Last revised: 13 November 2026. This notice covers the contact, subscription, event, survey, Bureau document and website-management activities on ngoforbgeneva.org. It addresses EU GDPR, applicable Spanish data-protection and electronic-communications rules, and, where applicable, the Swiss Federal Act on Data Protection (FADP).
1. The Committee, the website operator and the host
The Committee: NGO Committee on Freedom of Religion or Belief (Geneva) is an unincorporated NGO committee operating from Geneva, Switzerland, through its Bureau and authorised representatives. It is not presented as a separately registered Swiss company or foundation. It organises the Committee's membership activities, correspondence, meetings and publications. Correspondence address: Palais des Nations, Geneva.
The website operator in Spain: Fundación para la Mejora de la Vida, la Cultura y la Sociedad (Fundación Mejora) is a Spanish foundation that provides and administers the Committee's website and related technical infrastructure. Postal address: Calle Santa Catalina, 7, 28014 Madrid, Spain. Its operation of the website does not, by itself, mean that Infomaniak or the Committee's hosting account holder makes every decision about how Committee member data is used.
Controller arrangement: Fundación Mejora is the data controller for the website processing described in this notice, determining its purposes and essential means in support of the Committee's activities. The Committee's Bureau and authorised users carry out the relevant programme and review work within that arrangement. This statement does not claim that the Committee is an incorporated Spanish or Swiss legal entity.
Hosting provider: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Acacias, Switzerland, provides Swiss hosting infrastructure. For personal data hosted on behalf of its customer, Infomaniak generally acts as a processor under its Data Processing Agreement, rather than as the controller of Committee mailing lists or applications. Infomaniak may act as a separate controller for its own customer-account and billing data.
Privacy requests and contact point: You can use the dedicated privacy-rights page for an access, correction, erasure or other data-protection request, or write to contact@ngoforbgeneva.org. Fundación Mejora, through its authorised website/privacy administration, oversees the request and coordinates with relevant Committee personnel where operational input is needed.
2. Why we use information, on what basis, and for how long
Active general contacts in the Committee registry may receive the monthly FoRB news digest by default under the Committee's documented communication policy, where an appropriate lawful basis and applicable electronic-communications rules permit it. Established Committee members, participants and reviewed historical Committee contacts may additionally receive routine Committee announcements and meeting/event invitations by default. Each category can be switched off separately through the personal email-preferences link, and a global unsubscribe suppresses all general mailings. A one-time event registration, survey response or application does not by itself create an ongoing general-contact relationship. Optional subscriptions outside these defaults use a confirmation step.
| Data and activity | Purpose and GDPR legal basis | Retention criteria |
|---|---|---|
| Monthly/weekly FoRB digests and Committee communication preferences: email, name, language, frequency, Committee relationship where applicable, category choices, confirmations and withdrawal records. | Keep the Committee network informed under the documented relationship/contact policy and an appropriate legal basis for the particular communication (for example proportionate legitimate interests where applicable, or consent/confirmation where required). Electronic-communications rules are assessed separately. Every general mailing provides preference and withdrawal controls, and event-only/survey-only records are not converted into ongoing general contacts. | While the relevant contact or Committee relationship remains current and the communication purpose continues; afterwards only necessary administrative or suppression records are retained, subject to periodic review. |
| Contact profile and optional My FoRB Portal: supplied identity and organisation details, profile photograph, short biography, website/social profiles, language, portal-account linkage and self-service changes. | Maintain an accurate relationship/contact record and, where the Committee enables a personal portal, allow the contact to review/update their own supplied information and communication preferences. Depending on the relationship and action, the basis may be performance of requested services/steps (Article 6(1)(b)), proportionate legitimate interests (Article 6(1)(f)) or consent where required. Portal access does not give the contact staff/admin rights or authority to alter Committee classifications. | While the contact relationship or portal is active and thereafter according to the underlying contact purpose, suppression/audit needs and documented retention review. Disabling portal access does not automatically erase lawful historical records. |
| Meetings and event registration: name, email, organisation, RSVP, reminder choices, event access details and participation-related correspondence. | Organise requested participation and selected reminders: pre-contractual steps/agreements where appropriate (Article 6(1)(b)) or proportionately pursued legitimate interests (Article 6(1)(f)). Where an event was proposed by an external organiser/contact, the Committee may explicitly enable event-scoped organiser access: counts only by default; names/organisation/RSVP, full contact details, or registration management only where appropriate and disclosed. This never grants access to the wider contact registry. Any unsolicited invitation must also comply with applicable electronic-communications rules; it is not automatically permission for general marketing. | During the meeting and follow-up, with an initial review trigger 24 months after the event; earlier deletion where no longer needed, longer only when justified or legally required. |
| Private enquiries: sender details, message, documents where provided, and reply history. | Respond to correspondence and safeguard our activities: legitimate interests (Article 6(1)(f)) or pre-contractual steps (Article 6(1)(b)) where applicable. No newsletter opt-in is inferred. | Until resolved, with a proposed annual review and normally deletion within 12 months after closure unless retention is justified or legally required. |
| Membership applications: organisation, representatives, credentials, application answers, review notes and decisions. | Assess eligibility and administer Committee membership: steps at the applicant's request where applicable (Article 6(1)(b)) and/or proportionate legitimate interests (Article 6(1)(f)). A separate Article 9 condition is needed if sensitive personal-belief data is genuinely processed. | During review and any active membership, subject to periodic review. Refused or withdrawn applications are flagged for review after 12 months, subject to justified retention and legal claims. |
| Website access/security: IP addresses, timestamps, necessary cookies, login details, anti-bot signals and technical logs. | Site security, fraud prevention and service reliability (Article 6(1)(f), as applicable). Non-essential analytics and marketing technologies may require prior consent and a separate cookie notice. | Proportionate technical/security log periods; exact periods depend on documented site settings and provider contracts. |
3. One contact registry, with purpose-specific controls
We use a shared contact registry to avoid duplicate records and correctly associate submissions made by the same person. Where authorised staff verify that two records are duplicates, they may be merged into one canonical contact. The absorbed email address is retained as an alternate identity alias and the merge is logged so earlier registrations, mail history and governance records remain attributable without rewriting the historical address on those records. An alias is not automatically a second active bulk-mail recipient. Event participation, membership applications, messages and communication preferences remain logically distinct. A technical record created only for an event, survey or application is not automatically treated as an active general mailing contact. Active general contacts may fall within the monthly-digest default where the Committee has documented an appropriate basis; Committee working notices and meeting/event invitations additionally depend on an established Committee relationship or another recorded basis. Preferences and withdrawals are recorded without automatically erasing lawful administrative records.
4. Mandatory fields and possible sensitive data
Each form identifies required fields. You may use the contact form without joining a mailing list. Our work concerns freedom of religion or belief, and submissions could disclose religious or philosophical beliefs, which may be protected as special-category data under GDPR Article 9 and as sensitive personal data under Swiss law. Please avoid providing unnecessary information about personal beliefs or third parties in free-text fields. Sensitive content must be assessed for necessity and an appropriate Article 9 exception, with restricted access; merely submitting a general-form privacy-policy acknowledgment is not explicit Article 9 consent.
5. Meetings, recording, participant names and photographs
Some Committee events are recorded internally, recordings may be circulated to registered attendees or published publicly, and photographs and participant names may be published in event reports. These are not automatic conditions of registering. The specific event invitation and registration page should identify in advance whether audio/video recording is planned, its audience, and whether photography/name publication is planned. Organisers should announce recording again at the meeting, explain how to avoid capture when feasible, and assess an appropriate lawful basis and objection or consent mechanism according to the intended use. Publishing identifiable footage or sensitive disclosures requires particular scrutiny. Recording distribution and retention must be assessed per event; no blanket permission is inferred from registration.
6. Who receives data and where processing happens
Only appropriately authorised members of the Committee and staff or contractors supporting Fundación Mejora should have access appropriate to their duties. Data may be handled by authorised personnel in Geneva and Spain. This website uses Infomaniak hosting and Mail/SMTP in Switzerland; Brevo/Sendinblue may process subscriber addresses and campaign interactions when used for newsletter delivery; Zoom and Infomaniak kMeet are used for virtual meetings; Cloudflare Turnstile and Google reCAPTCHA may assess abusive web submissions; Google Analytics/Site Kit and WPForms/Google Forms may process website interactions or applications when enabled. The actual destinations, roles, sub-processors and transfer safeguards for each service must be documented in the technical provider register. Merely naming a service here does not authorise it to operate without a proper lawful basis or cookie consent. Such services are to be documented and subject to suitable contractual protections where required. We do not sell membership lists to advertisers.
Additional declared service providers: Infomaniak (Switzerland) — website and database hosting; Mail/SMTP; kMeet and optional kDrive; review applicable DPA and provider sub-processors.
Brevo / Sendinblue — delivery of Committee email campaigns, subscriber addresses and campaign statistics; check contractual region and DPA.
Zoom — meeting participation, invitations and recordings when enabled; check account-specific processing region and terms.
Cloudflare Turnstile — anti-bot verification; check whether deployed on each active public form.
Google reCAPTCHA — anti-bot verification where enabled; assess data transfers, alternatives and relevant notices.
Google Analytics via Google Site Kit — optional website analytics; require verified prior consent and correct Site Kit/CMP setup.
Google Forms — external form hosting where used; avoid collecting unnecessary personal or sensitive information.
WPForms — WordPress form software; not automatically a separate external processor. Review any connected third-party integrations..
Cloudflare Turnstile, if enabled, may receive device and connection information to assess bot risk. Embedded media, analytics, web fonts and external mail services may involve separate service providers; only services actually used should appear in the final provider register. Necessary cookies and any optional consent-required technologies must be explained in an accurate cookies notice. Non-essential Google Analytics or similar tracking must be blocked until valid consent is obtained. The FoRB plugin includes a fail-closed control for the Site Kit GA4 tag pending an administrator-verified WP Consent API and cookie-consent setup; this does not control independently installed Google tags or other third-party scripts. Google Forms and embedded reCAPTCHA should be reviewed for minimisation and international transfers.
7. Transfers between Switzerland, Spain and other countries
Switzerland is outside the European Economic Area, but the European Commission recognises Switzerland as providing an adequate level of data protection under GDPR Article 45. Therefore hosting EU personal data in Switzerland does not, by itself, require EU Standard Contractual Clauses. Processing access by the Committee in Geneva and authorised personnel in Spain should follow the applicable GDPR and Swiss FADP rules. Transfers to service providers in other non-adequate countries, if any, require a separate assessment and an appropriate legal transfer mechanism, such as approved contractual clauses and any necessary supplementary measures. The precise list of recipients and locations must be checked against enabled services and account settings.
8. Identified surveys and Bureau governance documents
When you answer an optional Committee survey, we collect the answers, your name and email address, and confirmation that you control the email address. Verified answers are linked to the existing Committee contact registry, without automatically adding newsletter permissions. Survey results are accessible only to authorised Committee personnel. Identified response exports must be handled securely; results should be anonymised for broader publication where feasible. A survey may use consent or another documented appropriate legal basis depending on the questions and context. Avoid submitting sensitive religious-belief data unless specifically requested under a clearly explained Article 9 condition.
Authorised Bureau and Foundation users may access private governance documents and sign approved versions through individual WordPress accounts. The workspace records document versions, assigned signatory capacities, electronic signature declarations, time of signing, user and linked contact IDs, document hashes and limited security evidence. Signed governance records are retained for accountability and may require longer retention under the controllers' documented legal obligations or legitimate interests. Bureau documents may also contain names, comments, version histories, proposed revisions, per-version approval and rejection decisions, meeting minutes and joint statements. These records are restricted to the assigned Bureau users and kept for governance accountability according to the approved retention schedule. The on-site workflow produces ordinary electronic signatures, not qualified signatures under eIDAS.
9. Your rights and complaints
Depending on the law and circumstances, you may request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, or withdraw marketing consent at any time. We coordinate requests submitted through the dedicated secure privacy-rights page or sent to contact@ngoforbgeneva.org; EU GDPR requests are generally answered within one month, with lawful extensions where applicable. Email confirmation verifies control of an address, but additional proportionate identification may be needed before disclosure or erasure. The applicable Swiss law also provides rights to information and correction and other remedies. We may verify identity before releasing data.
Where GDPR applies, you may lodge a complaint with the competent EU/EEA data-protection authority, including the Agencia Española de Protección de Datos (AEPD) when competent, or the relevant authority in your place of residence, work or an alleged infringement. Where Swiss FADP applies, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). We do not restrict any statutory rights by our internal division of responsibilities.
10. Security, automated decisions and changes
We use authorised-access restrictions, validated forms, anti-bot controls and appropriate operational precautions. Automatic spam checks may block abusive submissions, but membership decisions are reviewed by authorised people rather than solely automated profiling with legal or similarly significant effects. We update this notice when practices change; the date and consent notice version are documented separately. For highly sensitive complaints, request an appropriate confidential channel before sending material through ordinary web forms.
Exercise your data-protection rights
You do not need to accept this privacy notice in order to exercise your rights. Use the dedicated secure request page for access, correction, erasure, restriction, objection, portability or another data-protection request.
Scope: The ngoforbgeneva.org contact registry, Committee communications, event registrations, membership workflow and website operation. The Committee's unincorporated status, the Foundation's Spanish legal identity and Infomaniak's Swiss hosting must not be confused. Other organisations and websites have their own notices.