<div class="container_title"><h1>Policies</h1></div><div class="container_content">The IAESTE Exchange Platform is a web Portal that allows IAESTE member countries to coordinate the IAESTE exchange program and allows students/employers to participate in the IAESTE exchange program. The IAESTE Exchange Platform (hereafter also “Site”, “Services”, “Portal” or “EP”) is operated by IAESTE A.s.b.l., a registered association (Registration number and address: 51, Rue Albert Ier, L1117 Luxembourg), and its affiliated associations (hereafter collectively IAESTE). By accessing or using our Site, you (the “User”) signify that you have read, understood and agreed to be bound by these General Terms and Conditions (“Agreement”), whether you are a “Visitor” or a registered member of the Portal. We reserve the right to make changes to this Agreement from time to time. When these changes are made, we will make the Agreement updated available on the Site. You understand and agree that it is your responsibility to regularly check the Site for changes to the Agreement and to review such changes. Your continued use of the Site and the Service now, or following the posting of any changes, will indicate your acceptance of this Agreement, and of any such changes. If any future changes are unacceptable to you, you should discontinue using the Site and the Service.</div><pd4ml-page-break><div class="container_title"><h1>General Terms and Conditions</h1></div><div class="container_content">The IAESTE Exchange Platform is a web Portal that allows IAESTE member countries to coordinate the IAESTE exchange program and allows students/employers to participate in the IAESTE exchange program. The IAESTE Exchange Platform (hereafter also “Site”, “Services”, “Portal” or “EP”) is operated by IAESTE A.s.b.l., a registered association (Registration number and address: 51, Rue Albert Ier, L1117 Luxembourg), and its affiliated associations (hereafter collectively IAESTE). By accessing or using our Site, you (the “User”) signify that you have read, understood and agreed to be bound by these General Terms and Conditions (“Agreement”), whether you are a “Visitor” or a registered member of the Portal. We reserve the right to make changes to this Agreement from time to time. When these changes are made, we will make the Agreement updated available on the Site. You understand and agree that it is your responsibility to regularly check the Site for changes to the Agreement and to review such changes. Your continued use of the Site and the Service now, or following the posting of any changes, will indicate your acceptance of this Agreement, and of any such changes. If any future changes are unacceptable to you, you should discontinue using the Site and the Service.

1. Eligibility

1.1. The IAESTE Exchange Platform (in the following “Portal”) is exclusively

a. for IAESTE members (officials, volunteers and employers of IAESTE A.s.b.l, IAESTE full members, IAESTE associated members or IAESTE cooperating institutions) to coordinate the IAESTE exchange program and internal affairs.

b. employers and students who want to participate in the IAESTE exchange program. 1.2. By using the Portal, the User represents and warrants that he or she agrees to and abides by all of the terms and conditions of this Agreement.

2. Registration Information and Account Security

Before registering for or using the Portal, please take into consideration that you will be agreeing to the following: a. To provide accurate, current and complete information about you on the Portal.

b. To be responsible for the security of your password and identification information. You will not share your password, let anyone else access your account, or do anything else that might jeopardize the security of your account.

c. To maintain and update the registration information, and any other information you provide, to keep it accurate, current and complete. d. To be solely and fully responsible for all the use of your account and for any activity that takes place using your account.

3. Proprietary Rights of Portal Content

3.1. With the exception of the User Content as defined in section 5, all, text, pictures, video, information, music, logos, trademarks, brands, sound and other files, and their selection and arrangement (the “Portal Content) are the (intellectual) property of IAESTE A.s.b.l. with all rights reserved.

3.2. No Portal Content may be modified, copied, distributed, framed, reproduced, republished, displayed, posted, transmitted, or sold in any form or by any means, without prior written consent of IAESTE.

3.3. Provided that you are eligible to use the Portal, you are granted with a limited, nonexclusive license to access and use the Portal and the Portal Content.

3.4. Except for your own User Content, you may not upload or republish Portal Content elsewhere or use the information for any other means without written consent from IAESTE A.s.b.l.

3.5. With the exception in section 4.3.c, the limited license granted to you by IAESTE is subject to this Agreement and does not permit the use of any data gathering or extraction methods.

3.6. Any use of the Portal or the Portal Content other than as specifically allowed in this Agreement, without the prior written permission of IAESTE A.s.b.l., is strictly prohibited and will terminate the license granted in the Agreement.

3.7. Unless explicitly stated in this Agreement, nothing in this Agreement shall be construed as conferring any license to intellectual property rights, whether by estoppel, implication or otherwise.

3.8. This license is revocable at any time without notice and with or without cause.

4. User Conduct

4.1. You understand that except for advertising opportunities offered by IAESTE A.s.b.l.; the Portal is available for your personal, IAESTE exchange program related use only.

4.2. You represent, warrant and agree that nothing submitted through your account or otherwise posted, transmitted or shared by you on or through the Portal will violate or infringe upon the rights of any third party.

a. To collect email addresses or other contact information of other users from the Portal for the purposes of sending unsolicited emails or other unsolicited communications;

b. In any unlawful manner or in any other manner that could damage, disable, overburden or impair the Portal;

c. To collect information from or otherwise interact with, using automated scripts and offered interfaces like web services without a written permission of the IAESTE Board or IAESTE IT Manager.

d. To make available any harmful, threatening, unlawful, defamatory, infringing, abusive, inflammatory, harassing, vulgar, obscene, fraudulent, invasive of privacy or publicity rights, hateful, or racially, ethnically, or otherwise objectionable content through your account.

e. To upload, post, transmit, share, store or otherwise make available any audio clips other than those of a personal nature that: Are the voices of you or your friends Are created by you or your friends with their authorization

f. To create more than one User account or create a User account on behalf of someone or something other than yourself unless expressly authorized to do so by IAESTE A.s.b.l.

g. To impersonate anyone or anything, or falsely state or otherwise misrepresent yourself, your age or your affiliation with anyone or anything. h. To make available any unsolicited or unauthorized advertising or any other form of solicitation.

i. To make publicly available any private information of any third party, except students and employers who are participating in the IAESTE exchange program and agreed to do so.

j. To solicit personal information from anyone under 18 or solicit passwords or personally identifying information for unlawful purposes.

k. To make available any material that contains software viruses or any other computer code, files or programmes designed to interrupt, destroy or limit the functionality of any computer software or hardware or telecommunications equipment.

m. To make available content that would constitute, encourage or provide instructions for a criminal offense, violate the rights of any party, or that would otherwise create liability or violate any local, national or international law.

n. To use or attempt to use another user’s account, service or system without authorization from IAESTE A.s.b.l., or create a false identity on the Portal.

o. To make available content, that in the sole judgment of IAESTE A.s.b.l., is objectionable or which, restricts or inhibits any other person from using the Portal, or which, may expose IAESTE A.s.b.l. or its users to any harm or liability of any type.

b. Engage in behaviour or make available content that is obscene, pornographic, and sexually explicit, depicts graphic or gratuitous violence, makes threats of any kind or is malicious.

d. Facilitate or encourage any violations of this Agreement.

5. User Content Posted on the Portal

5.1. You are solely responsible for the photos, messages, audio, text, personal information, and other content that you upload, publish or display on or through the Portal, or transmit to or share with other users (collectively the “User Content”).

5.2. You may not post, transmit or share User Content (e.g. job offers / student and employers information) on the Portal that you did not create or that you do not have permission to share, post or transmit.

5.3. You agree that IAESTE may, but is not obligated to, review the Portal and may delete or remove (without notice) any Content or User Content in its sole discretion, for any or no reason, including User Content that in the sole judgment of the IAESTE violates this Agreement, or which may be offensive, illegal, or that might violate the rights, harm, or threaten the safety of others.

5.4. When you upload User Content to the Portal, you authorize and direct IAESTE to make any copies of that content, as we deem necessary in order to facilitate the upload and storage of the User Content on the Portal.

5.5. You may remove your User Content from the Portal at any time.

6. Copyright Complaints

6.1. IAESTE respects the intellectual property rights of others and IAESTE prohibits Users from uploading, posting or otherwise transmitting on the Portal any materials that violate another party’s intellectual property rights. When IAESTE receive proper complaints, IAESTE may promptly remove the content and/or disable access to the allegedly infringing material.

6.2. If you believe that any material on the Portal infringes upon any intellectual property, which you own or control, you may send a written notification of such infringement to board@iaeste.org.

6.3. If IAESTE removed your content for infringing someone else’s copyright, and you believe we removed it by mistake, IAESTE will provide you with an opportunity to send a written notification to board@iaeste.org.

7. Repeat Infringer Policy

7.1. In appropriate circumstances and at IAESTE’s sole discretion, IAESTE A.s.b.l. may disable accounts of members who repeatedly infringe any intellectual property rights of others.

8. Third Party Websites and Content

8.1. The Portal contains (or you may be sent through the Portal) links to other web sites (“Third Party Sites”) as well as other content or items belonging to or originating from third parties (the “Third Party Content”).

8.2. Such Third Party Sites and Third Party Content are not investigated, monitored or checked for accuracy, appropriateness, or completeness by IAESTE A.s.b.l., and IAESTE A.s.bl. is not responsible for any Third Party Sites accessed through the Portal or any Third Party Content posted on, available through or installed from the Portal, including the content, accuracy, offensiveness, opinions, reliability, privacy practices or other policies of or contained in the Third Party Sites or the Third Party Content.

8.3. Inclusion of, linking to or permitting the use or installation of any Third Party Site or any Third Party Content does not imply approval or endorsement thereof by IAESTE A.s.b.l.

8.4. If you decide to leave the Portal and access the Third Party Sites or to use or install any Third Party Content, you do so at your own risk and you should be aware that our terms and policies no longer govern. You should review the applicable terms and policies, including privacy and data gathering practices, of any site to which you navigate from the Portal or relating to any applications you use or install from such site.

9. User Disputes

9.1. You are solely responsible for your interactions with other users on the Portal. 9.2. IAESTE reserve the right, but have no obligation, to monitor disputes between you and other users.

10. Privacy Policy / Data Protection

10.1. Your privacy is very important to us. Please take the time to view our <a href="https://iaeste.smartsimple.ie/s_viewpolicies.jsp?companyid=443352">IAESTE Exchange Platform Code of Conduct</a>. The terms of the Code of Conduct also govern and apply to your use of the Portal, and they are incorporated herein by this reference.

10.2. Any personal data included in the General Terms and conditions of the use of the IAESTE Exchange Platform shall be processed pursuant to European Union Regulation 2016/679 dated 27 April 2016 (GDPR). Such data shall be processed solely for the purposes of the performance, management and monitoring of the use of the platform by IAESTE A.s.b.l. acting as data controller without prejudice to possible transmission to the bodies charged with monitoring or inspection task in application of Data protection law.

10.3. You shall have the right of access to your personal data and the right to rectify any such data. Should you have any queries concerning the processing of your personal data, you shall address them to the entity acting as data controller IAESTE A.s.b.l. (<a href="mailto:privacy@iaeste.org" target="_blank">privacy@iaeste.org</a>).

10.4.You shall have right of recourse at any time to the European Data Protection Supervisor or the National Commission for Data Protection in Luxembourg (www.cnpd.lu).

10.5. Where the use of the platform requires the processing of personal data by you, you may act only under the supervision of the data controller, in particular with regard to the purposes of the processing, the categories of data which may be processed, the recipients of the data, and the means by which the data subject may exercise your rights.

10.6.You shall limit access to the data to the staff strictly necessary for the performance, management and monitoring of the use of the platform.

10.7.You undertake to adopt appropriate technical and organisational security measures having regard to the risks inherent in the processing and to the nature of the personal data concerned in order to:

<ol style="list-style-type: lower-alpha;">
	<li style="text-align: justify;">prevent any unauthorised person from having access to computer systems processing personal data, and especially:

<ol style="list-style-type: lower-alpha;">
		<li style="text-align: justify;">unauthorised reading, copying, alteration or removal of storage media; </li>
		<li style="text-align: justify;">unauthorised data input as well as any unauthorised disclosure, alteration or erasure of stored personal data;</li>
		<li style="text-align: justify;">unauthorised using of dataprocessing systems by means of data transmission facilities;  </li>
	</ol>
	</li>
	<li style="text-align: justify;">ensure that authorised users of a data processing system can access only the personal data to which their access right refers; </li>
	<li style="text-align: justify;">record which personal data have been communicated, when and to whom;  </li>
	<li style="text-align: justify;">ensure that personal data being processed on behalf of third parties can be processed only in the manner prescribed by the contracting institution or body; </li>
	<li style="text-align: justify;">ensure that, during communication of personal data and transport of storage media, the data cannot be read, copied or erased without authorisation; </li>
	<li style="text-align: justify;">design its organisational structure in such a way that it meets data protection requirements. </li>
</ol>

10.8. By using the Portal, you are consenting to have your personal data transferred to and processed in any country, which is an IAESTE member, associate member, or cooperating institution.

10.9. By using the Portal and participating in the IAESTE exchange program, you agree that the personal data, which has been provided to IAESTE member, IAESTE associate member, or IAESTE cooperating institution may be passed to IAESTE member, IAESTE associate member, or IAESTE cooperating institution and potential employers for the purpose of arranging your traineeship; your personal data may be provided to government authorities for the issuance of visa/work permit purpose.

10.10. You agree that all data must be handled in accordance with Luxembourg and EU laws regarding data protection and security.

11. Disclaimers

11.1. IAESTE is not responsible or liable in any manner for any User Content or Third Party Content posted on the Portal, whether posted by Users of the Site, by third parties or by any of the equipment or programming associated with or utilized in the Portal.

11.2. The Portal may be temporarily unavailable from time to time for maintenance or other reasons. IAESTE A.s.b.l. assumes no responsibility for any error, omission, interruption, deletion, defect, delay in operation or transmission, communications line failure, theft or destruction or unauthorized access to, or alteration of, User communications.

11.3. IAESTE A.s.b.l. is not responsible for any technical malfunction or other problems of any computer systems, servers or providers, computer equipment, software or failure of email on account of technical problems or traffic congestion on the Portal, including injury or damage to the User’s or to any other person’s computer or other hardware or software, related to or resulting from using or downloading materials in connection with the Portal.

11.4. Under no circumstances will IAESTE A.s.b.l. be responsible for any loss or damage, including any loss or damage to any User Content or, personal injury or death, resulting from anyone’s use of the Portal, any User Content or Third Party Content posted on or through the Portal, or any interactions between users of the Portal, whether online or offline.

11.5. The Portal, and the Portal content are provided “as is” and IAESTE A.s.b.l. disclaims any and all representations and warranties, whether express or implied, including implied warranties of title, merchantability, fitness for a particular purpose or non infringement.

11.6. Without limiting the foregoing, you understand and agree that you download or otherwise obtain content, material, data or software from or through the Portal at your own discretion and risk and that you will be solely responsible for your use thereof and any damages to your computer system that may result.

11.7. IAESTE reserves the right to change any and all content, software and other items used or contained in the Portal at any time without notice.

11.8. Reference to any products, services, processes or other information, by trade name, trademark, manufacturer, supplier or otherwise does not constitute or imply endorsement, sponsorship or recommendation thereof, or any affiliation therewith, by the IAESTE A.s.b.l., unless otherwise stated.

12. Limitation on Liability and Indemnity

12.1. Except where provided by law, in no event will IAESTE A.s.b.l., its officials, employees or volunteers be liable to you or any third person for any direct, indirect, consequential, exemplary, incidental, special or punitive damages, including for any lost profits or lost data arising from your use of the Portal or any of the Portal Content or other materials on, accessed through or downloaded from the Portal. You agree to indemnity and hold IAESTE A.s.b.l., its subsidiaries and affiliates, and each of their directors, officers, agents, contractors, partners and employees, harmless from and against any loss, liability, claim, demand, damages, costs and expenses, including reasonable attorney’s fees, arising out of or in connection with any User Content, any Third Party Content you post or share on or through the Portal, your conduct in connection with the Portal or with other users of the Portal, or any violation of this Agreement or of any law or the rights of any third party.

13. Termination

13.1. This agreement is effective until terminated or in case of a limited term license upon expiration or will terminate automatically if you fail to comply with the limitations described above. In this case IAESTE A.s.b.l can disable your account and delete any content or information.

14. Arbitration

14.1. This Agreement shall be governed by and construed and interpreted in accordance with the substantive laws of Luxembourg.

14.2. The mediation proceedings shall be conducted in English. If any claim or dispute arises under or in connection with this agreement, the parties will attempt to settle such claim or dispute by negotiation. If any claim or dispute cannot be settled by negotiation within 21 days after either party has made a written offer to the other party to negotiate a settlement to such claim or dispute, the parties shall before resorting to court proceedings, attempt to resolve the claim or dispute by referring the dispute to the following representatives (to be indicated). If the above representatives are unable to resolve the dispute with 28 days of such referral either party shall be entitled to attempt to resolve the claim or dispute by mediation in accordance with the Centre for Dispute Resolution (CEDR). If the parties have not settled any claim or dispute by mediation within 42 days from the initiation of the mediation, the dispute shall be referred to and finally resolved by the courts.

15. Miscellaneous

15.1. This Agreement, together with the Privacy Policy constitute the entire agreement between you and IAESTE regarding the use of Portal, superseding any prior agreements.

15.2. The failure of the IAESTE to exercise or enforce any right or provision of this Agreement shall not constitute a waiver of such right or provision in that or any other instance.

15.3. If any provision of this Agreement should be invalid in any jurisdiction under applicable law, the legality and enforceability of the remaining provisions hereof shall not in any way be affected or impaired thereby. In such an event the Parties commit themselves to compose a legally valid replacement rule, which approaches the invalid provision as closely as possible within the economic intent of this Agreement. With this in mind, this Agreement will be interpreted as though the invalid clause had been omitted from the outset.

15.4. Any amendment to or waiver of this Agreement must be made in writing and signed by us.

16. Contact

You may contact us by email at board@iaeste.org. The information contained in this Agreement is subject to change without notice. 
</div><pd4ml-page-break><div class="container_title"><h1>Data Protection Code of Conduct</h1></div><div class="container_content">IAESTE Exchange Platform Code of Conduct for the Processing of Personal Data In accordance with European Union Regulation 2016/679  dated 27 April 2016 (GDPR)

The International Association for exchange of Students for Technical Experience (IAESTE A.s.b.l.) is a non for profit organisation incorporated in Luxemburg (RCSL number F1180) that has as aims: (a) to provide students in higher education with technical experience relevant to their studies; (b) to offer employers well-qualified and motivated trainees; (c) to be a source of cultural enrichment for trainees and their host communities (Art 2. of the statutes)

The Members of the Association are legal bodies constituted by National Committees or national organisations advised by National Committees, and registered, according to their national laws (Art.7 of the statutes). Accepted Cooperating Institutions are also allowed to participate in the exchange of students (Art.3 of the bylaws).

To make this exchanges possible the Members and Cooperating Institutions, who send students, have to be able to pass the required personal information (passport, Curriculum Vitae, marks, etc.) to the receiving Members and Cooperating Institution, who will pass this information to the concerned organisations as employers, visa authorities, work permit authorities, etc. This exchange of information is done through an exchange platform administrated by IAESTE A.s.b.l.

As IAESTE A.s.b.l. is committed to achieve and maintain members’, cooperating institutions, students’ and employers’ trust, providing a robust security and privacy program that carefully considers data protection matters is an integral part to this mission.

In accordance with the EU Data Protection Directive (European Union Directive 2016/679 dated 27 April 2016.) and implementing Luxembourg national legislation, the IAESTE Exchange Platform Data protection code of conduct is intended to provide an adequate level of protection for Personal Data during international transfers within IAESTE, made on behalf of the Members and Cooperating Institutions (hereafter “Customers”) and under their instructions.

For clarity, a Customer (as defined in Section 2) may be a Controller or a Processor of Personal Data. Where a Customer is a Processor of Personal Data, the IAESTE A.s.b.l. Exchange Platform shall process Personal Data as sub-processors on behalf of the Controller. In these cases the instructions from the Controller regarding the processing of Personal Data shall be given through the Processor.

<ul>
	<li style="text-align: justify;">Controller means controller, as defined in the EU Data Protection Directive. The term “controller” is defined in the EU Data Protection Directive as “the natural or legal person, public authority, agency, or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law.” In our case it is clearly the National Secretary of the Members or the Person in charge of the Cooperating Institutions to whom the personal data will be sent.</li>
	<li style="text-align: justify;">Customer means (i) a legal entity with which IAESTE A.s.b.l. is executing an agreement to provide the service of the Exchange Platform and such agreement incorporates by reference the IAESTE Exchange Platform Data Protection Code of conduct. </li>
	<li style="text-align: justify;">Data Subject means an individual to whom Personal Data relates. </li>
	<li style="text-align: justify;">EU Data Protection Directive means European Union Directive 2016/679 dated 27 April 2016.</li>
	<li style="text-align: justify;">Personal Data means personal data, as defined in the EU Data Protection Directive, when such data is submitted. The term “personal data” is defined in the EU Data Protection Directive as “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural, or social identity.” </li>
	<li style="text-align: justify;">Processor means processor, as defined in the EU Data Protection Directive. The term “processor” is defined in the EU Data Protection Directive as “a natural or legal person, public authority, agency, or any other body which processes personal data on behalf of the controller.” </li>
	<li style="text-align: justify;">Services means the online services provided to Customers by IAESTE A.s.b.l., as listed in Appendix A. </li>
</ul>

The purpose of the IAESTE Exchange Platform Data Protection Code of conduct is to govern cross-border transfers of Personal Data to and between members of IAESTE A.s.b.l., and to third-party sub-processors as Employers and Authorities (in accordance with agreements with any such third-party sub-processors) when acting as Processors and/or sub-processors on behalf and under the instructions of Customers.

The IAESTE Exchange Platform Data Protection Code of conduct applies to Personal Data submitted to the Services by: (a) Customers established in EEA member states whose processing activities for the relevant data are governed by the EU Data Protection Directive and implementing national legislation; and (b) Customers established in non-EEA member states for which the customer has contractually specified that the EU Data Protection Directive and implementing national legislation shall apply.

IAESTE A.s.b.l. may update the IAESTE Exchange Platform Data Protection Code of conduct. All changes to the IAESTE Exchange Platform Data Protection Code of conduct shall be communicated to members of IAESTE A.s.b.l..

The Board of IAESTE A.s.b.l. shall be responsible for keeping a fully updated list of the members and cooperating Institutions of IAESTE A.s.b.l. and making appropriate notifications to Customers and the “Commission Nationale pour la protection des données” of Luxembourg (C.N.P.D.) in its capacity as lead authority for the IAESTE Exchange Platform Data Protection Code of conduct. IAESTE A.s.b.l. shall not transfer Personal Data to a new member or Cooperating Institution of IAESTE A.s.b.l. until it is appropriately bound by and complies with the IAESTE Exchange Platform Processor Data Protection Code of conduct.

IAESTE A.s.b.l. shall make the most current version of the IAESTE Exchange Platform Data Protection Code of conduct, available at <a href="https://iaeste.smartsimple.ie/s_viewpolicies.jsp?companyid=443352">https://iaeste.smartsimple.ie/s_viewpolicies.jsp?companyid=443352</a> and the members and Cooperating Institutions of IAESTE A.s.b.l. at <a href="http://iaeste.org/countries_list.pdf">http://iaeste.org/countries_list.pdf</a>. Significant changes to the IAESTE Exchange Platform Data Protection Code of conduct and/or the list of members and Cooperating Institutions of IAESTE A.s.b.l. will be reported (a) in a timely fashion to Customers and (b) once per year to the relevant data protection authorities accompanied by a brief explanation of the changes.

4. Data Protection Principles

<ol>
	<li style="list-style-type: none;">a. Purpose Limitation </li>
</ol>

IAESTE A.s.b.l. shall process Personal Data only for the following purposes: (i) processing in accordance with a Customer’s instructions set forth in the Customer’s agreement with IAESTE A.s.b.l.; and (ii) processing initiated by the Customer in its use of the Services. If IAESTE A.s.b.l. cannot comply with such purpose limitation, a member of IAESTE A.s.b.l. shall promptly notify the relevant Customer, and such Customer shall be entitled to suspend the transfer of Personal Data and/or terminate the applicable order form(s) in respect to only those Services, which cannot be provided by IAESTE A.s.b.l. in accordance with such Customer’s instructions. On the termination of the provision of such Services, IAESTE A.s.b.l. and third-party sub-processors shall, at the choice of the Customer, return the Personal Data to the Customer and/or delete the Personal Data as set forth in the applicable customer agreement.

<ol>
	<li style="list-style-type: none;">b. Data Minimization</li>
</ol>

In accordance to the customers the personal data in the platform will be limited to the strictly necessary data for a smoothly exchange.

<ol>
	<li style="list-style-type: none;">c. Limited Storage Periods</li>
</ol>

The storage of the data concerned will be limited in the following way:

<ol>
	<li style="list-style-type: none;">
	<ol style="list-style-type: lower-roman;">
		<li style="text-align: justify;">Personal data related to the exchange of traineeship and in enclosure as passport copy, grades, Curriculum vitae, etc. will be conserved for two years following its introduction in the platform. After two year they will be deleted. </li>
		<li style="text-align: justify;">The personal data that permits to link a person with an realized traineeship exchange will be stored to permit IAESTE A.s.b.l. at any moment to emit a certificate at the demand of the trainee. This is sometime required when the person is doing the formality to obtain a retirement.   </li>
		<li style="text-align: justify;">The anonymised data as general information about the trainee (nationality, age, studies, together with the student and employer report) will be stored indefinitely for statistical and historical processing. </li>
	</ol>
	</li>
</ol>

<ol>
	<li style="list-style-type: none;">d. Data Quality </li>
</ol>

Customers have access to, and control of, Personal Data in their use of the services. To the extent, a Customer, in its use of the services, does not have the ability to anonymize, correct, amend or delete Personal Data, as required by applicable laws, IAESTE A.s.b.l. shall comply with any request by a Customer in a reasonable period of time and to the extent reasonably possible to facilitate such actions by executing any measures necessary to comply with the law, in a reasonable period of time and to the extent reasonably possible to the extent IAESTE A.s.b.l. is legally permitted to do so. IAESTE A.s.b.l. will, to the extent reasonably required for this purpose, inform each member of IAESTE A.s.b.l. to whom the Personal Data may be stored of any anonymization, rectification, amendment or deletion of such data. If any such anonymization, correction, amendment or deletion request is applicable to a third-party sub-processor’s processing of Personal Data, IAESTE A.s.b.l. shall communicate such request to the applicable third-party sub-processor(s).

<ol>
	<li style="list-style-type: none;">e. Data Protection by Design and by Default</li>
</ol>

The platform is designed to automatically anonymize the data after two years presence in the platform taking into account the exception indicated in point 4.c.ii.

IAESTE A.s.b.l. acts as Processor on behalf of Customers. Customers have primary responsibility for interacting with Data Subjects, and the role of IAESTE A.s.b.l. is generally limited to assisting Customers as needed.

<ol>
	<li style="list-style-type: none;">a. Purpose of the data processing</li>
</ol>

The personal data collected is used exclusively to permit the student to obtain a traineeship and to communicate with him.

<ol>
	<li style="list-style-type: none;">b. Recipient to whom the personal data have been or will be disclosed</li>
</ol>

The personal data will be send only to the member countries where it is needed and with the students consent. The data will be supervised by the National Secretary of the student’s country, by the National Secretary of the country, where the students is applying to, by the employer of the entity where the student is soliciting and by the administrative authorities of the country as visa authorities, work permit authorities, etc.

<ol>
	<li style="list-style-type: none;">c. The envisaged period for which the personal data will be stored</li>
</ol>

The personal data will be stored for two years as the process for obtaining and realizing a traineeship can cover two years. After that all data that relate a particular student to a traineeship will be removed with exception of the name, surname and birthdate connected with a traineeship that has been realized. This will permit the Association to emit a traineeship certificate many years after at the demand of the person. The anonymized data will be stored to permit historical and statistical analysis later on.

<ol>
	<li style="list-style-type: none;">d. Right to request rectification or erasure of personal data </li>
</ol>

The Exchange platform is designed in such a way that every natural person who enters personal data on the exchange platform can at any moment access, correct, amend or delete this data. In case this is not possible for whatever reason that person should address a request to the board of IAESTE A.s.b.l. (board@iaeste.org). IAESTE A.s.b.l. shall provide Customers and data subject with cooperation and assistance in a reasonable period of time and to the extent reasonably possible in relation to any request regarding Personal Data to the extent Customers and data subject do not have access to such Personal Data through their respective uses of the Services.

<ol>
	<li style="list-style-type: none;">e. The right to lodge a complaint with a supervisory authority</li>
</ol>

The IAESTE A.s.b.l.Board shall be responsible for handling complaints related to compliance with the IAESTE Exchange Platform Data Protection Code of conduct. Data Subjects may lodge a complaint about processing of their respective Personal Data that is incompatible with the IAESTE Exchange Platform Data Protection Code of conduct by contacting the IAESTE A.s.b.l. Board at the email address: board@iaeste.org. IAESTE A.s.b.l. shall promptly communicate the complaint to the Customer to whom the Personal Data relates.

Customers shall be responsible for responding to all Data Subject complaints forwarded by IAESTE A.s.b.l. except in cases where a Customer has disappeared factually or has ceased to exist in law or become insolvent. Where IAESTE A.s.b.l. is aware of such a case, it undertakes to respond directly to Data Subjects’ complaints within thirty (30) days, including the consequences of the complaint and further actions Data Subjects may take if they are unsatisfied by the reply (such as lodging a complaint before the relevant data protection authority, who, in the case of IAESTE A.s.b.l. will be the CNPD of Luxembourg)

<ol>
	<li style="list-style-type: none;">f. Regulatory Inquiries and Complaints </li>
</ol>

IAESTE A.s.b.l. shall, to the extent legally permitted, promptly notify a Customer if IAESTE A.s.b.l. receives an inquiry or complaint from a data protection authority in which that Customer is specifically named. Upon a Customer’s request, IAESTE A.s.b.l. shall provide the Customer with cooperation and assistance in a reasonable period of time and to the extent reasonably possible in relation to any regulatory inquiry or complaint involving IAESTE A.s.b.l.’s processing of Personal Data.

As set forth in applicable contracts with Customers, members of IAESTE A.s.b.l. may retain third-party sub-processors, and depending on the location of the third-party sub-processor, processing of Personal Data by such sub-processors may involve transfers of Personal Data. Such third-party sub-processors shall process Personal Data only (i) in accordance with the Customer’s instructions set forth in the contract with IAESTE A.s.b.l.; or (ii) if processing is initiated by the Customer in its use of the Services. The third-party sub-processor engaged in processing Personal Data, including a description of its processing activities, is available at demand. Such third-party sub-processors have entered into written agreements with IAESTE A.s.b.l. in accordance with the applicable requirements of Articles 29 and 32 of EU Data Protection Directive and the Sections 3 – 10 of the IAESTE Exchange Platform Data Protection Code of conduct as applicable to the third-party sub-processor’s processing activities.

As set forth in applicable contracts with Customers, IAESTE A.s.b.l. shall provide Customers with prior notification before a new sub-processor begins processing Personal Data. Within thirty (30) days of receiving such notice, a Customer may object to IAESTE A.s.b.l.’s use of a new sub-processor subject to the following:

 It would be unreasonable for a Customer to object to a new sub-processor if (a) the sub-processor is subject to the IAESTE Exchange Platform Data Protection Code of conduct; and (b) has achieved a third-party, internationally-recognized security certification (e.g., ISO 27001) unless the Customer demonstrates reasonable suspicion that the new sub-processor will not be able to comply with its obligations under the IAESTE Exchange Platform Data Protection Code of conduct.

 Unless a Customer demonstrates reasonable suspicion that a new third-party sub-processor introduces unreasonable risk to the protection of Personal Data (e.g., a history of security breaches), it would be unreasonable for a Customer to object to a new third-party sub-processor if (a) the new third-party sub-processor is located in a country that provides an adequate level of protection per the European Commission or has entered into a contract with IAESTE A.s.b.l. containing the applicable requirements of the European Commission’s controller-to-processor standard contractual clauses; and (b) the new third-party sub-processor has passed IAESTE A.s.b.l.’s vendor security evaluation based on a third-party, internationally-recognized security framework.

In the event a Customer objects to a new sub-processor, and that objection is not unreasonable under the standards described above, IAESTE A.s.b.l. will use reasonable efforts to make available to the Customer a change in the Services or recommend a commercially reasonable change to the Customer’s configuration or use of the Services to avoid processing of Personal Data by the objected-to new sub-processor without unreasonably burdening the Customer. If IAESTE A.s.b.l. is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, the Customer may terminate the applicable order form(s) in respect only to those Services which cannot be provided by IAESTE A.s.b.l. without the use of the objected-to new sub-processor by providing written notice to IAESTE A.s.b.l. with whom the customer has contracted. Such Customer shall receive a refund of any prepaid fees for the period following the effective date of termination for such terminated Services.

<ol>
	<li style="list-style-type: none;">a. Confidentiality and Training </li>
</ol>

IAESTE A.s.b.l. shall ensure that its personnel engaged in the processing of Personal Data are informed of the confidential nature of the Personal Data, have executed written confidentiality agreements and have received appropriate training on their responsibilities. Additionally, IAESTE A.s.b.l. shall ensure that its personnel responsible for the development of tools used to process Personal Data have received appropriate training on their responsibilities. IAESTE A.s.b.l. shall also ensure that its personnel engaged in the processing of Personal Data are limited to those personnel who require such access to perform IAESTE A.s.b.l.’s obligations under applicable contracts with Customers.

<ol>
	<li style="list-style-type: none;">b. Data Security </li>
</ol>

IAESTE A.s.b.l. shall maintain appropriate administrative, technical and physical safeguards for protection of the security, confidentiality and integrity of Personal Data, as set forth in applicable contracts with Customers. IAESTE A.s.b.l. regularly monitors compliance with these safeguards. The IAESTE A.s.b.l. will not materially decrease the overall security of the Services during a Customer’s applicable subscription term.

<ol>
	<li style="list-style-type: none;">c. Security Breach Notification </li>
</ol>

In the event IAESTE A.s.b.l. becomes aware of any unauthorized access to or disclosure of Personal Data, IAESTE A.s.b.l. will promptly notify affected Customers to the extent such notification is permitted by applicable law.

<ol>
	<li style="list-style-type: none;">d. Third-Party Audits and Certifications </li>
</ol>

Smart Simple, who acts as a subcontractor, has their own Code of conduct that can be shown on request.

8. Liability and Enforcement

To the extent a Customer (or a Data Subject, if Section 7 of the IAESTE Exchange Platform Data Protection Code of conduct applies) demonstrates that a Data Subject has suffered damages and establishes facts showing that it is likely that such damages have occurred because of the IAESTE A.s.b.l.’s breach of Sections 4-10 of the IAESTE Exchange Platform Data Protection Code of conduct or a third-party sub-processor’s breach of a contract with IAESTE A.s.b.l., IAESTE A.s.b.l. shall be responsible for providing that it – or its third-party sub-processor – was not responsible for the breach giving rise to the damages or that no such breach took place. If IAESTE A.s.b.l. can prove that IAESTE A.s.b.l. and its third-party sub-processors are not responsible for the act leading to the damages suffered by the Data Subject, IAESTE A.s.b.l. may discharge itself from any responsibility.

9. Cooperation with Data Protection Authorities

IAESTE A.s.b.l. shall cooperate with member state data protection authorities with jurisdiction over the IAESTE A.s.b.l. or competent for Customers, reply to any requests they make within a reasonable time frame and abide by the advice and recommendations of the relevant member state data protection authorities regarding the interpretation and application of the IAESTE Exchange Platform Data Protection Code of conduct.

Upon request and subject to duties of confidentiality, IAESTE A.s.b.l. shall provide relevant member state data protection authorities with jurisdiction over IAESTE A.s.b.l. or competent for Customers  (i) a copy of IAESTE A.s.b.l.’s annual assessment of compliance with the IAESTE Exchange Platform Data Protection Code of conduct and/or other documentation reasonably requested; and (ii) the ability to conduct an onsite audit of IAESTE A.s.b.l.’s architecture, systems and procedures relevant to the protection of Personal Data.

Appendix A – Services to which the IAESTE Exchange Platform Data Protection Code of conduct Applies

The IAESTE Exchange Platform Data Protection Code of conduct applies to the services branded as the following:

<ul>
	<li style="text-align: justify;">The Training placement Offer, where the training offer is proposed </li>
	<li style="text-align: justify;">The Student part, that contains the student’s data (that he can fill in himself) that will be shared with the country to which he/she will apply for the traineeship.</li>
	<li style="text-align: justify;">The Employer part, that contains the data of the employer, who offers the traineeship.</li>
	<li style="text-align: justify;">The Nomination part, that generate the acceptance documents that the student needs to travel and realize his/her traineeship.; </li>
	<li style="text-align: justify;">The Employer and Student report part, where the student and the employer can report about the process and the traineeship.</li>
	<li style="text-align: justify;">The Library part that contains all the document relevant to the IAESTE activities in the past and in the present. </li>
</ul>
</div>

Policies

The IAESTE Exchange Platform is a web Portal that allows IAESTE member countries to coordinate the IAESTE exchange program and allows students/employers to participate in the IAESTE exchange program. The IAESTE Exchange Platform (hereafter also “Site”, “Services”, “Portal” or “EP”) is operated by IAESTE A.s.b.l., a registered association (Registration number and address: 51, Rue Albert Ier, L1117 Luxembourg), and its affiliated associations (hereafter collectively IAESTE). By accessing or using our Site, you (the “User”) signify that you have read, understood and agreed to be bound by these General Terms and Conditions (“Agreement”), whether you are a “Visitor” or a registered member of the Portal. We reserve the right to make changes to this Agreement from time to time. When these changes are made, we will make the Agreement updated available on the Site. You understand and agree that it is your responsibility to regularly check the Site for changes to the Agreement and to review such changes. Your continued use of the Site and the Service now, or following the posting of any changes, will indicate your acceptance of this Agreement, and of any such changes. If any future changes are unacceptable to you, you should discontinue using the Site and the Service.