Privacy PolicyThis Privacy Policy sets out how we, the International Cannabinoid Research Society (ICRS), obtain, store and use your information when you use or interact with our website, www.icrs.com (our website), or where we otherwise obtain or collect your information. Summary This section summarises how we obtain, store and use information about you. It is intended to provide a very general overview only. It is not complete in and of itself and it must be read in conjunction with the corresponding full sections of this Privacy Policy.
3. Our details The data controller in respect of our website is the International Cannabinoid Research Society. The data controller is the person which determines the purposes and means of processing your information. You can contact the data controller by sending an email to [email protected]. If you have any questions about this Privacy Policy, please contact the data controller. 4. How we collect or obtain information about you 4.01 Information collected from you We collect information about you when you provide it to us, such as through your use of our website and its features, when you contact us directly by email, phone, in writing, or via social media, or any other means by which you provide information to us. The type of information we collect about you includes information such as:
4.02 Our use of cookies and similar technologies Cookies are data files which are sent from a website to a browser to record information about users of a website. We use cookies and similar technologies on or via our website. For further information on how we use cookies and similar technologies, including the information we collect through our use of cookies and similar technologies, please see our cookies policy, which is available via the following link: https://www.icrs.com/cookies-policy You can reject some or all of the cookies we use on or via our website by changing your browser settings, but doing so may impair your ability to use our website or some or all of its features. For further information about cookies, including how to change your browser settings, please visit www.allaboutcookies.org We use Google Analytics on our website to understand how you engage and interact with it. For information on how Google Analytics collects and processes data using cookies, please visit www.google.com/policies/privacy/partners/. You can opt out of Google Analytics tracking by visiting: https://tools.google.com/dlpage/gaoptout We use web beacons on our website. For information on how third parties use information gathered from our use of web beacons, please visit https://mailchimp.com/legal. Some (but not all) browsers enable you to restrict the use of web beacons by either preventing them from sending information back to their source (e.g. when you choose browser settings which block cookies and trackers) or by not accessing the images containing them (e.g. if you select a “do not display images (in emails)” setting in your email server). 4.03 Information received about you from third parties We may receive information from authorize.net relating to the payment of membership or conference program fees, such as transaction information. 5. How we use your information We will use your information for one or more of the following purposes. The legal basis on which we use your information is set out and explained after each purpose: 5.01 Administrative and business purposes
5.02 Analytical purposes
5.03 Legal and enforcement of legal rights
5.04 Use of your information only where we have your consent Where we process your information on the basis of your consent, you can withdraw your consent to such processing at any time by emailing us at [email protected] or writing to us at ICRS: Steven Kinsey, 231 Glenbrook Rd, U-4026, Storrs, CT, 06269. 5.05 Our use of automated decision-making, including profiling We use automated decision-making, including profiling. Automated decision-making is decision-making by technological means (i.e. by a machine) without human involvement. Profiling is any form of automated processing of your information to evaluate personal aspects about you, in particular to analyse or predict things like your personal preferences, interests, behaviour, location or movements. We automate some of our decision-making and/or profiling functions in order to improve the efficiency of our business, to improve the consistency with which we deliver our products or services, to reduce our administrative costs, to update our records, to organise our databases to improve the services we offer and how we communicate with you and to monitor your interaction with our business. This is important because it means that some actions and decisions we take (such as an acknowledgment email to confirm that your membership application has been received) are performed automatically by machines and algorithms rather than humans. Your information will be used by these systems to determine how we interact with you, and also to collect aggregate anonymized data relating to our collective customer base. This is significant because the outcome of your interactions with us will be based on the information you provide to us and not the choices of any individual. You have the right to request that we do not use automated decision-making in relation to your information by emailing us at [email protected]. 6. Retention and destruction of information We will retain your information, regardless of format or media, for as long as necessary to meet the identified purpose or as otherwise required by law. We will retain your information for no longer than necessary, taking into account the following:
Once the information is no longer required for its identified purpose or the legal retention period has expired, we destroy your information in a secure manner, using destruction methodologies appropriate to the format, media or device, such that reconstruction is not reasonably foreseeable. 7. How we secure your information 7.01 Security Measures We take appropriate technical and organisational measures to secure your information and to protect it against unauthorised or unlawful use and accidental loss or destruction, including:
7.02 Transmission of information to us by email Transmission of information over the internet is not entirely secure, and if you submit any information to us over the internet (whether by email, via our website or any other means), you do so entirely at your own risk. We cannot be responsible for any costs, expenses, loss of profits, harm to reputation, damages, liabilities or any other form of loss or damage suffered by you as a result of your decision to transmit information to us by such means. 8. Transfers of your information to other countries and safeguards used Your information will be transferred and stored outside the European Economic Area (EEA) in the circumstances set out below. We will also transfer your information outside the EEA or to an international organization in order to comply with legal obligations to which we are subject (compliance with a court order, for example). Where we are required to do so, we will ensure appropriate safeguards and protections are in place. 8.01 Server Log Information Information collected when you visit our website is transferred outside of the EEA and stored on the servers of our third party hosting company, Memberclicks. You can access their privacy policy here: https://memberclicks.com/legal/privacy-policy/#cookies-and-other-tracking-mechanisms Country of storage: The United States and Canada. Canada is subject to an adequacy decision by the European Commission. The United States is not subject to an adequacy decision by the European Commission. Safeguard(s) used: our third party hosting provider has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.dataprivacyframework.gov/list 8.02 E-mail Information you submit to us by e-mail is transferred outside the EEA and stored on our third party email provider’s servers. Our third party email provider is: GSuite. You can access their privacy policy here: https://policies.google.com/privacy?hl=en Country of storage: The United States. The United States is not subject to an adequacy decision by the European Commission. Safeguard(s) used: our third party email provider has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome. 8.03 Mailing List Information you submit to us when you sign up for our mailing list is transferred outside the EEA and stored on our third party mailing list provider’s servers. Our third party mailing list provider is: Memberclicks. You can access their privacy policy here: https://memberclicks.com/legal/privacy-policy/#cookies-and-other-tracking-mechanisms Country of storage: The United States. This country is not subject to an adequacy decision by the European Commission. Safeguard(s) used: our third party mailing list provider has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome 8.04 Google Analytics Information collected by Google Analytics (your IP address and actions you take in relation to our website) is transferred outside the EEA and stored on Google’s servers. You can access Google’s privacy policy here: https://www.google.com/policies/privacy/ Country of storage: United States of America. This country is not subject to an adequacy decision by the European Commission. Safeguard(s) used: Google has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome. The EU-U.S. Privacy Shield is an approved certification mechanism under Article 42 of the General Data Protection Regulation, which is permitted under Article 46(2)(f) of the General Data Protection Regulation. You can access the European Commission decision on the adequacy of the EU-U.S. Privacy Shield here: https://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm 8.05 Payment Information Information you submit to us when you pay membership or conference program fees is transferred outside the EEA and stored on our third party payment terminal provider’s servers. Our third party payment terminal provider is: Authorize.net. You can access their privacy policy here: https://usa.visa.com/legal/privacy-policy.html Country of storage: The United States, among others. The United States is not subject to an adequacy decision by the European Commission. Safeguard(s) used: our third party mailing list provider has self-certified its compliance with the EU-U.S. Privacy Shield which is available here: https://www.privacyshield.gov/welcome 9. Your rights in relation to your information Subject to certain limitations on certain rights, you have the following rights in relation to your information, which you can exercise by writing to ICRS: Steven Kinsey, 231 Glenbrook Rd, U-4026, Storrs, CT, 06269 or sending an email to [email protected]:
the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation 9.01 Verifying your identity where you request access to your information Where you request access to your information, we are required by law to use all reasonable measures to verify your identity before doing so. These measures are designed to protect your information and to reduce the risk of identity fraud, identity theft or general unauthorised access to your information. How we verify your identity Where we possess appropriate information about you on file, we will attempt to verify your identity using that information. If it is not possible to identity you from such information, or if we have insufficient information about you, we may require original or certified copies of certain documentation in order to be able to verify your identity before we are able to provide you with access to your information. We will be able to confirm the precise information we require to verify your identity in your specific circumstances if and when you make such a request. 10. Your right to object to the processing of your information for certain purposes You have the following rights in relation to your information, which you may exercise in the same way as you may exercise by writing to ICRS: Steven Kinsey, 231 Glenbrook Rd, U-4026, Storrs, CT, 06269 or sending an email to [email protected]:
You may also exercise your right to object to us using or processing your information for direct marketing purposes by:
For more information on how to object to our use of information collected from cookies and similar technologies, please see the section entitled How to accept or reject cookies in our cookies policy, which is available here: https://www.icrs.com/cookies-policy 11. Consequences of not providing your information to us Where you wish to subscribe to our services, we require your information in order to provide you with such services. We may also require your information pursuant to a statutory obligation (e.g. update our membership list). If you do not provide your information, we might not be able to provide you with our services. 12. Sensitive personal information ‘Sensitive personal information’ is information about an individual that reveals their racial or ethnic origin, age, marital status, financial information, identifying numbers such as your social insurance number or driver’s licence, religion, political opinions, religious or philosophical beliefs, or trade union membership, genetic information, biometric information for the purpose of uniquely identifying an individual, information concerning health or information concerning a natural person’s sex life or sexual orientation. We do not knowingly or intentionally collect sensitive personal information from individuals, and you must not submit sensitive personal information to us. If, however, you inadvertently or intentionally transmit sensitive personal information to us, you will be considered to have explicitly consented to us processing that sensitive personal information under Article 9(2)(a) of the General Data Protection Regulation Act. We will use and process your sensitive personal information for the purposes of deleting it. 13. Changes to our privacy policy We update and amend our Privacy Policy from time to time. 13.01 Minor changes to our Privacy Policy Where we make minor changes to our Privacy Policy, we will update our Privacy Policy with a new effective date stated at the beginning of it. Our processing of your information will be governed by the practices set out in that new version of the Privacy Policy from its effective date onwards. 13.02 Major changes to our Privacy Policy or the purposes for which we process your information Where we make major changes to our Privacy Policy or intend to use your information for a new purpose or a different purpose than the purposes for which we originally collected it, we will notify you by email (where possible) or by posting a notice on our website. We will provide you with the information about the change in question and the purpose and any other relevant information before we use your information for that new purpose. Wherever required, we will obtain your prior consent before using your information for a purpose that is different from the purposes for which we originally collected it. 14. Children’s privacy Because we care about the safety and privacy of children online, we comply with the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA and its accompanying regulations protect the privacy of children using the internet. We do not knowingly contact or collect information from persons under the age of 13. The website is not intended to solicit information of any kind from persons under the age of 13. It is possible that we could receive information pertaining to persons under the age of 13 by the fraud or deception of a third party. If we are notified of this, as soon as we verify the information, we will, where required by law to do so, immediately obtain the appropriate parental consent to use that information or, if we are unable to obtain such parental consent, we will delete the information from our servers. If you would like to notify us of our receipt of information about persons under the age of 13, please do so by sending an email to [email protected]. 15. California do not track disclosures “Do Not Track” is a privacy preference that users can set in their web browsers. When a user turns on a Do Not Track signal in their browser, the browser sends a message to websites requesting that they do not track the user. For information about Do Not Track, please visit www.allaboutdnt.org At this time, we do not respond to Do Not Track browser settings or signals. In addition, we use other technology that is standard to the internet, such as pixel tags, web beacons, and other similar technologies, to track visitors to the website. Those tools may be used by us and by third parties to collect information about you and your internet activity, even if you have turned on the Do Not Track signal. For information on how to opt out from tracking technologies used on our website, see our cookies policy which is available here: https://www.icrs.com/cookies-policy 16. Copyright The copyright in this Privacy Policy is either owned by, or licensed to, us and is protected by copyright laws around the world and copyright protection software. All intellectual property rights in this document are reserved.
|