Data Dashboard/Privacy Policy

Your Data

The IYNA is committed to the protection and privacy of your data. On this page, you can get a comprehensive look into the data we collect, and what we do with it. If any data specified here is incorrect, or you would like some data to be removed, and you are unable to do so through the website, please file a support ticket. For more information, be sure to read the sections below titled 'Your Data Rights & the GDPR', and 'Data FAQ'.


Some Definitions

  1. IYNA, We, Us, Our: International Youth Neuroscience Association
  2. You, Your: You
  3. GDPR, General Data Protection Regulation: New data privacy and protection legislature in the European Union, approved April 16th 2016, and enforced starting May 25th, 2018.
  4. LCN: IYNA Local Chapter Network; A group of chapters established around a geographic region that works to facilitate IYNA activites in that region through the cooperation of multiple chapters.
  5. NCN: IYNA National Chapter Network; the leadership of the IYNA's activities in a given country.
  6. The website: Any mention of 'the website', 'website', or 'IYNA Website' refers to the website belonging to and operated by the International Youth Neuroscience Association, namely 'https://www.youthneuro.org'.
  7. Displayed publically: This term applies to display of data on our website. Your data is 'displayed publically' if users other than you can access it without special authorization from the IYNA, even if they are logged in. For example, your bio and avatar are displayed publically on your author page, because anyone can access it, but position applications you create are not, because only users that have been approved to do so (IYNA staff who manage your position, in this case) can do so.


Changes to this Policy

Although most changes are likely to be minor, we may change our Privacy Policy from time to time at our sole discretion. We encourage visitors to frequently check this page for any changes. Your continued use of this site after any change in this Privacy Policy will constitute your acceptance of such change.

IYNA's Information

We believe that transparency is crucial for any nonprofit. For this reason, we provide a variety of information and documents, both here and on our governance page.



Profile


Name: International Youth Neuroscience Association, aka IYNA

Address: 2764 Pleasant Rd Ste A800, Fort Mill, SC 29708 USA

Contact Details: Email us at support@youthneuro.org, file a support ticket, or send physical correspondence to address above.

Nonprofit Designation: 509(a)(2) Public Charity under section 501(c)(3) of the Internal Revenue Code of the United States of America. Designated on 4/19/2017. See governance page for documentation.

Board of Directors: See governance page.

GuideStar Profile: IYNA GuideStar Page



Data Information


Data Hosting: Our databases are currently hosted through New Dream Network, LLC, aka DreamHost Web Hosting, at servers located in Ashburn, Virginia, United States of America.

Sources of data: The data collected by us about you is either explicitly provided by you, or automatically collected through your usage of the site. For more information, see section 'Your Data'.

Partners and Data: Limited data (first name, last name, and email) of users who opt in is processed on our behalf Benchmark Internet Group, aka Benchmark, who provide our newsletter/mailing list service. Limited data (first name, last name, and email) of users with IYNA positions is also processed by Google, Inc, who provide infrastructure for IYNA staff accounts, and with Facebook, Inc, who provide our team communications tool, Workchat. Submitted journal articles may also be shared with partnering organizations if you explicitly consent to it when submitting. See 'data types' section below for additional information.

Data Collected by Partners: Our partners may collect limited data while you use their services. All data collected by our partners is held securely, and is never resold, shared, or used for advertising. Their staff cannot view your data without your express consent. For information on data collected by Benchmark, see 'Newsletter Data' under the 'Data Types' section. For information on data collected by Google or Facebook, see 'Staff Data' under the 'Data Types' section.

Security Breaches: The IYNA has NOT experienced any breaches or data leakages. If a breach does occur where your data is compromised, we will make it our first priority to contact you as soon as possible.

Data Protection: All data collected is held safely and securely. We restrict the data we collect to the minimum necessary. All data sent to/retrieved from our website is protected with HTTPS while in transit. Additionally, our website employs protection against a variety of potential attacks, including CSRF forgery, XSS, SQL Injection, and clickjacking. All IYNA databases are password-protected, and cannot be accessed from external sources.

Your Data Rights & the GDPR

The General Data Protection Regulation, or GDPR, is a law passed by the European Union that established requirements for the processing of data of citizens of the EU. As this among the most comprehensive, progressive data protection guidelines available, we are GDPR compliant for data of all of our members, not just those in the EU. The GDPR establishes 8 core rights for individuals:


  1. The Right to be Informed: This right states that data processors must provide information about the processing of data, and that that information must be concise, clear, easily accessible, and free to access. We provide this information through this webpage and through our privacy policy.

  2. The Right of Access: Under this right, you are entitled to access to information we process about you. This information can be accessed below in the section titled 'Data Types'.

  3. The Right to Rectification: If any information we store about you (which may be accessed through this webpage), is inaccurate, you have the right to correct it here, or submit a request to have it corrected. See the 'Data FAQ' section for more information.

  4. The Right to Erasure: Also known as "The Right to be Forgotten", this is a right for you to have your data erased. Please note that this applies only under certain circumstances. You can delete some data instances in the 'Data Types' section. If you wish to delete a data instance, but cannot do so below, you may send us a request. If you wish to close your IYNA account, or would like more information about sending us requests, please see the 'Data FAQ section'

  5. The Right to Restrict Processing: This right states that you may request to end processing of your data. This option may be proposed if deleting a data instance is not feasible. To request restriction of data processing, please send us a request. More information on requests can be found in the 'Data FAQ' section.

  6. The Right to Data Portability: This right allows you to obtain and reuse a copy of your data for your own purposes. This is provided for free, in a machine-readable format. A copy of your data may be downloaded in the 'Data Types' section. In some cases, restrictions may apply. For example, you must obtain permission from us to republish journal articles that have been edited and formatted by our staff.

  7. The Right to Object: Under this right, you may object to direct marketing, processing based on legitimate interest, or processing for purposes of research. You may opt out of direct marketing in your user profile settings.

  8. Rights related to automated decision making: We have a right to inform you about any automated decision making and profiling, and you have a right to request manual review for any such case. We do not engage in profiling. The only automated decisions are those related to age restrictions for our programs, which are a necessary condition of the services we provide,

Data FAQ

What does 'processing' mean?

TL;DR: Processing is anything we do with your data.

Processing is defined Article 4 of the GDPR as "means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction".

What is a "lawful basis for processing"?

A 'lawful basis for processing' is indicated for every data type we or our partners collect. Essentially, this is why we process the data that we process. The GDPR establishes 6 legal grounds for processing:

  1. Consent: If data is processed on grounds of consent, this means that you have given consent to the processing of his or her personal data for one or more specific purposes. For example, use of your data for our newsletter is based on consent: You specifically opt in during registration, and are able to easily withdraw consent at any time.

  2. Contract: Data may be processed on grounds of contract if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Most data we process is processed under contract.

  3. Legal Obligations: Processing is permitted for compliance with legal obligations. This must be directly specified.

  4. Vital Interests: Processing is permitted where it is necessary in order to protect the vital interests of the data subject or of another natural person.

  5. Public Interest: This lawful basis allows processing in order to fulfill a public task or duty. As the IYNA is not a public authority, this lawful basis is currently not applicable to us.

  6. Legitimate Interests: This lawful basis allows processing on grounds of legitimate interests, except where those interests are overriden by your rights.
Do you ever sell my data, or share it with advertisers?

We do not sell your data or use it for advertising purposes. We rely entirely on donations to financially sustain ourselves.

What do the NCN and LCN Communications checkboxes mean?

The IYNA Chapter system is made up of 3 levels: chapters, Local Chapter Networks (LCNs), and National Chapter Networks (NCNs). Sharing your first name, last name, and email is a requirement of joining a chapter. Because you make this decision yourself, and are free to leave your chapter at any time, independent consent is not required. Your membership in LCNs and NCNs, however, is determined by your chapter and which country you are located in, respectively. Checking these boxes will allow your data to be shared with your chapter's LCN, your country's NCN, or both. You can always withdraw consent later.

Are there age requirements? Do I need parental permission to register?

We welcome all members 13 or older to register. However, depending on your location, other restrictions may apply. The GDPR establishes children as a protected group concerning data processing. It sets the age of consent, during and after which parental consent is not required, to 16 years of age. Most EU member states, however, have chosen to lower this age. Here is a list of member states with ages of consent other than 13, as of May 2018:

16: The Netherlands, Slovakia, Romania, Malta, Luxembourg, Croatia, Lithuania, Hungary, Germany, France
15: Slovenia, Greece, Czech Republic
14: Austria, Cyprus, Bulgaria, Italy

If you are below your country's age of consent, you will unfortunately not be able to log into the IYNA website until we obtain verifyable parental consent. Our current method of obtaining parental consent is requesting that parents sign and mail/email a copy of the form to us.

How can I send a request to excercise one of my rights as listed above?

Please check this webpage first to make sure that a request is necessary. If you do decide to send a request, you can send it by email to support@youthneuro.org or by mail to 2764 Pleasant Rd Ste A800, Fort Mill, SC 29708 USA, or file a support ticket online.

When sending a request, please include one or more specific requests, and enclose identification so that we can verify your identity. Examples of valid ID include government, school, or work-issued photo IDs. If we feel that the verification you provide is insufficient to verify your identity, we may request additional documentation.

After we receive your request and verify your identity, we will reply within one calendar month. If the request is very complex, we will notify you that we will require an extension of up to two additional calendar months, including the reason for the delay. If we choose to deny a request, we will notify you within one month. If your request is denied, we will provide reasons, and, if you are a citizen of the European Union, notify you of your right to file a complaint with a supervisory authority.

In accordance with the GDPR, requests shall be handled free of charge. However, if requests are excessively repetetive, we may charge a small administrative fee.

I'm not satisfied. How can I file a complaint?

If you are a citizen of the EU, your rights are legally protected by the GDPR starting May 25th, 2018. If you have sent us a request, and are not satisfied with our answer, or believe your rights are being violated, you have the right to file a complaint against us with your member state's supervisory authority.

If you are not a citizen of the EU, the GDPR does not legally apply. However, we are still dedicated to ensuring your privacy. If you wish to file a complaint, please contact us via email at gdpr@youthneuro.org.

I don't live in the EU. Are my rights protected?

The GDPR only legally protects the rights of residents of the EU. However, we are dedicated to your data's privacy and protection: Our policies towards data transparency, security, and accessibility do not vary, so you will be able to access your data and send in requests pertaining to your data regardless of your country of residence.

I noticed you don't mention your Data Protection Officer. Why is that?

Under the GDPR, some organizations are required to name a Data Protection Officer (DPO), who enforces the GDPR within an organization and serves as an external contact point. As a small nonprofit organization that processes minimal, non-sensitive data, we are exempt from the need of hiring a full-time DPO under Article 37(1). Instead, we have split up the conventional duties of the DPO between our executive team and our web development team.

I have additional questions/comments/suggestions.

Wonderful! We love hearing feedback from our members. If you would like to get in contact, please file a support ticket.

Data Types

Here, you can find comprehensive information on data that we or our partners collect and store, as well as methods on how to access a copy of this data, correct errors, or have it deleted.

Your Account Data

When you register, and while you use our site, you manually submit profile information. Some additional information (dates of registration and last login) is collected while you use the site.

Lawful Basis for Processing: Contract for all internal processing; consent for processing data for newsletter and for sharing with LCNs and NCNs (see FAQ above). Only first name, last name, and email is shared in cases of external (third party; by Benchmark or by LCN or NCN leadership) processing.

Purposes for Processing: When you sign up as an IYNA Member, we must process data (ie creating an account, adding information to our database, etc.) in order to provide you with the opportunities and acccess to programs that you are signing up for. All data sharing consent and parental consent is collected under the lawful basis of legal obligations.

Display on Website: Varies, see data subtypes.

Retention Periods: Account data will be retained as long as your account is active (ie until you decide to remove it).

Source of Data: All account data is collected directly from you.

Third Party Interactions: Your first and last name, as well as your email, is also stored on databases belonging to Benchmark, our email newsletter provider.

Integration with Other Data Types: Parts of your account data may be automatically added into other data types. See documentation on other data types for more details.

How to Correct/Delete: If you wish to correct any of your account data, you can do so at your account dashboard. If you wish to terminate your IYNA account, please send us a request. More information on sending requests is available in the FAQ above.

Name

Methods of Collection: Your name (first and last) is collected directly from you upon registration, and may be further amended by you from your account dashboard.

Display on Website: Your first and last name will be displayed on the site in public areas as part of your profile. This includes any journal articles you have published, the IYNA Leadership and Governance pages (if you have a leadership position), chapter leadership pages (if you have a chapter/chapter network leadership position), mentorship pages (if you have signed up to be a mentor), and staff portals (if you manage staff).

Integration with Other Data Types: In addition to public display, your first and last name may also be displayed as a part of other data types, such as position applications and journal articles. See the descriptions for those specific data types for more info.

Emails

Methods of Collection: Your primary email, as well as any secondary emails you choose, are collected directly from you. If you are a staff member, your work email is automatically generated from the first letter of your first name, and your last name.

Display on Website: Your primary email nor your secondary emails are never publically displayed on the IYNA website. If you manage staff, your work email will be displayed on staff portals.

Integration with Other Data Types: If you apply for an IYNA position, your email will be displayed on position applications to the reviewers only. See the documentation on position applications for more information.

Birthday and Age

Methods of Collection: Your birthday is provided by you on registration. Your age is automatically calculated from your birthday.

Reason for Collection: Different opportunities are available to IYNA members of different ages. Collection of this data is necessary in order to determine which opportunities you are eligible for.

Display on Website: Your birthday and age are never publically displayed on the IYNA website.

Integration with Other Data Types: If you apply for an IYNA position, your age will be displayed on position applications to the reviewers only, because high school students are given preference during candidate selection. See the documentation on position applications for more information.

Chapter

Methods of Collection: Your chapter is provided by you through your your account dashboard.

Reason for Collection: This information is processed so that your contact information can be shared with your chapter.

Display on Website: Your chapter is not publically displayed on our website, unless you are a chapter officer, in which case your name, bio, and avatar will be displayed on your chapter's leadership page.

Integration with Other Data Types: Your chapter is integrated with chapter leadership records. See the documentation on chapter leadership records for more information.

Country

Methods of Collection: Your ccountry is provided by you during registration, and can be changed through your your account dashboard.

Reason for Collection: This information is processed so that we can provide you information on chapters, chapter networks, and mentors that are most relevant to you.

Display on Website: Your country is not publically displayed on our website, unless you are a NCN officer, in which case your name, bio, and avatar will be displayed on your NCN's leadership page.

Integration with Other Data Types: Your chapter is integrated with chapter leadership records. See the documentation on chapter leadership records for more information.

Avatar and Bio

Methods of Collection: Your avatar and bio are (optionally) provided by you through your your account dashboard.

Reason for Collection: Your avatar and bio are displayed on leadership pages (both for the IYNA and for our chapters), your IYNA Journal author page, and any articles you write.

Display on Website: Your avatar and bio are displayed on leadership pages (both for the IYNA and for our chapters), your IYNA Journal author page, and any articles you write.

Integration with Other Data Types: If you apply for an IYNA position, your bio will be displayed on position applications to the reviewers only. See the documentation on position applications for more information.

Consent Data

Methods of Collection: You can consent to being placed on our newsletter, of for your data to be shared with our chapter networks, during registration or on your account dashboard.

Reason for Collection: Because some types of data processing require consent as a lawful basis, we process your consent information so that we can comply with your wishes, and so that you can easily adjust your settings.

Display on Website: Your consent information is never publically displayed on the IYNA website.

Integration with Other Data Types: Your consent data is not integrated with other data types.

Administrative Records

Certain data, namely your positions, staff status, parental consent data (see FAQ), and dates of registration and last login are stored in our records.

Methods of Collection: Dates of registration and last login are collected automatically. Staff status and positions are updated based on your current positions at the time. Parental consent (if applicable) is manually entered by us when we obtain parental consent, if necessary.

Reason for Collection: Staff data is needed to facilitate permissions and staff accounts. Dates of registration and last login are needed for security purposes. Parental consent data is required to comply with the GDPR.

Display on Website: If you have leadership positions, your positions may be displayed on the IYNA Leadership or Governance page.

Integration with Other Data Types: Your current positions are displayed on any positions applications you create, and your date registered is included in any position applications you submit.

Access Logs

We store logs of all logins so that you can know if someone logs into your account.

Methods of Collection: These logs are collected automatically.

Reason for Collection: We are dedicated to ensuring your security. Collecting these logs allows you to track access to your account.

Display on Website: These logs are NEVER publically displayed.

Integration with Other Data Types: Access logs are not integrated with other data types.

Logs of Interactions with Data

We collect and store logs of interactions with data objects on our site. This data is processed for security reasons, so that we can audit any unauthorized incidents. This data is collected on grounds of legitimate interests. If you wish to access these logs pertaining to your account, please send us a request.

Your Data

You must be logged in to view or download your data.

Journal Articles

The IYNA Journal accepts article submission through the IYNA website. Here, you can find information on the data involved with article submissions.

Lawful Basis for Processing: Contract

Purposes for Processing: Processing articles submitted by users is necessary in order to edit, format, and publish them.

Display on Website: Article titles, authors, content, and publication dates are displayed on the IYNA website.

Retention Periods: Articles will be stored forever unless we receive a request to remove them.

Source of Data: All article data is collected directly from you.

Date From Your Profile: Your name is automatically associated with any articles you create.

Third Party Interactions: If you explicitly consent to it, articles may be shared with partners of our journal.

How to Correct/Delete: If an article has not yet been published, you may withdraw it below. If an article has already been published, please send us a request for information on how to get it removed. Information on sending requests can be found in the FAQ.

Your Articles

You must be logged in to view your data.

Position Applications

We accept applications for positions within the IYNA from our website. Here, you can find information regarding position applications.

Lawful Basis for Processing: Contract

Purposes for Processing: Processing applications submitted by users is necessary in order to review them and consider you for a position.

Display on Website: Applications are never displayed publically on the website.

Retention Periods: Applications will be stored until you decide to remove them.

Source of Data: All application data is collected from you.

Data From Your Profile: Some data from your profile is automatically inserted into any applications you make.

  1. Your name and email are provided so that the reviewer of your application can get in contact with you, for reasons such as to onboard you or schedule an interview.
  2. Your age is provided. The mission of the IYNA is primarily to provide opportunities for high school students. While we allow all members between the ages of 13 and 25 to apply, high school students will be given preference.
  3. The date registered is provided, so that the reviewer can assess your answer to the question 'How have you contributed to the IYNA so far?' in the context of how long you have been a member.
  4. Your current positions and pending position applications are provided so that the reviewer can assess your possible time commitment.
  5. Your website bio is provided so that the reviewer can better assess your professionality and how you might fit into our corporate culture
Third Party Interactions: Position applications are NEVER shared outside the IYNA.

How to Correct/Delete: Position applications cannot be edited after submission. If you wish, you can withdraw your application at any time below.

Your Applications

You must be logged in to view your data.

Your Chapter Leadership Positions

You can obtain a chapter leadership position within our chapter system on the level of a NCN, LCN, or chapter by starting a new NCN, LCN, or chapter, or by being invited to the leadership of an existing one.

Lawful Basis for Processing: Contract

Purposes for Processing: Processing chapter leadership data is necessary to display your positions on your chapter/LCN/NCN's website, and to give you proper permissions to access your chapter/LCN/NCN's dashboard.

Display on Website: If you have chapter leadership positions, your name, avatar, bio, and chapter position will be displayed on your chapter/LCN/NCN's leadership page.

Retention Periods: Chapter leadership data is stored until it is automatically deleted when your chapter leadership capacities are terminated.

Source of Data: Your name, avatar, and bio are collected from your account data, which is collected directly from you. Your position and permission levels within your chapter website are determined by your chapter president, or if you are the chapter president, are automatically granted to the fullest extent accessible for chapter leadership positions.

Data From Your Profile: Your name, avatar, and bio are automatically associated with your chapter leadership positions.

Third Party Interactions: Chapter leadership data is not shared outside the IYNA.

How to Correct/Delete: You may correct your name, avatar, and bio from your account dashboard. If you need to correct or delete your chapter/LCN/NCN leadership profile, please speak to your chapter/LCN/NCN head, or file a support ticket.

Your Chapter Leadership Data

You must be logged in to view your data.

Communications with Support



Lawful Basis for Processing: Contract

Purposes for Processing: Processing is necessary in order to store, access, and respond to support tickets you file.

Display on Website: Your support tickets are not publically displayed on the website.

Retention Periods: Support tickets are kept until you choose to delete them.

Source of Data: All information is provided by you.

Third Party Interactions: Support tickets are not shared outside the IYNA.

How to Correct/Delete: If you wish to delete a support ticket, please either comment so on the support ticket, or send us a request as per the instructions in the FAQ above.

Your Support Data

You must be logged in to view your data.

IYNA Newsletter Data



Lawful Basis for Processing: Consent

Purposes for Processing: Processing is necessary to provide you with access to the IYNA Newsletter.

Display on Website: Your newsletter data is not publically displayed on the website.

Retention Periods: Your name and email is kept until you unsubscribe; your newsletter interaction data is kept for the last 5 campaigns (usually between 1 and 3 months).

Source of Data: Your name and email are provided by you. Your interaction history with emails we send out is automatically collected.

Third Party Interactions: Your newsletter interaction information is processed on our behalf by Benchmark (see 'partners and data' in 'IYNA's Information' section). Benchmark has confirmed that it's staff do NOT have access to your data.

How to Correct/Delete: You may correct your name and email from your account dashboard.

Your Newsletter Data

You must be logged in to view your data.

IYNA Staff Data



Lawful Basis for Processing: Contract

Purposes for Processing: Processing is necessary to enable access to G Suite, Facebook Workchat, staff dashboards, and other staff resources.

Display on Website: If you have a leadership position with the IYNA, your avatar, name, and bio may be displayed on the IYNA Leadership or Governance pages

Retention Periods: Your staff data is kept while you have active positions

Source of Data: Your name and email are provided by you.

Third Party Interactions: Your staff data is processed on our behalf by Google for G Suite, and by Facebook for Facebook Workplace. Their staff do not have access to view your data, and they do not sell, share, or use it for advertising.

How to Correct/Delete: Please contact us for any corrections.

Your Staff Data

You must be logged in to view your data.

Chapter/LCN/NCN Data



Lawful Basis for Processing: Contract

Purposes for Processing: Processing is necessary to allow joining your chapter/LCN/NCN, and to host the website for your chapter/LCN/NCN.

Display on Website: Most data is displayed on your chapter/LCN/NCN's website.

Retention Periods: Data is retained until your chapter/LCN/NCN is terminated.

Source of Data: All information is provided by you and your staff. Country is automatically determined from country of the founder.

Third Party Interactions: Your chapter/LCN/NCN data is not shared externally, aside from publication on the IYNA website.

How to Correct/Delete: You can make any corrections from your chapters dashboard.

Your Chapter/LCN/NCN Data

You must be logged in to view your data.