the applicable privacy notices of third-party websites, platforms or services before providing personal data to those parties.

GEAF may amend or update this Policy from time to time to reflect changes in its activities, processing practices, legal or regulatory requirements, or other relevant circumstances.

The current version of this Policy shall be made available through GEAF’s website and shall indicate the date on which it was last updated.

Where GEAF makes a material change to this Policy, GEAF shall take reasonable steps to bring such change to the attention of affected individuals where required or appropriate.

Where this Policy is made available in more than one language and there is any inconsistency or discrepancy between the different language versions, the English-language version shall prevail, to the extent permitted by applicable law.