This privacy notice explains how and why the Joint Air Power Competence Centre (also referred to as “JAPCC”, “we”, “our” and “us”) uses personal data about those individuals who receive services from us, provide services to us, visit our websites (collectively the “Website”), or otherwise communicate or engage with us (referred to as “you”).

You should read this notice, so that you know what we are doing with your personal data. Please also read any other privacy notices that we give you, that might apply to our use of your personal data in specific circumstances in the future.

“Personal data” is any information that relates to an identifiable natural person. Your name, address and contact details are all examples of your personal data, if they identify you.

The term “process” means any activity relating to personal data, including, by way of example, collection, storage, use, consultation and transmission.

The JAPCC is a so-called “controller” of your personal data. This means that we make decisions about how and why we process your personal data and, because of this, we are responsible for making sure it is used in accordance with data protection laws.

We collect different types of personal data about you when you visit our Website, request or receive something from us or otherwise communicate or engage with us. We collect your personal information from various sources. The different types of personal information that we collect, and the sources we collect it from, are listed below.

• Contact Form and Event Registration Forms. Depending on the event, the personal data we request from you may differ. In most cases, we ask for your full name, email, organisation, address and your title or rank, if applicable. The submitted form also provides us with your IP address and the date/time of submission.
• Business Cards. Many people we make contact with provide us with their business card. We store that information electronically in a dedicated contact database.
• Email. Any data you provide us in an email is kept on our email server for later reference.
• Contracts. If you have a contract with us, your personal data which is part of the contract is stored on our servers. This typically also includes your bank account details to settle payments.

If any of the personal information you have given to us changes, such as your contact details, please inform us without delay.

We process your personal data for particular purposes in connection with your use of our Website, the provision of services from us to you, your communication or other engagement with us and the management and administration of our mission.

We are required by law to always have a so-called “lawful basis” (i.e. a reason or justification) for processing your personal data. This is usually the case if you give us your consent to process your data. We assume your consent, if you provide us your contact information on a business card, by using our contact form or communicating with us via email.

Please note that where our processing of your personal data is either necessary for us to take steps, at your request, to potentially provide our service to you, and you choose not to provide the relevant personal data to us, we may not be able to enter into or continue our engagement with you.

We may also convert your personal data into statistical or aggregated form to better protect your privacy, or so that you are not identified or identifiable from it. Anonymised data cannot be linked back to you. We may use it to conduct research and analysis, including to produce statistical research and reports. For example, to help us understand and improve the use of our Website.

We do not process ‘special categories of personal data’ and/or sensitive personal data. Where necessary, we contract dedicated companies who can ensure compliance with applicable laws and regulations. This is currently the case with

• Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. We do not store any credit card details on our servers. Stripe provides us with a secure gateway which processes all credit card payments conducted on our webpage. Stripe is certified to the highest industry standards and has obtained regulatory licenses around the world.

Sometimes we need to disclose your personal data to other people.

Inside the North Atlantic Treaty Organization (NATO)

We are part of NATO, which includes, globally, numerous international headquarters and affiliated defence organisations. Therefore, we may share your personal data with other NATO entities to provide our services in accordance with our mission. If we do so, we typically use NATO’s internal and secured computer network which ensures that appropriate security standards are in place and your personal data is protected.

Access to your personal data is strictly limited and granted only on a need-to-know basis, depending on job functions and roles within our organisation.

Outside the North Atlantic Treaty Organization (NATO)

Usually, we do not share your personal data with third parties outside the NATO organisation. If we do so, these third parties will process your personal data on our behalf. We will disclose your personal data to these parties so that they can perform their functions as requested by us. Before we disclose your personal data to these third parties, we will seek to ensure that they have appropriate security standards in place to protect your personal data.

In certain circumstances, we will also disclose your personal data to third parties who will receive it as controllers of your personal data in their own right for the purposes set out above, where the relevant disclosure is in relation to:

• services provided to you or us by a third party acting independently to JAPCC but which has a relationship with us, for example, certain payment services;
• the disclosure of your personal data in order to comply with a legal obligation.

As part of NATO, JAPCC may transfer your personal data to recipients that are established in jurisdictions other than your own. Please be aware that the data protection laws in some jurisdictions may not provide the same level of protection to your personal data as is provided to it under the laws in your jurisdiction.

If any disclosures of personal data referred to above require your personal data to be transferred from within to outside the European Union, we will only make that transfer if:

• the transfer is necessary for the conduct of our mission, and
• the organization to which the personal data is to be transferred is part of NATO and its secured computer network and therefore ensures an adequate level of protection for personal data, or
• you explicitly consent to the transfer.

We will take specific steps (as required by applicable data protection laws) to ensure we take appropriate security measures to protect your personal data from unlawful or unauthorised processing and accidental loss, destruction or damage.

We will only retain your personal data for a limited period of time and for no longer than is necessary for the purposes for which we are processing it for. This will depend on a number of factors, including:

• any laws or regulations that we are required to follow;
• whether we are in a legal or other type of dispute with each other or any third party;
• the type of information that we hold about you; and
• whether we are asked by you or a regulatory authority to keep your personal data for a valid reason.

We will use your personal data to communicate with you:

• to administer our relationship with you;
• to respond to any questions that you may have;
• to inform you about our publications; and
• to invite you to take part in our conferences, meetings and working groups.

With your opt-in consent (if required), we will provide you with information about our products, events and services which may be of interest to you. Such communications will be sent either by email, text, post or telephone.

If you do not wish to receive such communications, you can refuse to give your consent (where your consent is required) or opt-out at any time by either following the instructions within the communication or by contacting us at .

This website uses so-called ‘First Party Cookies’. First-party cookies are cookies that are set by our website itself and can only be read by our site. They are used for the functionality of our website, e.g. to store your login information if you are a member of our community.

We do not use any so-called ‘Third Pary Cookies’. Third-party cookies are set by third parties which can be tracking or marketing companies (e.g. advertising networks). These cookies get re-read during a visit to other sites if they do business with these companies as well.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know.

Where our processing of your personal data is based on legitimate interest, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim.

Where we are processing your personal data for direct marketing purposes (e.g., our newsletter), you have the right to object to that processing.

You have the right to (subject to applicable laws and certain limitations):

• access your personal data and to be provided with certain information in relation to it, such as the purpose for which it is processed, the persons to whom it is disclosed and the period for which it will be stored;
• require us to correct any inaccuracies in your personal data without undue delay;
• require us to erase your personal data;
• require us to restrict processing of your personal data;
• receive the personal data which you have provided to us, in a machine readable format, where we are processing it on the basis of your consent or because it is necessary for your relationship with us and where the processing is automated; and
• object to a decision that we make which is based solely on automated processing of your personal data (however, we do not currently conduct any such decision making).

You also have the right to lodge a complaint with the relevant Supervisory Authority.

We may update this notice from time to time to reflect changes to the type of personal data that we process and/or the way in which it is processed. In the event of a material change which affects the processing of your personal data, we will notify you. We also encourage you to check this notice on a regular basis.

If you want more information about any of the subjects covered in this privacy notice or if you would like to discuss any issues or concerns with us, you can contact us: .