Effective Date: 1 September 2025
This Privacy Policy explains how PartnerStandard Council (“we”, “us”, “our”) collects, uses, discloses, and protects personal data when you use our invitation-only platform for collaborative standards development (the “Council” or “Services”), or otherwise interact with us.
This Policy covers personal data processed through:
| Category | Typical Examples | Source |
|---|---|---|
| Profile Data | Name, email, company, title, expertise areas, bio | Provided at registration or profile completion |
| Contribution Data | Definitions, votes, comments, collaborative articles | Created by members during participation |
| Activity Data | Login times, contributions count, badges earned, statistics | Automatically tracked during platform use |
| Invitation Data | Inviter details, invitation date, invitation status | Generated when invitations are sent/received |
| Technical Data | IP address, browser type, device information | Automatic server logs |
| Purpose | Legal Basis (GDPR) |
|---|---|
| Manage membership and access | Art. 6(1)(b) – Contract |
| Facilitate collaboration and voting | Art. 6(1)(b) – Contract |
| Publish standards with attribution | Art. 6(1)(f) – Legitimate interest |
| Track achievements and statistics | Art. 6(1)(f) – Legitimate interest |
| Platform security and integrity | Art. 6(1)(f) – Legitimate interest |
| Service announcements | Art. 6(1)(b)/(f) |
Within the Council:
Public Attribution:
Third Parties:
We use:
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Platform hosting | EU & US |
| Supabase Inc. | Database & authentication | EU & US |
| Notion Labs Inc. | Standards publishing | US |
| Resend (Twilio) | Email notifications | EU & US |
All providers are bound by data processing agreements and appropriate safeguards (SCCs or EU-US Data Privacy Framework).
When data is transferred outside the EEA, we ensure appropriate safeguards through:
Active Members: Data retained while account is active
Contributions: Permanently retained as part of historical record
Inactive Accounts: Deleted after 3 years of inactivity (except contributions)
Published Standards: Attribution data retained indefinitely
We implement industry-standard security measures including:
You have the right to:
The Council is not intended for users under 18. We do not knowingly collect data from children. If we become aware of such collection, we will delete the data immediately.
In the event of a data breach likely to result in risk to your rights and freedoms, we will notify you within 72 hours as required by GDPR.
To exercise your rights or ask questions:
You may also lodge a complaint with the Spanish Data Protection Authority (AEPD) at aepd.es.
We do not use automated decision-making that produces legal or similarly significant effects. Voting results and statistics are transparent and based on actual member input.
We may update this Policy periodically. Material changes will be announced to members at least 30 days in advance. The Effective Date indicates the latest revision.
For privacy-related questions or requests:
Given our size and operations, we have not appointed a formal DPO. Privacy inquiries should be directed to the contact information above.