Nexus Action does not collect sensitive personal data (known under GDPR as 'special category data') such as health information, political opinions, or religious beliefs.

We may collect and process the following categories of personal data:

• Full name

• Professional email address

• Employer or affiliated organisation

• Job title or professional role

• Country or region of residence (for geographic composition monitoring)

• Gender (for gender composition monitoring of events)

Directly from you via Google Forms (or the equivalent) completed when registering for or expressing interest in a Nexus Action event or dialogue process, or via documentation or correspondence you provide to us directly.

From third parties. Your contact information may be shared with us by partner organisations such as think tanks, research institutes, and professional associations with whom we collaborate on a recurring basis. In all such cases, those third parties are required to have obtained your consent prior to sharing your data with us, and to have informed you that your data may be passed to organisations such as Nexus Action for the purpose of inviting you to relevant programmes and events.

If you believe your data has been shared with us without your consent, you have the right to object to its processing. Please see Section 6 for how to do so.

Nexus Action does not use your data for any automated decision-making or profiling. We do not carry out any mechanised or algorithmic processing of your personal data. We do not sell, rent, or otherwise transfer your personal data to third parties for commercial purposes.

Nexus Action uses your personal data solely for the following purposes:

• To invite you to dialogue processes, events, and programmes that are relevant to your professional background

• To communicate with you about events you have registered for, including logistics, updates, and follow-up materials

• To monitor the geographic and gender composition of our events in order to ensure diverse and inclusive participation.

• To maintain records of participation in our programmes for organisational and reporting purposes.

Under the GDPR, we are required to identify a lawful basis for processing your personal data. Convene relies on the following bases:

Consent (Article 6.1 (a)): Where you have completed a registration form or otherwise provided your data to us directly, we process your data on the basis of your consent. You may withdraw your consent at any time, the procedure for which is outlined in Section 7 of this document. 

Consent passed from a third party (Article 6.1 (a)): Where your data has been shared with us by a partner organisation, we process it on the basis that the partner obtained your prior consent to share your information with organisations such as Convene for the purposes of invitation to relevant programmes.

Legitimate interests (Article 6.1 (f)): In limited circumstances, we may process data on the basis of our legitimate interest in facilitating inclusive, multi-stakeholder dialogue on matters of public importance. We are committed to balancing this interest against your rights, and you may object to such processing at any time.

Your personal data is stored on the Google Drive of Convene, a cloud storage service provided by Google LLC (USA). Google acts as a data processor on our behalf and processes data in accordance with a Data Processing Agreement (DPA) in place between Convene and Google, established by agreement in the creation of the Google Workspace. Google relies on Standard Contractual Clauses (SCCs) approved by the European Commission to legitimise any transfers of data outside the European Economic Area. Access to folders containing personal data is restricted to named Convene staff accounts only. We implement appropriate organisational measures to protect your data against unauthorised access, accidental loss, destruction, or damage.

We retain your personal data only for as long as is necessary for the purposes for which it was collected. In practice, participation records may be retained for up to five (5) years for organisational and reporting purposes, after which they are securely deleted.

Convene is a registered business in France and operates within the European Economic Area (EEA) and across the globe. The nature of our work means we engage with partner organisations and participants located in countries outside the EEA that have not received an adequacy decision from the European Commission. When we share or transfer personal data to such third countries, we will take steps to ensure that appropriate safeguards are in place and that our partners process your data in accordance with standards set out by the GDPR. If you would like further information about specific countries or the safeguards in place, please contact our Data Controller (see Section 11).

Nexus Action may contact you by email to invite you to dialogue processes, events, or programmes that we believe are relevant to your professional background. We do not engage in unsolicited commercial marketing. If at any time you no longer wish to receive communications from us, you may opt out by clicking the 'unsubscribe' link included on the email or simply replying “I withdraw my consent to be contacted by Nexus Action” to the email or to our data controller (contact information in Section 11).

Under the GDPR, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you.

• Right to rectification: You may request that we correct any inaccurate or incomplete data.

• Right to erasure: You may request that we delete your personal data.

• Right to restriction of processing: You may request that we restrict how we process your data in certain circumstances

• Right to data portability: You may request that we transfer your data to you or another organisation in a structured format. 

• Right to object: You may object to processing based on legitimate interests

• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact our data controller (see Section 11). We will respond within 30 days at no charge.

Nexus Action may update this policy from time to time. Any changes will be posted on this page with an updated revision date. Where changes are significant, we will endeavour to notify you directly by email.

If you are not satisfied with our response to a concern, you have the right to lodge a complaint with the French data protection authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) Website: www.cnil.fr Telephone: +33 (0)1 53 73 22 22 Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

For any questions or concerns regarding the collection, processing, use or disclosure of data by Nexus Action, please contact:

Amanda Harding, amanda@convene.space.