Your information deserves respect and protection.

1. Who is responsible for your information?

The proposed future operating entity is currently referred to as SGSITS Community Trust. This is a provisional working name only. It does not represent a statement that a trust or other legal entity has already been established, registered or authorised.

At present, the project is being developed by an individual. The person or legal entity that actually determines the purposes and means of processing personal information will be identified as the data controller, data fiduciary or equivalent responsible party under the laws that apply to the relevant processing.

We will not present the proposed trust as the legal controller until it has been properly constituted and has formally assumed the relevant responsibilities.

2. Scope of this policy

This policy applies to personal information processed through the We Seksarians website, member accounts, community directory, events, communications and other related services that are operated under the We Seksarians identity.

It covers information relating to prospective members, registered members, alumni, students, faculty, staff, institutional partners, event participants, website visitors and people who communicate with the community.

Where a separate notice applies to a particular event, form, service or activity, that notice should be read together with this policy.

3. Personal information we may collect

The information collected will depend on the service used and the information a person chooses or is required to provide.

We do not intend to collect sensitive personal information unless it is necessary for a clearly identified purpose, an applicable legal condition is satisfied and appropriate safeguards are in place.

Please do not submit passwords, financial account credentials, government identity numbers or other highly sensitive information through general profile or contact fields.

4. How and why we use personal information

Personal information may be processed only for specific, explicit and legitimate purposes. These may include:

• Create, authenticate, maintain and secure member accounts.
• Verify membership eligibility and institutional or community associations where applicable.
• Operate the community directory and enable members to reconnect.
• Facilitate events, reunions, mentoring, networking and community participation.
• Publish member-submitted profiles, achievements or contributions where appropriate permission has been obtained.
• Respond to enquiries, provide support and communicate essential service information.
• Maintain platform integrity, prevent misuse, investigate security incidents and enforce community standards.
• Meet applicable legal, regulatory, accounting and record-keeping obligations.
• Improve accessibility, reliability and performance using proportionate operational information.

We will not introduce materially different purposes without first assessing the applicable legal requirements and providing any required notice or obtaining any required consent.

5. Legal grounds for processing

Where a law requires a lawful basis or other legal condition, the responsible operator will identify and document it for each processing activity. Depending on the jurisdiction and purpose, this may include:

• Consent: where an individual has freely and validly agreed to a specified use of their information.
• Contract or requested service: where processing is necessary to provide a service or take steps requested before entering into an agreement.
• Legal obligation: where processing is required to comply with applicable law.
• Legitimate interests: where recognised by applicable law, properly assessed and balanced against individual rights and interests.
• Other permitted grounds: where a specific jurisdiction provides another applicable legal basis or condition.

Consent will not be treated as a universal legal basis for every activity. Where consent is relied upon, it must be appropriately informed, specific and freely given, and withdrawal must be respected in accordance with applicable law.

6. Community directory and profile visibility

The community directory is intended to help members reconnect and discover fellow members. Directory publication requires particular care because information made visible to other members or the public may be copied, indexed or redistributed by others.

Before public launch, the directory must have clear visibility settings and appropriate member-facing disclosures. Members must be told which profile fields are visible, to whom they are visible and how to request a change or removal where applicable.

Information that may be considered for directory display includes a member's name, academic batch, discipline, professional role and other profile details specifically designated for publication.

Account verification or membership status alone must not be interpreted as permission to publish every item of personal information.

7. When and with whom we share information

We do not intend to sell personal information. We will not disclose member information for unrelated advertising or commercial exploitation.

Information may be shared only where necessary and legally permitted, including with:

• Hosting, infrastructure, security, email and technical service providers acting under appropriate instructions and safeguards.
• Event or programme partners where a specific activity requires sharing and the appropriate notice or permission has been provided.
• Professional advisers, auditors or insurers where reasonably necessary and appropriately protected.
• Public authorities, regulators or law enforcement where disclosure is legally required or otherwise lawfully permitted.
• A successor or reorganised operating entity where a lawful transition takes place and appropriate safeguards and notices are provided.

Service providers must be assessed for their role, access, security measures, contractual obligations, locations of processing and any onward transfers. A provider must not use personal information for its own unrelated purposes merely because it supplies a service to the platform.

8. International data transfers

We Seksarians is intended to serve a worldwide community. Depending on the hosting location, service providers and member locations, personal information may be processed in countries other than the country in which the individual resides.

Before such transfers take place, the responsible operator must identify the relevant countries, recipients and transfer arrangements and implement any required adequacy decision, contractual safeguards, transfer assessment, consent or other lawful mechanism required by applicable law.

We will provide additional transfer information where required, including the relevant safeguards and how an individual may obtain further information about them.

9. Data retention and deletion

Personal information should be retained only for as long as it is reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

Retention decisions should take account of:

• The continued existence of the member account or requested service.
• Membership verification, security and fraud-prevention requirements.
• Applicable statutory, regulatory, accounting and record-keeping obligations.
• The resolution of disputes, complaints or legal claims.
• Whether information can be securely anonymised or deleted.

When information is no longer required, it should be securely deleted, anonymised or otherwise disposed of in accordance with the approved retention schedule. Backups and restricted archival records may be subject to separate deletion cycles where legally permitted.

10. Security and personal data breaches

Appropriate technical and organisational measures must be implemented to protect personal information against unauthorised access, disclosure, alteration, loss, destruction and other unlawful processing.

Depending on the risks and the nature of the information, safeguards may include:

• Access controls, role-based permissions and least-privilege administration.
• Secure authentication, password protection and session management.
• Encryption in transit and appropriate protection of stored information.
• Secure development, vulnerability management and software updates.
• Logging, monitoring, backup and recovery procedures.
• Staff, volunteer and service-provider confidentiality and security obligations.
• Documented incident response and breach assessment procedures.

No website or information system can guarantee absolute security. If a personal data breach occurs, the responsible operator will assess it and provide notifications to affected individuals and authorities within the timeframes and circumstances required by applicable law.

11. Your privacy rights

Depending on where you live and which law applies, you may have some or all of the following rights:

Some rights are subject to legal conditions, exceptions and limitations. The applicable response period also depends on the governing law. We will not impose a fee where the law requires a request to be handled free of charge, although permitted charges or refusals may apply to manifestly unfounded, excessive or repetitive requests where the law allows.

We may need to verify identity before disclosing, correcting or deleting personal information. We will request only information reasonably necessary for that verification.

Where a representative submits a request on another person's behalf, we may require evidence of authority, subject to applicable law.

12. Cookies and similar technologies

Cookies and similar technologies may be used where necessary to operate the website, maintain security, support requested features or remember preferences.

Non-essential cookies or tracking technologies will be assessed under the laws applicable to each visitor. Where prior consent is required, they must not be activated before valid consent is obtained. Refusing optional technologies should not prevent access to features that do not require them.

Some pages may load static resources from external content delivery networks or other providers. Those providers may receive technical connection information such as an IP address and browser metadata when a resource is requested. The actual providers and resources must be included in the pre-launch technology and privacy review.

13. Children and younger members

The community may be relevant to students and recent graduates. Some visitors or prospective members may be under the age of majority in their jurisdiction.

Before accepting personal information from children or younger individuals, the responsible operator must establish the applicable age thresholds, parental or guardian authorisation requirements, age-assurance measures and other safeguards required by the relevant law.

We will not knowingly rely on a general adult registration process where additional child-protection requirements apply. If information has been collected unlawfully from a child, we will assess the matter and take appropriate action under applicable law.

14. Automated processing and profiling

Routine technical processing may be used to authenticate accounts, protect the platform, detect suspicious activity and support search functionality.

We do not intend to make solely automated decisions producing legal or similarly significant effects on members as part of the current community directory or general participation model.

If profiling, automated eligibility assessment, ranking or other significant automated decision-making is introduced, the responsible operator must first assess the applicable legal requirements, provide meaningful information and implement any required explanation, human review or objection mechanisms.

15. External websites and services

The website may contain links to external websites, social networks, maps, event services or other third-party resources. Those services operate under their own privacy policies and terms.

We Seksarians is not responsible for the privacy practices of independent third-party websites. Please review their policies before providing personal information or interacting with their services.

Links to external websites do not automatically mean that personal information is shared with those websites. Any integration that does share information must be assessed and disclosed appropriately.

16. Changes to this policy

This policy will be reviewed periodically and whenever there are material changes to the legal operator, purposes of processing, data categories, service providers, international transfers, technologies or applicable legal requirements.

Where a change materially affects individuals' rights or how their information is used, we will provide appropriate notice and obtain consent where required before introducing the new processing.

The effective date and last-updated date will be clearly displayed. Previous versions should be retained for accountability and audit purposes.

17. Contact and privacy requests

Questions, concerns and requests relating to personal information should be directed to the responsible operator through the verified privacy contact details published here before the service becomes publicly operational.

Where applicable, individuals may also contact the competent data protection supervisory authority in their jurisdiction.