Privacy Policy & GDPR Compliance

GDPR Compliance Commitment

Global Business Bridge Society operates in full compliance with the General Data Protection Regulation (GDPR). We adhere strictly to the foundational principles of Article 5 GDPR: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. We ensure GDPR-standard data protection for all attendees, speakers, and sponsors globally.

Lawful Bases for Processing (Article 6 GDPR)

In accordance with Article 6 of the GDPR, personal data is processed solely under the following valid legal bases:

• Contractual Necessity (Art. 6(1)(b)): Processing attendee registrations, delegate badges, forum venue access credentials, and payment transactions necessary to fulfill your ticket purchase and participation agreement.
• Explicit Consent (Art. 6(1)(a)): When you voluntarily submit speaker talk proposals, apply for sponsorship packages, or opt in to forum communications. Consent is affirmative, unbundled, and may be withdrawn at any time without penalty.
• Legitimate Interests (Art. 6(1)(f)): Ensuring cybersecurity, preventing payment and identity fraud, protecting physical venue integrity, and evaluating aggregate participant feedback to enhance future programming.
• Legal Obligations (Art. 6(1)(c)): Retaining statutory accounting records, tax invoices, and transaction audit trails required under Canadian nonprofit and corporate law.

Information Collected on Forms & Data Minimization

Under the principle of data minimization (Art. 5(1)(c) GDPR), we collect only information strictly necessary to process your event participation and evaluate proposals:

• Contact & Professional Data: Full name, business email, telephone number, job title, and company or organization name.
• Speaker Submissions: Proposed talk titles, abstracts, biographies, and professional social profiles (e.g., LinkedIn) provided during submission.
• Sponsor Inquiries: Company profile, corporate objectives, selected sponsorship tiers, and designated representative contacts.
• Consent Audit Trail: Timestamped records of affirmative GDPR consent given on our submission forms are maintained for compliance and verification.

Payment Processing & Financial Security (Stripe)

We do not store, process, or retain complete credit card numbers or security codes on our servers. All financial transactions are managed securely by Stripe, Inc.:

• PCI-DSS Level 1 Certified: Stripe operates at the highest tier of international payment security certifications.
• GDPR Data Processing Agreement: Stripe acts as a compliant data processor and independent controller under approved EU Standard Contractual Clauses (SCCs).
• End-to-End Encryption: Payment transactions are processed with 256-bit TLS/SSL encryption and tokenized credentials.
• Secure Checkout: Financial transactions are governed by GDPR Article 6(1)(b) (Contract Performance), ensuring your billing data is processed lawfully and protected against unauthorized access.

Your Rights Under GDPR

As a data subject, you hold comprehensive rights under GDPR Articles 15 through 22, exercisable free of charge at any time:

• Right of Access (Art. 15): Request confirmation of whether your data is processed and obtain a full copy of your personal data.
• Right to Rectification (Art. 16): Request correction of any inaccurate, incomplete, or outdated personal information.
• Right to Erasure / 'Right to Be Forgotten' (Art. 17): Request the permanent deletion of your data where it is no longer required for event operations or legal retention.
• Right to Restriction of Processing (Art. 18): Request that we restrict or suspend processing your personal data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object (Art. 21): Object at any time to data processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent (Art. 7(3)): Withdraw previously granted consent at any time without affecting past lawful processing.
• Right to Lodge a Complaint (Art. 77): Lodge a complaint with a European Union supervisory authority or the Office of the Privacy Commissioner of Canada.

Data Retention & International Transfers

• We never sell, rent, or monetize your personal data to third-party brokers or advertisers.
• Personal information is shared only with vetted operational providers directly required for forum execution (e.g., venue access, Stripe payment processing).
• Data is stored securely on servers located in Canada and cloud infrastructure utilizing recognized international transfer mechanisms, including EU Standard Contractual Clauses (SCCs).
• Personal data is retained only for the duration necessary to deliver event services and meet statutory audit obligations, after which it is securely purged.

Data Protection Officer & Contact

To exercise your GDPR rights, withdraw consent, or submit privacy inquiries, please contact our Data Protection contact at info@globalbusinessbridge.ca. In accordance with GDPR Article 12, we respond to all verified inquiries within 30 days without undue delay.