This Privacy Policy governs the way ECA Maastricht, registered in Tongerseweg 238, 6214BE Maastricht, The Netherlands, processes (collects, uses, maintains and discloses) your personal data in relation to the ECA’s activities. 

The following definitions apply:

“Personal Data”- Personal data is considered, following the GDPR definition, data that can reasonably identify a specific living person, either alone or with other information. 

“Managing Board” – Managing and supervising body of the association

“Association Council”- Council of the heads of each ECA portfolio

“Teams”- Teams of members that support the activities of certain portfolios

“Regular Member(s)”- Members that are not part of the Managing Board, the Association Council, and the Teams (organization). 

“Third Party(ies)”- Non-members that engage with ECA

“User”- Anyone who engages with ECA activities and provides personal data

When this Privacy Policy mentions “ECA”, “we”, “us”, or “our”, it refers to ECA Maastricht (the “Data Controller”), that is responsible for the processing of your personal data under this Privacy Policy. 

1. Information ECA Collects

   1. Membership Registration Information

      You give us this information when registering to be a member of ECA. 

      • Personal Information: First name and last name, date of birth, nationality and address.

      • Contact Details: Email and phone number.

      • Education: University, programme, faculty and year of study.

      • Payment information: Method of payment.

      • Others: How you heard about the association.

   2. Special Internal Forms

      Sometimes, for specific purposes, ECA will create special forms to collect necessary information for ECA activities. These are Board, Council and Team applications, as well as sign-ups for trips, special events, and ECA representations (to EuroMUN, for example). The information demanded in each of these can vary, but the forms will only include:

      • Personal Information: First name and last name, date of birth, nationality and address

      • Contact Details: Email and phone number

      • Selection Material: CV, motivation letter, experience and motivation statements.

      • ECA Card Number: Membership number.

   3. Special External Forms

      For certain special events, ECA will sometimes use a registration form to allow external participation of non-members. These forms collect:

      • Third-Party Personal Information: First name and last name.

      • Third-Party Contact Details: Email

2. Usage of information we collect

3. Sharing and Disclosure

1. Internal Sharing

The information is internally disclosed the following way:

• The Managing Board is the association’s management body. Hence, they automatically have access to your data to be able to conduct and survey all the activities and overall functioning.

• The Association Council has a restricted access to your data. Only counsellors that reasonably need your data will have access to it. 

• Councilperson for Internal Affairs: The position has access to Personal Information, Contact Details, Education, Others, ECA Card Number, Third Party Personal Information and Third-Party Contact Details: Because the counsellor is in charge of the alumni network, internal communication, newsletters, and other administrative tasks (sign-ups, for example). 

Furthermore, the position has access to the Internal Affairs team applications’ Selection Material, Contact Details, and Personal Information: Because the Councilperson is in charge of the respective team selection.

• Councilperson for Marketing: The position has access to the Marketing team applications’ Selection Material, Contact Details, and Personal Information: Because the Councilperson is in charge of the respective team selection.

• Councilperson for Workshops: The position has access to the relevant sign-ups’ Selection Material, Contact Details, Personal Information, Third-Party Personal Information and Third-Party Contact Details: Because the Councilperson is in charge of the respective member selection and is in charge of Workshops, which involves the usage of the above mentioned data.

• Councilperson for Special Events: The position has access to Third-Party Personal Information and Third-Party Contact Details: Because the Councilperson is in charge of Special Events, which involves the usage of these data.

• Councilperson for External Affairs: The position has access to Selection Material, Personal Information, and Contact Details: Because the councilperson is in charge of the respective member selection.

Furthermore, the Councilperson has also access to the Regular Meetings team applications’ Selection Material: Because the Councilperson is in charge of the respective team selection. 

• Councilperson for Blog: The position has access to the Blog team applications’ Personal Information, Contact Details, and Selection Material: Because the Councilperson is in charge of the respective team selection. 

• The Advisory Board is the association’s consultative body. Hence, it has access to certain information to be able to give advice to the Managing Board and Association Council. The Advisory Board will have access to all the data when necessary for advising and consultative purposes. 

• Teams and Regular Members do not have access to personal data from Regular Members or Third Parties.

2. Public Disclosure of Information

Under no circumstances will personal data be disclosed publicly. However, anonymous statistics based on personal data (e.g. nationality, education) may be used for marketing purposes.

3. Service Providers

ECA uses a variety of third-party service providers which help providing a better service to the student community and our members. Each of these service providers gathers and processes their own data, and have their own privacy policy, which you can check in the links below.  

• MailChimp: Used for internal communication. Data provided: Personal Information (Name, Last Name and Date of Birth), Contact Details (Email). Click here for their privacy policy.

• Doodle: Used for internal administration. No data provided, but they may gather data independently when used. We would like to point out that as a provider of the pages we have no knowledge of the content of the transmitted data as well as their usage. Click here for their privacy policy. 

• PayPal: Used for payments. No data provided, but they may gather your payment details when used. We would like to point out that as a provider of the pages we have no knowledge of the content of the transmitted data as well as their usage. Click here for their privacy policy.

• Squarespace: Used for website and analytical services. No data directly provided, but they do gather data to provide us with analytics (anonymized information). Click here for their privacy policy. 

• Instagram: Used for marketing and communication. No data directly provided, but they may gather data independently when used. We would like to point out that as a provider of the pages we have no knowledge of the content of the transmitted data as well as their usage. Click here for their privacy policy.

• WhatsApp: Used for internal communication. Click here for their privacy policy.

• Linktree: Used for communication. No data directly provided, but they may gather data independently when used. We would like to point out that as a provider of the pages we have no knowledge of the content of the transmitted data as well as their usage. Click here for their privacy policy.

• Google Drive: Used for document and data management. Google drive contains all the personal data. Click here for their privacy policy. 

• Google Forms: Used for selection processes and sign-ups. Apart from the information they gather on our behalf (e.g. Selection Material), they may gather their own data independently. We would like to point out that as a provider of the pages we have no knowledge of the content of such data as well as their usage. Click here for their privacy policy. 

Furthermore, ECA might share data if necessary to more third parties. You will be informed if this is the case. 

4. Safety and Compliance with Law

ECA discloses your information to courts, law enforcement or governmental authorities, or authorized third parties, if and to the extent that we are required to do so by law or if such disclosure is reasonably necessary: (i) to comply with legal process and to respond to claims asserted against ECA, (ii) to respond to verified requests relating to a criminal investigation or alleged or suspected illegal activity or any other activity that may expose us, you, or any other of our Users to legal liability, (iii) for fraud investigation and prevention, risk assessment, customer support, product development and debugging purposes, or (v) to protect the rights, property or personal safety of ECA, its members, or members of the public. 

We will attempt to notify Users about these requests unless: (i) providing notice is prohibited by the legal process itself, by court order we receive, or by applicable law, or (ii) we believe that providing notice would be futile, ineffective, create a risk of injury or bodily harm to an individual or group, or create or increase a risk of fraud upon ECA and its members. In instances where we comply with legal requests without notice for these reasons, we will attempt to notify that Users about the request after the fact if we determine in good faith that we are no longer legally prohibited from doing so and that no Risk Scenarios apply.

4. Storage of Data

1. Where?

The data is stored on files within the association’s Google Drive. For their privacy policy click here. Furthermore, some of this data is also stored within other service providers. You can check which data goes where on Service Providers. The data is securely stored by google, via encryption and special security programmes. Check it here. 

2. For how long?

Your data will not be stored longer than necessary for the purposes for which they are collected. Only where there is a legal obligation will we store the data for a longer time.  

5. Your Rights 

You have the right to:

• Information about and access to your personal data

• Rectify your personal data

• Erasure of your personal data

• Restriction of processing of your personal data

• Object to the processing of your personal data

• Receive your personal data in a structured, commonly used and machine-readable format and to (have) transmit(ted) your personal data to another organization.

To exercise any of these rights send an email to board@ecamaastricht.org.

Finally, you also have the right to lodge a complaint with the relevant data protection authority including the Dutch Data Protection Authority relating to the processing of your personal data by ECA. 

• Address

Autoriteit Persoonsgegevens

PO Box 93374

2509 AJ DEN HAAG

• Phone Number

(+31) - (0)70 - 888 85 00

6. Contact

If you have any questions or complaints about this Privacy Policy or ECA’s personal data practices, you can contact us at ECA Maastricht Tongerseweg 238, 6214BE Maastricht, The Netherlands. You can also send an email to board@ecamaastricht.org.