Personal data

Depending on the service, the Organisation collects identity data (name, position, organisation), contact details (email, telephone, address), professional data (qualifications, experience) and, for the Desk, documents proving ownership or provenance of a work.

No sensitive data in the strict sense is requested. If data of this nature appears in a file, it is processed with enhanced safeguards and limited to what is strictly necessary.

Each processing operation has a specific purpose: examining a certification request, enrolling an official in a training course, replying to a message, reviewing an application. The legal basis is, as the case may be, the performance of a public-interest task, compliance with a legal obligation or your consent.

For processing based on consent, you may withdraw it at any time, without affecting the lawfulness of operations already carried out.

Data is kept only as long as necessary. A message sent through the contact form is kept for three years (indicative). A certification file is kept for the validity period of the certificate, then archived for the period required by applicable law.

Unsuccessful applications are deleted after two years (indicative), unless the applicant agrees to be contacted about other offers.

Only authorised staff access the data, within the limits of their duties. Technical providers act as processors and are bound by contract: they may use the data only on the Organisation's instructions.

Transfers outside the European Economic Area may take place, for example to the offices in New York, Singapore or Nairobi. They are governed by equivalent protection clauses.

You may request access to your data, its rectification, erasure, restriction of processing and portability, and object to certain processing. Write to the data protection officer: dpo@oimap.example. Proof of identity may be requested to prevent impersonation.

If you consider that your request has not received a satisfactory reply, you may refer the matter to the data protection authority of your country of residence. In the event of a data breach, the Organisation informs the persons concerned as soon as possible.