Privacy Policy
**Privacy Policy for the Mensa Hub**
# **Introduction**
## **Who We Are**
Unless otherwise specified in this Privacy Policy, **Mensa International Limited**, company reg. no. 00848100, registered in the United Kingdom (hereinafter referred to as "MIL" or “we”/”us”/”our”), is the entity responsible for the processing of personal data described in this policy (the Controller). Our contact details can be found at the end of this Privacy Policy.
## **About this Privacy Policy**
We are committed to respecting your fundamental right of privacy and complying with applicable data protection laws. In this Privacy Policy, we describe the personal data collected, used and accessed within the scope of providing the Mensa Hub platform (hereinafter referred to as “the Hub”).
## **Definitions**
_Personal data_ means any information that can be directly or indirectly linked to a natural, living person. Examples of personal data include name, address, phone number, and email address. Information such as IP address and user behaviour on our website also constitutes personal data.
_Processing_ of personal data refers to all handling of such data, including collection, use, storage and deletion.
_Controller_ means the person or entity which, alone or jointly with others, determines the purposes and means of the processing of personal data and is responsible for ensuring that the processing complies with applicable data protection law.
# **How and When we Process your Personal Data**
## **Account Administration**
We process personal data in order to enable you to register and adjust settings for your account, and in order to administrate your account as necessary.
We may perform mainly the following processing activities to fulfil this purpose:
- Send information about how to join the Hub
- Register account creation
- Communicate important information about the Hub and your account
- Register user settings and preferences
- Register updates to user account
- Administrate group membership and access rights
- Administrate space memberships
- Periodically cross-check user account against MIL member database
- Disable or delete account
| **Personal Data** | Name<br><br>Username<br><br>E-mail address\*<br><br>Password\*\*<br><br>Country of residence<br><br>Membership number<br><br>User groups\*\*\*<br><br>User settings<br><br>Account meta data\*\*\*\*<br><br>“About” information\*\*\*\*\*<br><br>_\* This includes your personal Mensa e-mail alias, which is used to send out information about how to register a user account on the Hub._<br><br>_\*\* Please note that we do not have access to your password. Password is only processed at login and as confirmation for certain account-related updates._<br><br>_\*\*\* We may add you to a user group in order to give you certain admin rights or to facilitate communication with users belonging to a certain group, for example, users who are international volunteers._<br><br>_\*\*\*\* This may include, e.g., which date and time content was posted or a message was sent._<br><br>_\*\*\*\*\* This refers to a text field headlined “About” during the registration step and in your profile, which you may fill in with any information about yourself._ |
| ------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Legal Basis** | The processing performed to enable and facilitate account registration is necessary in order to fulfil MIL’s contractual obligations towards all members in international good standing, as set out in the Constitution III.F. <br><br>The processing performed to administrate your account after it has been created is necessary in order to fulfil the contractual obligations as set out in the Hub’s Terms and Conditions. |
| **Retention Period** | Your account data is retained for as long as your account is active and has not been deleted. Certain data may be retained beyond this period of time for security and backup purposes. |
## **Provision of the Hub’s Services**
The purpose of the Hub is to facilitate communication between members of Mensa, as well as between members and officers of the organisation. We process personal data in order to enable you to publish posts and other content, interact with content, interact with other members through messages or otherwise, create spaces, customise your user profile, and otherwise use the Hub for its intended purpose.
Mainly the following processing activities may be performed to fulfil this purpose:
- Register and display user content and profile information
- Communicate messages between users
- Display and send notifications
- Create and administrate spaces
- Fetch, generate and present search results
- Activate/deactivate modules in user profile
- Provide additional user-requested services, such as modules
- Review, moderate and, if necessary, delete user content
| **Personal Data** | Name<br><br>Username<br><br>User profile\*<br><br>Space membership<br><br>Space ownership<br><br>Activated modules<br><br>Users you follow<br><br>Users who follow you<br><br>Users you have blocked<br><br>Users who have blocked you<br><br>Online status<br><br>User content\*\*<br><br>Messages that you send and/or receive<br><br>Interactions with user content or messages\*\*\*<br><br>Meta data about your content and activity\*\*\*\*<br><br>_\* The Hub provides a number of standard fields for your profile, such as title, address, birthday date, phone number and e-mail address. There are also more general fields such as “About”, where you may supply more information about yourself. Most of these fields are not required to fill out in order to use the Hub. For information about the visibility of your personal data on the Hub, please see “How We Share Your Personal Data”._<br><br>_\*\*_ _This may include, e.g., text posts, images, videos, polls, files, articles, documents, wiki pages, landing pages, calendar events and comments._<br><br>_\*\*\* This may include, e.g., likes, shares, poll votes, tags, pins and bookmarks._<br><br>_\*\*\*\* This may include, e.g., which date and time content was posted or a message was sent, or which topics you have set for your posts._ |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Legal Basis** | The processing is necessary in order to fulfil the contractual obligations as set out in the Hub’s Terms and Conditions, including to provide the services you choose to use on the Hub.<br><br>Information volunteered by you (such as voluntary fields filled in in your user profile or personal data you choose to include in posts, messages or other content) is processed with your consent. This includes any special categories of personal data\* which you choose to fill in, post, include in messages, or reveal through Space membership. You can withdraw your consent by deleting the user content or other personal data yourself.<br><br>_\* Special categories of data include the following, according to law: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, data concerning sex life or sexual orientation._ |
| **Retention Period** | Personal data will be processed for this purpose until you choose to delete it from the Hub. Profile data will be deleted if you delete your account. User content will be retained until you choose to delete specific content from the Hub. Undeleted messages with other users will be retained for as long as either your account or the other user’s account is active, but a deleted profile will no longer be connected to those messages. User content that has not been deleted by you before account deletion will be retained indefinitely for the purpose of maintaining historical discussions and content on the Hub; however, you may contact a Hub admin to delete all of your content as well. Certain data may be retained beyond this period of time for security and backup purposes. |
## **Analysis and Statistics**
We collect data about user activity on the Hub. This data is only used by us in aggregated form to evaluate and improve the Hub. For example, we may use the statistical data to determine whether certain spaces or functions should be discontinued for lack of usage.
You can see your own activity data on your profile. Other users cannot see your activity data.
We perform the following processing activities to fulfil this purpose:
- Collect activity data
- Present each user’s activity data to them
- Aggregate activity data
- Analyse aggregated data
| **Personal Data** | Username\*<br><br>User activity\*\*<br><br>_\* The username is only processed in order to collect the activity data. We do not analyse or otherwise use activity data on an individual user-level, nor do we see your username in the aggregated dataset._<br><br>_\*\* User activity includes, e.g., number of posts created, number of private messages sent, or number of logged-in users per day._ |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Legal Basis** | The processing is necessary in order to fulfil our legitimate interest of evaluating and improving the Hub. |
| **Retention Period** | User activity is retained for as long as your account is active. Certain data may be retained beyond this period of time for security and backup purposes. We may retain anonymous statistical data indefinitely. |
## **Cookies**
Cookies are small text files that are placed on your device by websites that you visit. They are widely used to make websites work more efficiently, as well as to provide information to the site owners. Cookies can be used for various purposes, such as enabling the website to remember your preferences, helping you navigate between pages efficiently, and generally improving your browsing experience. Importantly, we only use cookies that are technically necessary for the operation of our website, and not for advertising or marketing purposes.
### **Cookies Used on Our Website**
We use the following types of cookies on our website:
1. **Session Cookies**
- **Name**\: PHPSESSID
- **Purpose**\: To maintain your session and ensure the website functions properly during your visit.
- **Domain**\: [workplace.mensa.org](http://workplace.mensa.org/)
- **Expiry**\: These cookies are temporary and expire when you close your browser.
2. **Security Cookies**
- **Name**\: _csrf
- **Purpose**\: To protect against Cross-Site Request Forgery (CSRF) attacks by ensuring that the requests made by the user are genuine.
- **Domain**\: [workplace.mensa.org](http://workplace.mensa.org/)
- **Expiry**\: These cookies expire at the end of your session.
3. **Authentication Cookies**
- **Name**\: _identity
- **Purpose**\: To store user identity information for authentication and session management purposes.
- **Domain**\: [workplace.mensa.org](http://workplace.mensa.org/)
- **Expiry**\: These cookies expire one month from the date they are set.
4. **Consent Cookies**
- **Name**\: cookieconsent_status
- **Purpose**\: To store the user's consent status regarding cookie usage, preventing the consent banner from showing repeatedly.
- **Domain**\: [workplace.mensa.org](http://workplace.mensa.org/)
- **Expiry**\: These cookies expire one year from the date they are set.
5. **Preference Cookies**
- **Name**\: language
- **Purpose**\: To remember your language preference for the website, ensuring that the user interface is displayed in the preferred language.
- **Domain**\: [workplace.mensa.org](http://workplace.mensa.org/)
- **Expiry**\: These cookies expire one year from the date they are set.
6. **Embedded Content Cookies**
- **Name**\: VISITOR_INFO1_LIVE
- **Purpose**\: To track user preferences for YouTube videos embedded on sites and determine which interface the user is using.
- **Domain**\: .youtube.com
- **Expiry**\: These cookies expire six months from the date they are set.
- **Name**\: VISITOR_PRIVACY_METADATA
- **Purpose**\: To store privacy settings or preferences related to user interactions with YouTube content.
- **Domain**\: .youtube.com
- **Expiry**\: These cookies expire six months from the date they are set.
- **Name**\: YSC
- **Purpose**\: To track views of embedded YouTube videos.
- **Domain**\: .youtube.com
- **Expiry**\: Session (expires when the browser is closed)
### **Managing Cookies**
You have the ability to accept or decline cookies by modifying your browser settings. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. For detailed instructions on how to control and delete cookies, please refer to your browser's help section or visit [www.allaboutcookies.org](http://www.allaboutcookies.org/).
# **How We Share Your Personal Data**
## **Other users on the Hub**
The purpose of the Hub necessitates sharing of certain user information with other users on the Hub. You alone decide how much information you want to share about yourself on the platform, such as in your public profile or through content you post in Spaces, and have the option to delete information that you have shared previously.
You have the option to set the visibility (user permissions) for the information in your user profile. In the Hub’s member list, your name, title, country, profile tags, about information, photo and header image will be visible. However, only name, country and city are searchable through the search function.
## **Transfers to third parties**
The circumstances under which we may authorise third parties to process or store your data are outlined below.
In order to fulfil the purposes of our processing of your personal data, we may share your personal data with companies that provide services to us, e.g., to host the Hub or to cross-check your account against the international member database. These companies are only allowed to process your personal data on our instructions and are not allowed to use your data for any purposes of their own.
We may also on occasion outsource work or liaison duties to trusted individuals not in our direct employment. For example, we may share certain personal data with trusted volunteers of MIL if necessary to fulfil one of the purposes described in this Privacy Policy. These individuals will have agreed to abide by our Privacy Policy and entered into confidentiality agreements where necessary.
If you allow embedded content to be loaded on the Hub – for example, in order to watch an embedded YouTube video – please note that certain data about, e.g., your interactions with that embedded content may be transferred to the third party that supplies the content. The third party in question is the data controller for the processing of your data for this purpose. You can read more about this in our cookie information.
## **Transfers outside the UK**
We strive to process your personal data within the UK. In the case that we need to transfer your personal data outside the UK, we will do so only after ensuring that the level of protection of your personal data guaranteed UK data protection law is not undermined.
For instance, we may transfer personal data outside the UK based on an adequacy decision; that is, if the third country in question has been deemed to provide adequate protection for people’s rights and freedoms concerning their personal data. For example, EU Member States have been deemed to provide such adequate protection.
We may also transfer personal data outside the UK after entering into a contract with the recipient which incorporates standard data protection clauses recognised or issued in accordance with UK data protection laws.
# **Your Rights**
## **Details on Your Rights**
Under the UK General Data Protection Regulation (UK GDPR), you have the below rights.
Please note that you can view, access and delete most of your own personal information on the Hub itself.
**Right of access**
You have the right to request information about whether we process your personal data and, if so, to access that data and information about how we use it. You also have the right to request a copy of your personal data. The first copy you request is free of charge, but additional copies may be subject to a fee. If you submit your request in an electronic format, we will provide it to you electronically, if possible. If you do not specify a particular electronic format, we will provide the information in a commonly used format, such as PDF.
If providing the information would adversely affect the rights and freedoms of others, we may refuse to disclose certain personal data. Please also note that the right of access does not mean that you always have the right to receive the actual document or file where your personal data is processed.
Please note that you can view and access most of your own personal information on the Hub itself.
**Right to rectification**
You have the right to have inaccurate personal data corrected without undue delay. If appropriate with regards to the purpose of our processing, you also have the right to have incomplete personal data completed, for example by providing us with supplementary information. Please note that you can adjust your own settings and personal information in most cases on the Hub itself.
**Right to restriction of processing**
A restriction of processing means that the personal data may only be used and processed in certain limited manners, for example, in that we may only store the personal data but not process it in any other manner during the time that the restriction applies. Other use may only take place with your consent, to protect the rights of others, or for an important public interest. You have the right to request that we restrict the processing of your personal data in the following situations:
- If the processing is unlawful and you oppose the erasure of the personal data, you can instead request that its use be restricted.
- If we no longer need the personal data for the purposes of the processing, but you need the personal data to establish, exercise or defend against legal claims, you may request that we retain the data for that purpose only.
- If you object to a processing of your personal data (in one of the circumstances outlined in this Privacy Policy), you have the right to request that the processing of your personal data be restricted while we verify whether our legitimate grounds for processing override your interests.
If we restrict the processing of your personal data, we are obliged to notify you before the restriction is lifted.
**Right to erasure (‘right to be forgotten’)**
You have the right to request the deletion of your personal data. We are obligated to delete your personal data without delay in the following cases:
- When the personal data is no longer necessary for the purposes for which it was collected.
- If you revoke the consent on which the processing is based and there is no other legal basis for the processing.
- If you object to the processing (in one of the circumstances outlined in this Privacy Policy), and there are no legitimate grounds for the processing which outweigh your interests.
- If the personal data has been unlawfully processed.
- If the personal data must be deleted in order to comply with a legal obligation.
Please note that in certain circumstances, we may not be able to fulfil your request to have your personal data erased. We may refuse your request in whole or in part if our processing is necessary for any of the following reasons:
- To fulfil other important rights, such as the right freedom of expression and freedom of information.
- To comply with legal obligations.
- For the establishment, exercise or defence of legal claims.
- For archiving purposes in the public interest, or for scientific, historical or statistical purposes.
You can delete most of your own personal information, including content, on the Hub itself. You can also delete your own account on the Hub, which also deletes your profile and account information. In order to permanently delete everything tied to your account, including all user content, please contact a Hub admin.
**Right to compensation**
If you have suffered damage because your personal data has been processed unlawfully, you have the right to request compensation.
**Right to lodge a complaint with the Information Commissioner**
If you believe that our processing of your personal data is unlawful or not carried out correctly, you have the right to lodge a complaint with the Information Commissioner (ICO). The ICO is the regulatory authority responsible for enforcing privacy laws in the UK, where MIL is based.
**Right to object**
If we are processing your personal data based on legitimate interests, you have the right to object to such processing on grounds relating to your particular situation. If so, we will no longer process the personal data, unless we can either demonstrate compelling legitimate grounds for the processing which override your given grounds, or if we need to continue the processing for the establishment, exercise or defence of legal claims.
**Right to withdraw your consent**
With regards to processing carried out on the basis of consent, you have the right to withdraw your consent at any time, in which case the personal data must cease to be processed. However, the withdrawal of your consent does not affect the lawfulness of processing based on consent performed before the withdrawal.
You can withdraw your own consent on the Hub itself by, e.g., deleting content you have posted or information in your own profile.
**Right to move your personal data (“data portability”)**
Automated processing (e.g. in an IT system) carried out based on your consent or on a contract, where the personal data has been collected directly from you, is covered by the right to data portability. This means that you have the right to request your personal data in a structured, commonly used and machine-readable format. Please note that you can view and access most of your own personal information on the Hub itself.
## **How to Exercise Your Rights**
You are always welcome to contact us with your questions or concerns about how we process your personal data, or to exercise one of your rights. All requests should be made in writing and submitted by you personally or emailed from the email address you have registered on the Hub to [[email protected]](mailto:[email protected])ational. You can also reach out to our Data Protection Officer (DPO) at [[email protected]](mailto:[email protected]).
We may ask you to confirm your identity before we begin processing a request to exercise your rights. If your request is manifestly unfounded or excessive, we may request a reasonable fee from you or deny your request.
You can read more about your rights on the Information Commissioner’s website: [https://ico.org.uk/for-the-public/](https://ico.org.uk/for-the-public/).
# **Updates to this Privacy Policy**
We may update this Privacy Policy from time to time, e.g., if we were to process your personal data for new purposes, collect additional data or share your data with new recipients. The latest version of the Privacy Policy is always published on the Hub.
| **Revision history** | |
| ---------------- | --- |
| 2024-06-29 | Version 1.0 |
| 2024-07-16 | Minor updates and clarifications |