GDPR & Data Protection Policy

The World Leadership and Policy Institute ("WLPI," "we," "us," or "our") takes the protection, confidentiality, integrity, and lawful use of personal data seriously.

This GDPR & Data Protection Policy explains how WLPI processes personal data in connection with its:

• international events;
• programs;
• applications;
• websites;
• payments;
• visa-support services;
• partnerships;
• referral and affiliate activities;
• communications;
• digital systems;
• media activities; and
• organizational operations.

WLPI maintains appropriate administrative, organizational, contractual, and technical measures designed to protect personal data and to ensure that information entrusted to WLPI is handled responsibly.

This Policy supplements the WLPI Privacy Policy and applies where the General Data Protection Regulation (EU) 2016/679 ("GDPR") or related European data-protection requirements apply.

1. WLPI Legal Structure

World Leadership and Policy Institute (WLPI) is an internationally operated brand and a registered trade name in the State of Wyoming, United States.

WLPI operates through:

European Operations

Ufuq Group Kft Company Registration Number: 13-09-248345 Hungary

United States Operations

Nexus Prime Group LLC EIN: 33-4659415

United States

World Leadership and Policy Institute is a trade name and brand and does not constitute a separate legal entity from Nexus Prime Group LLC or Ufuq Group Kft.

Depending on the relevant transaction, activity, service, event, jurisdiction, or contractual relationship, personal data may be controlled and processed by Ufuq Group Kft, Nexus Prime Group LLC, or both entities, as applicable.

2. WLPI's Authority to Process Personal Data

By interacting with WLPI, submitting an application, registering for an event, purchasing a service, participating in a program, communicating with us, joining the Affiliate Program, or otherwise requesting WLPI services, you understand that WLPI may collect and process personal data where an appropriate legal basis exists.

Depending on the circumstances, WLPI may process personal data in order to:

• receive and evaluate applications;
• determine eligibility;
• verify identities and submitted information;
• administer competitive selection processes;
• provide event registrations;
• administer event participation;
• prepare invitation letters;
• provide visa-support services;
• communicate with embassies or consulates where appropriate;
• issue certificates and official documents;
• verify documents issued by WLPI;
• process payments;
• issue invoices;
• administer refunds;
• respond to payment disputes;
• prevent fraud;
• identify misuse of WLPI services;
• administer accommodation and transportation;
• manage delegates;
• communicate with participants;
• operate referral and affiliate programs;
• manage partnerships;
• carry out marketing where legally permitted;
• maintain organizational records;
• protect WLPI's legal rights;
• secure WLPI systems;
• investigate misconduct;
• comply with legal obligations; and
• operate WLPI's international activities.

WLPI is not required to obtain consent for every processing activity.

Where another lawful basis applies, including contractual necessity, legal obligation, legitimate interests, or another legally permitted basis, WLPI may process personal data without relying on consent.

3. Categories of Information WLPI May Process

WLPI may collect and process information reasonably necessary for its activities.

This may include:

Identity Information

• full legal name;
• preferred name;
• title;
• date of birth;
• nationality;
• citizenship;
• country of residence;
• gender where relevant;
• photograph;
• signature; and
• identification information.

Contact Information

• email address;
• telephone number;
• WhatsApp or other messaging details;
• mailing address;
• residential country;
• emergency contact details; and
• professional or social-media contact information.

Passport & Travel Information

• passport number;
• passport copy;
• issuing country;
• issue date;
• expiry date;
• nationality;
• visa information;
• embassy information;
• appointment information;
• flight details;
• arrival information;
• departure information; and
• other information required for travel or visa-support services.

Educational & Professional Information

• educational institution;
• qualifications;
• degrees;
• field of study;
• employer;
• organization;
• job title;
• professional experience;
• CV or résumé;
• biography;
• professional achievements;
• leadership experience;
• awards;
• volunteering experience; and
• areas of expertise.

Application Information

• application responses;
• essays;
• motivation statements;
• supporting documentation;
• interview responses;
• video submissions;
• selection assessments;
• evaluation information;
• references; and
• other materials voluntarily submitted to WLPI.

Event Information

• participation category;
• registration status;
• accommodation requirements;
• room allocations;
• meal requirements;
• transportation arrangements;
• airport transfer details;
• attendance;
• delegate credentials;
• certificate records;
• session participation;
• reimbursement information; and
• event-related communications.

Financial & Transaction Information

• order details;
• transaction ID;
• amount;
• currency;
• invoice details;
• payment status;
• payment provider;
• refund status;
• chargeback information;
• payout information; and
• limited payment-method information made available by financial providers.

Affiliate & Referral Information

• Affiliate identity;
• referral links;
• referral codes;
• attributed customers;
• clicks and conversions;
• eligible sales;
• commission balances;
• payout information;
• transaction status;
• refunds;
• reversals;
• chargebacks;
• fraud indicators; and
• information necessary to enforce WLPI Affiliate Program rules.

Digital & Technical Information

• IP address;
• browser;
• operating system;
• device type;
• approximate location;
• referring website;
• pages visited;
• session information;
• interaction information;
• cookie information;
• referral identifiers;
• logs;
• security information; and
• other technical information.

Communications

WLPI may retain communications made through:

• email;
• website forms;
• WhatsApp;
• social media;
• customer-support systems;
• telephone communications where lawfully recorded;
• surveys;
• feedback forms; and
• other communication channels.

4. Requirement to Provide Accurate Information

Users are responsible for ensuring that information supplied to WLPI is:

• true;
• accurate;
• complete;
• current; and
• not misleading.

This requirement is particularly important for:

• passport information;
• visa-support documents;
• invitation letters;
• certificates;
• applications;
• payment details;
• billing information;
• Affiliate Program information; and
• identity verification.

WLPI reserves the right to verify information submitted to us.

Where reasonably necessary, WLPI may request:

• additional identification;
• supporting documents;
• payment verification;
• proof of eligibility;
• confirmation of professional or academic information;
• clarification of inconsistent information; or
• other supporting evidence.

WLPI may suspend, reject, restrict, or terminate a service, application, Affiliate account, registration, or participation where information is reasonably believed to be:

• false;
• fraudulent;
• misleading;
• incomplete;
• inconsistent;
• unlawfully obtained; or
• used to misuse WLPI services.

WLPI may retain appropriate records of such incidents for:

• fraud prevention;
• security;
• legal claims; and
• protection of WLPI's legitimate interests.

5. Legal Bases Used by WLPI

Where GDPR applies, WLPI processes personal data using one or more lawful bases appropriate to the circumstances.

Contractual Necessity

WLPI may process data where necessary to:

• provide a purchased service;
• administer an application;
• register a participant;
• organize accommodation;
• provide transportation;
• issue an invitation letter;
• administer an event;
• issue certificates;
• operate an Affiliate relationship;
• process a payment;
• administer a refund; or
• take steps requested before entering into an agreement.

Legitimate Interests

WLPI may process personal data where necessary for legitimate organizational and commercial interests, provided applicable legal requirements are satisfied.

Such interests may include:

• operating WLPI;
• maintaining accurate records;
• improving programs;
• protecting WLPI's reputation and operations;
• preventing fraud;
• investigating misconduct;
• preventing misuse of documents;
• verifying transactions;
• preventing fraudulent chargebacks;
• maintaining website security;
• maintaining event security;
• managing partners;
• analyzing organizational performance;
• managing Affiliate Program integrity;
• protecting intellectual property;
• establishing or defending legal claims; and
• maintaining appropriate historical and institutional records.

Legal Obligations

WLPI may process and retain information where necessary to meet:

• accounting obligations;
• tax obligations;
• financial requirements;
• regulatory requirements;
• court orders;
• lawful governmental requirements; or
• other legal obligations.

Consent

WLPI may use consent where appropriate, including for certain:

• optional marketing activities;
• promotional uses;
• testimonials;
• non-essential cookies;
• optional sensitive data; and
• other activities where consent is legally required.

Vital Interests

Where necessary during an emergency, WLPI may process or disclose relevant information to protect the:

• life;
• health; or
• physical safety

of a participant or another individual.

6. Application Review & Selection

WLPI operates competitive application and selection processes.

WLPI may process applicant information for:

• eligibility checks;
• administrative review;
• merit assessment;
• application scoring;
• shortlisting;
• interviews;
• selection;
• scholarship decisions;
• Fully Funded decisions;
• Partially Funded decisions;
• waiting-list management;
• fraud prevention;
• duplicate-application detection; and
• internal quality control.

Application materials may be accessible to authorized:

• WLPI staff;
• evaluators;
• selection committee members;
• program administrators;
• authorized contractors; and
• appropriate organizational partners,

where necessary for the evaluation process.

Selection materials and internal assessment information constitute part of WLPI's internal administrative processes.

Nothing in this Policy requires WLPI to disclose:

• confidential internal business information;
• confidential evaluation methodologies;
• trade secrets;
• confidential third-party information; or
• information that may adversely affect the rights of another individual.

7. Passport, Identification & Visa-Support Information

WLPI may collect passport and identity information where necessary for:

• Official Invitation Letters;
• visa-support documentation;
• identity verification;
• event participation;
• certificate verification;
• accommodation arrangements;
• travel arrangements;
• embassy verification; or
• fraud prevention.

WLPI treats passport information as high-sensitivity identity information and limits access according to operational necessity.

Users authorize WLPI to use submitted passport information to prepare the documents or services they request.

WLPI may also verify the authenticity or consistency of identity information where reasonably necessary to protect the integrity of its services.

8. Embassy, Consulate & Government Verification

Where related to a WLPI invitation, event, visa-support service, or participant verification, WLPI may communicate with:

• embassies;
• consulates;
• visa application centers;
• immigration authorities;
• border authorities;
• governmental departments;
• law-enforcement bodies where lawfully required; and
• other competent authorities.

WLPI may confirm relevant information such as:

• participant identity;
• registration status;
• event information;
• participation category;
• invitation status;
• document authenticity;
• reference number; and
• other information reasonably necessary for verification.

WLPI will not provide unnecessary personal information where it is not relevant to the legitimate purpose of the communication.

9. Event Administration & Partner Data Sharing

WLPI operates international events and may share information reasonably necessary to provide event services.

Recipients may include:

• hotels;
• conference venues;
• universities;
• academic partners;
• transportation providers;
• travel partners;
• catering providers;
• security providers;
• local organizers;
• photographers;
• videographers;
• technology providers;
• event-management providers;
• printing and credential providers;
• speakers or program partners where necessary; and
• other suppliers engaged in event delivery.

Examples include:

• providing names to hotels for room allocation;
• providing flight information to airport-transfer providers;
• providing dietary requirements to caterers;
• providing participant lists to venues;
• providing relevant accessibility information to event staff; and
• providing registration details to authorized co-organizers.

WLPI determines what information is reasonably necessary for the relevant operational purpose.

10. Sister, Affiliate & Associated Organizations

WLPI may work with affiliated, associated, sister, partner, or commonly managed organizations.

Where lawful and reasonably necessary, WLPI may share personal information within such organizational relationships for purposes including:

• joint events;
• scholarships;
• educational programs;
• humanitarian initiatives;
• international programs;
• administrative support;
• technical services;
• finance;
• institutional partnerships;
• participant administration;
• communications;
• security;
• fraud prevention; and
• organizational development.

Such sharing may occur only where an appropriate lawful basis and, where required, appropriate contractual or international-transfer safeguards exist.

An affiliated organization may act as:

• a processor;
• a joint controller; or
• an independent controller,

depending on the particular activity.

11. Payment Providers & Financial Institutions

WLPI may transmit personal and transaction information to third parties necessary to receive or administer payments.

These may include:

• payment gateways;
• banks;
• card networks;
• acquiring institutions;
• invoicing providers;
• payment platforms;
• fraud-prevention providers; and
• accounting systems.

WLPI may retain transaction records necessary to:

• confirm payment;
• reconcile accounts;
• issue invoices;
• administer refunds;
• manage chargebacks;
• investigate payment fraud;
• respond to payment-provider inquiries;
• maintain accounting records; and
• protect WLPI in contractual or legal disputes.

Full payment-card credentials are generally processed by authorized payment providers rather than stored directly by WLPI.

12. Fraud Prevention & Security Monitoring

WLPI has a legitimate interest in protecting its:

• organization;
• events;
• payment systems;
• documents;
• participants; and
• digital infrastructure.

WLPI may therefore collect, compare, monitor, analyze, and retain information reasonably necessary to identify or investigate:

• fraudulent payments;
• fraudulent chargebacks;
• duplicate accounts;
• forged documents;
• fake applications;
• altered invitation letters;
• false identities;
• unauthorized access;
• suspicious referral activity;
• Affiliate Program manipulation;
• self-referral abuse;
• duplicate marketing compensation;
• system attacks;
• spam;
• misuse of WLPI branding; and
• other conduct threatening WLPI or its users.

WLPI may combine information from different WLPI systems where reasonably necessary to investigate suspected:

• fraud;
• abuse;
• security incidents; or
• contractual violations.

Where appropriate, relevant records may be provided to:

• payment processors;
• financial institutions;
• legal advisers;
• insurance providers;
• governmental authorities;
• law-enforcement agencies; or
• other parties necessary to protect WLPI's lawful interests.

13. Affiliate & Referral Tracking

WLPI may operate referral, ambassador, partnership, and Affiliate Programs.

WLPI may collect and process information required to:

• identify Affiliate traffic;
• attribute referrals;
• verify qualifying transactions;
• calculate commission;
• establish payout eligibility;
• monitor refunds;
• monitor chargebacks;
• identify duplicate compensation;
• detect self-referrals;
• prevent artificial transactions;
• investigate Affiliate abuse; and
• maintain financial records.

Referral attribution may use:

• referral links;
• referral codes;
• URL parameters;
• cookies where permitted;
• browser session information;
• local or session storage where permitted;
• server-side information;
• payment metadata; and
• transaction records.

WLPI may reject, reverse, block, or withhold Affiliate commissions associated with:

• invalid;
• refunded;
• fraudulent;
• manipulated; or
• otherwise ineligible transactions

in accordance with the Affiliate Program Terms.

14. Photographs, Video & Event Media

WLPI events may be:

• photographed;
• filmed;
• livestreamed;
• recorded; or
• documented.

Event media may include:

• photography;
• video;
• audio;
• interviews;
• participant statements;
• testimonials;
• group photographs;
• stage recordings;
• panel recordings;
• speaker recordings;
• networking footage;
• event highlights; and
• livestream content.

Subject to applicable law and the relevant lawful basis, WLPI may use event media for:

• institutional documentation;
• websites;
• social media;
• event portfolios;
• reports;
• newsletters;
• educational material;
• promotional campaigns;
• digital advertisements;
• sponsorship or partnership materials;
• press and public relations;
• future event promotion; and
• WLPI's historical archive.

Participation in a professional WLPI event may reasonably involve photography or recording as part of normal event documentation.

WLPI may rely on legitimate interests for appropriate general event documentation where legally permitted.

Where a participant is specifically selected for an:

• individual testimonial;
• endorsement;
• promotional feature; or
• another activity for which consent or separate authorization is appropriate,

WLPI may obtain that authorization separately.

WLPI retains intellectual-property and usage rights in WLPI-produced media to the extent provided by applicable law and relevant agreements.

15. Certificates, Invitation Letters & Verification Systems

WLPI may maintain digital verification systems for:

• invitation letters;
• certificates;
• participation records;
• reference numbers;
• QR codes;
• delegate credentials; and
• other official documentation.

WLPI may display limited verification information necessary to demonstrate authenticity.

This may include:

• participant name;
• event name;
• document category;
• reference number;
• issue status;
• validity status; and
• verification status.

WLPI may retain verification records after an event where reasonably necessary to:

• verify historical documents;
• prevent fraud;
• maintain institutional records;
• respond to embassy or employer verification requests; and
• protect against unauthorized document alteration.

16. Communications

WLPI may contact applicants, participants, Affiliates, customers, speakers, and partners through available communication channels.

These may include:

• email;
• telephone;
• SMS;
• WhatsApp;
• social media;
• website notifications;
• messaging systems; and
• other digital channels.

WLPI may send communications necessary for:

• application processing;
• selection;
• payment;
• document delivery;
• event administration;
• visa support;
• participation;
• safety;
• changes to programs;
• Affiliate administration;
• contractual matters; and
• customer support.

These are operational communications and may be necessary to provide requested services.

Marketing communications are managed separately and are subject to applicable marketing and privacy requirements.

17. Marketing & Future Opportunities

Where legally permitted, WLPI may use appropriate contact and engagement information to communicate:

• future events;
• new programs;
• scholarship opportunities;
• leadership opportunities;
• institutional news;
• educational programs;
• relevant WLPI services; and
• promotional offers.

Where consent is required, marketing will be based on appropriate consent.

Where another lawful basis is permitted, WLPI may rely upon that basis subject to applicable rules.

Individuals may:

• object to direct marketing; or
• use available unsubscribe mechanisms.

WLPI may retain a limited suppression record after an unsubscribe request so that the request can continue to be respected.

18. Cookies, Analytics & Digital Technologies

WLPI may use digital technologies necessary or useful for:

• website functionality;
• security;
• user sessions;
• payment processing;
• referral attribution;
• fraud prevention;
• website analytics;
• performance measurement;
• advertising;
• conversion measurement; and
• user experience.

WLPI may classify technologies as:

• strictly necessary;
• functional;
• analytics;
• advertising; or
• referral/attribution technologies.

Where applicable law requires prior consent for a non-essential technology, WLPI will use an appropriate consent mechanism.

WLPI reserves the right to use technologies that are strictly necessary for the:

• delivery;
• security;
• integrity; or
• operation

of requested digital services without treating such technologies as optional where the law permits.

19. Technology Providers & Data Processors

WLPI may appoint third-party service providers to process data on WLPI's behalf.

Such providers may support:

• hosting;
• cloud storage;
• CRM;
• email;
• messaging;
• website operations;
• payment processing;
• application management;
• event management;
• analytics;
• cybersecurity;
• document generation;
• marketing;
• fraud prevention;
• customer support;
• accounting;
• legal services;
• communications; and
• other operational functions.

Where required by GDPR, WLPI will use appropriate contractual arrangements with processors.

WLPI may change, replace, add, or remove service providers as its operational requirements develop, provided applicable data-protection obligations continue to be observed.

20. International Data Transfers

WLPI operates internationally, and personal information may be processed in countries other than the country in which the individual resides.

This includes transfers or access between:

Ufuq Group Kft – Hungary

and

Nexus Prime Group LLC – United States

as well as processing by international WLPI service providers and partners.

WLPI may conduct international transfers where a valid legal mechanism exists.

Depending on the circumstances, WLPI may rely upon:

• an applicable adequacy decision;
• Standard Contractual Clauses;
• other approved contractual safeguards;
• legally recognized certification or transfer arrangements;
• another mechanism permitted under GDPR; or
• a lawful derogation in the limited circumstances where one applies.

WLPI may implement additional:

• contractual;
• organizational;
• access-control;
• encryption; or
• security measures

where appropriate.

21. Security & Protection of WLPI Data

WLPI considers personal information entrusted to the organization to be protected organizational information.

WLPI implements technical and organizational measures designed to maintain an appropriate level of:

• confidentiality;
• integrity;
• availability;
• resilience;
• access control; and
• operational security.

Measures may include:

• secure website connections;
• authentication;
• access controls;
• role-based permissions;
• restricted document access;
• secure hosting;
• security monitoring;
• controlled administrative access;
• backups;
• confidentiality requirements;
• security procedures;
• payment-provider protections;
• fraud-detection mechanisms; and
• incident-response processes.

Particularly sensitive identity information, including passport documentation, may be subject to enhanced access controls.

WLPI retains the right to introduce, modify, strengthen, or replace security measures as technology, risk, and operational requirements evolve.

Although no digital environment can be represented as entirely immune from every possible security incident, WLPI takes appropriate measures designed to protect personal data against:

• unauthorized access;
• disclosure;
• alteration;
• loss;
• destruction; or
• misuse.

22. Confidentiality

Personal data held by WLPI is not intended to be freely accessible within the organization.

Access may be restricted according to responsibilities.

For example:

• application teams may access application information;
• selection teams may access evaluation information;
• finance personnel may access transaction information;
• visa-support personnel may access passport information;
• event teams may access registration and logistics information;
• Affiliate administrators may access referral and commission information; and
• technical personnel may access systems where necessary for maintenance or security.

WLPI may impose confidentiality requirements on:

• employees;
• contractors;
• evaluators;
• partners; and
• processors

where appropriate.

23. Data Retention

WLPI may retain personal data for as long as there is a valid:

• legal;
• contractual;
• administrative;
• financial;
• security;
• operational;
• evidentiary; or
• legitimate organizational reason

for doing so.

WLPI does not necessarily delete information immediately after:

• an event ends;
• an application is rejected;
• a participant withdraws;
• a transaction is completed;
• an Affiliate relationship terminates; or
• an individual stops using WLPI services.

Information may continue to be required for:

• accounting;
• taxation;
• payment disputes;
• chargebacks;
• legal claims;
• document verification;
• fraud prevention;
• security;
• contractual records;
• regulatory obligations;
• historical institutional records;
• Affiliate commission disputes;
• event records; and
• enforcement of WLPI Terms.

Different categories of personal data may therefore have different retention periods.

When personal information no longer serves a lawful or necessary purpose, WLPI may:

• delete it;
• anonymize it;
• restrict it;
• securely archive it; or
• otherwise dispose of it appropriately.

24. Right to Retain Records Despite a Deletion Request

A request for deletion does not automatically require WLPI to erase every record relating to an individual.

WLPI may lawfully retain information where necessary or permitted for reasons including:

• compliance with legal obligations;
• accounting;
• tax records;
• payment evidence;
• chargeback disputes;
• contractual claims;
• litigation;
• fraud prevention;
• security;
• enforcement of agreements;
• establishment, exercise, or defense of legal claims;
• freedom of expression or information where applicable;
• public-interest obligations where applicable; or
• another lawful exception.

Where only part of a record must be deleted, WLPI may retain other information that remains lawfully required.

25. Data Accuracy & Corrections

Individuals should notify WLPI if information becomes inaccurate.

WLPI may require reasonable verification before modifying identity-sensitive information.

In particular, WLPI may decline or delay changes to:

• passport data;
• legal names;
• certificates;
• invitation letters;
• payment records;
• Affiliate payment details; or
• other official records,

until sufficient evidence of the requested correction has been provided.

WLPI may retain records showing previous information or amendments where reasonably necessary for:

• audit;
• fraud prevention;
• document integrity; or
• legal purposes.

26. Data Subject Rights

Where GDPR applies, individuals may have rights including:

• access to qualifying personal data;
• correction of inaccurate information;
• erasure where the legal conditions are satisfied;
• restriction of processing in qualifying circumstances;
• portability in qualifying circumstances;
• objection to certain processing;
• withdrawal of consent where processing is based on consent; and
• protections relating to qualifying solely automated decisions.

These rights are subject to the:

• conditions;
• limitations;
• exemptions; and
• competing legal obligations

established by applicable law.

They should not be interpreted as an unrestricted right to:

• erase lawful financial records;
• remove evidence relevant to a dispute;
• obtain confidential information about other individuals;
• obtain WLPI trade secrets;
• obtain confidential evaluation methods;
• require deletion of records that WLPI is legally required to retain;
• interfere with fraud investigations; or
• prevent WLPI from establishing, exercising, or defending legal claims.

27. Access Requests

Where a valid right of access applies, WLPI will provide information required by applicable law.

The right of access relates to the individual's personal data.

It does not create an unrestricted right to obtain:

• entire WLPI databases;
• proprietary systems;
• trade secrets;
• confidential internal documents;
• confidential assessment methodologies;
• legally privileged information;
• personal data belonging to other individuals; or
• information whose disclosure would adversely affect the rights and freedoms of others.

WLPI may redact, restrict, or otherwise protect third-party and confidential information where legally permitted or required.

28. Identity Verification Before Privacy Requests

WLPI has an obligation to protect data from unauthorized disclosure.

Accordingly, WLPI reserves the right to verify the identity and authority of anyone submitting a privacy request.

WLPI may request reasonable information necessary to:

• identify the requester;
• locate relevant records;
• verify account ownership;
• prevent impersonation;
• protect confidential information; and
• confirm the authority of a representative.

WLPI will not disclose sensitive personal data merely because an individual claims to be the data subject without sufficient verification where there are reasonable doubts regarding identity.

29. Excessive, Repetitive or Unfounded Requests

Where permitted by GDPR, WLPI may:

• charge a reasonable administrative fee; or
• refuse to act

on requests that are manifestly unfounded or excessive, particularly where requests are repetitive.

WLPI may also take reasonable measures to prevent abuse of privacy-request procedures.

Each request will be assessed according to the circumstances and applicable law.

30. Impact of Privacy Requests on WLPI Services

Certain information is necessary for WLPI to provide particular services.

If an individual:

• withdraws necessary information;
• requests deletion of necessary information;
• refuses legally or contractually necessary processing; or
• fails to provide information required to deliver a service,

WLPI may be unable to continue providing that service.

For example, WLPI may be unable to:

• prepare an invitation letter without identity information;
• reserve accommodation without required participant details;
• issue an accurate certificate without a participant's name;
• process an Affiliate payout without required payment information;
• process a refund without transaction information; or
• complete an application without necessary application information.

Where necessary information is withdrawn, WLPI reserves the right to suspend or terminate the affected service where permitted by law.

31. Automated Systems & Administrative Technology

WLPI may use automated or technology-assisted tools for administrative purposes.

These may assist with:

• sorting applications;
• categorizing information;
• identifying duplicates;
• detecting suspicious transactions;
• identifying potential fraud;
• managing communications;
• analyzing website use;
• referral attribution;
• event administration; and
• supporting internal review.

WLPI may develop and change such systems as organizational requirements evolve.

Where GDPR restrictions relating to decisions based solely on automated processing apply, WLPI will comply with those requirements.

32. Data Breaches & Incident Response

WLPI maintains procedures for evaluating suspected personal-data security incidents.

Where an incident occurs, WLPI may:

• investigate the incident;
• restrict access;
• secure affected accounts;
• preserve evidence;
• engage technical specialists;
• communicate with processors;
• reset credentials;
• restore systems;
• notify affected parties where legally required;
• make legally required regulatory notifications; and
• take additional steps necessary to protect WLPI and affected individuals.

Whether notification is legally required will be assessed according to the nature and risk of the incident.

WLPI may maintain confidential incident records for:

• security;
• compliance; and
• legal purposes.

33. Legal Claims & Investigations

WLPI may preserve, access, review, use, and disclose relevant personal information where reasonably necessary to:

• investigate misconduct;
• investigate fraud;
• respond to a chargeback;
• enforce contracts;
• enforce Affiliate Program rules;
• protect intellectual property;
• protect WLPI documents;
• establish legal claims;
• exercise legal rights;
• defend WLPI against claims;
• respond to litigation;
• obtain legal advice;
• comply with court orders; or
• cooperate with lawful investigations.

A deletion or objection request does not necessarily prevent such processing where applicable law permits continued retention or use.

34. Corporate Reorganization & Business Transfers

Where permitted by applicable law, personal data may be disclosed or transferred as part of:

• corporate restructuring;
• merger;
• acquisition;
• transfer of activities;
• sale or transfer of business assets;
• internal reorganization;
• succession;
• establishment of a new operating entity; or
• a similar legitimate organizational transaction.

Any recipient receiving personal data as part of such a transaction will be required to handle it in accordance with applicable data-protection obligations.

35. Data Protection by Design

WLPI may integrate privacy and data-protection controls when developing:

• websites;
• forms;
• databases;
• application processes;
• payment systems;
• verification systems;
• Affiliate systems;
• event platforms; and
• new organizational processes.

WLPI determines appropriate controls based on:

• processing purpose;
• available technology;
• sensitivity of information;
• implementation cost;
• operational requirements;
• likelihood of risk; and
• potential impact on individuals.

36. Sensitive & Special-Category Information

WLPI generally requests only sensitive information reasonably necessary for a legitimate purpose.

Some event activities may require information relating to:

• accessibility;
• disability;
• health;
• dietary requirements;
• religious dietary requirements; or
• emergency requirements.

Applicants may also voluntarily include information in essays or applications that reveals:

• beliefs;
• political opinions;
• ethnicity;
• health status; or
• other sensitive matters.

Users should not submit unnecessary sensitive information.

Where special-category information is processed under GDPR, WLPI will rely upon:

• an applicable Article 9 condition; and
• an appropriate Article 6 legal basis.

37. Minors

Certain WLPI programs may permit participants under the age of 18.

Where appropriate or legally required, WLPI may require:

• parental consent;
• guardian authorization;
• emergency contact information;
• travel authorization;
• accommodation authorization;
• event participation authorization; or
• media authorization.

WLPI reserves the right to decline participation by a minor where required documentation or consent has not been provided.

Information concerning minors will be handled with additional consideration appropriate to the circumstances.

38. Emergency Situations

Where an emergency occurs during a WLPI event or activity, WLPI may disclose relevant information where necessary to:

• emergency services;
• medical personnel;
• hospitals;
• accommodation providers;
• security personnel;
• emergency contacts;
• authorities; or
• relevant WLPI personnel.

The safety and vital interests of individuals may justify processing that would not ordinarily occur during routine event administration.

39. Accountability & Internal Compliance

WLPI may maintain appropriate internal measures and records to demonstrate compliance.

These may include:

• processing records;
• processor agreements;
• confidentiality obligations;
• international-transfer safeguards;
• access controls;
• security procedures;
• consent records;
• legitimate-interest assessments;
• incident records;
• privacy-request records;
• retention procedures;
• Data Protection Impact Assessments where required; and
• internal reviews.

The existence of these internal compliance materials does not necessarily create a public right of access to confidential WLPI compliance documents.

40. Changes to Processors, Systems & Operational Methods

WLPI operates in an evolving international and technological environment.

WLPI reserves the right to:

• replace service providers;
• introduce new platforms;
• change payment providers;
• migrate databases;
• change hosting providers;
• change communication systems;
• introduce new fraud-prevention measures;
• introduce new security measures;
• introduce new application systems;
• modify Affiliate tracking;
• change data-storage locations; and
• otherwise update its technical and organizational infrastructure.

Such changes will be managed in accordance with applicable data-protection requirements.

Material changes affecting privacy practices may be reflected in updates to this Policy or other appropriate notices.

41. No Sale of Personal Data as a Business Model

WLPI does not operate a business whose purpose is selling participant or applicant personal information to data brokers.

Personal information is processed for legitimate WLPI:

• operational;
• contractual;
• event;
• administrative;
• institutional;
• security;
• marketing;
• partnership;
• financial; and
• legal purposes

described in this Policy and the WLPI Privacy Policy.

Data may nevertheless be disclosed to authorized recipients where necessary for those lawful purposes.

42. Rights of WLPI

Nothing in this GDPR Policy prevents WLPI, where permitted by applicable law, from:

• maintaining business records;
• protecting its systems;
• protecting its participants;
• protecting its intellectual property;
• verifying identities;
• verifying payments;
• investigating fraud;
• enforcing contractual terms;
• defending legal claims;
• monitoring Affiliate Program compliance;
• maintaining document-verification systems;
• retaining evidence;
• communicating with professional advisers;
• complying with governmental requirements;
• processing data necessary to provide requested services; or
• otherwise exercising lawful rights available to WLPI.

GDPR rights must be interpreted together with WLPI's legal obligations and lawful interests rather than as an unrestricted obligation to:

• delete;
• disclose;
• transfer; or
• cease processing

information whenever requested.

43. GDPR Request Procedure

Requests relating to GDPR rights may be submitted to:

support@wlpi.org

Users should include sufficient information for WLPI to identify the relevant:

• account;
• application;
• transaction; or
• event.

A suggested subject line is:

GDPR Request – [Type of Request]

WLPI may request additional information where reasonably necessary to:

• verify identity; or
• understand the request.

Users should not send unnecessary passport documents or sensitive information unless requested.

44. Response Time

WLPI will process valid privacy requests within the time required by applicable law.

Where GDPR applies, requests will generally be addressed:

• without undue delay; and
• within the statutory period.

Where a request is:

• complex;
• numerous;
• requires additional verification; or
• otherwise qualifies for an extension under GDPR,

WLPI may extend the response period as permitted by law.

The response period may also depend on obtaining sufficient information to identify the requester and understand the request.

45. Statutory Rights

Nothing in this Policy is intended to exclude a right that cannot legally be excluded under GDPR.

Where required by GDPR, individuals may also have a statutory right to lodge a complaint with a competent supervisory authority.

WLPI nevertheless encourages individuals with privacy questions or concerns to contact:

support@wlpi.org

so that WLPI can review and address the matter directly.

46. Relationship With Other WLPI Policies

This GDPR & Data Protection Policy should be read together with:

• WLPI Privacy Policy;
• WLPI Terms and Conditions;
• WLPI Refund Policy;
• WLPI Cookie Policy, where applicable;
• WLPI Referral/Affiliate Program Terms;
• event-specific notices;
• registration conditions;
• consent forms; and
• other notices provided for particular WLPI services.

Where a more specific privacy notice applies to a particular activity, the specific notice should be read together with this Policy.

47. Updates to This Policy

WLPI reserves the right to amend this GDPR & Data Protection Policy to reflect:

• changes in law;
• changes in WLPI operations;
• new services;
• new events;
• organizational restructuring;
• new technology;
• new service providers;
• new payment arrangements;
• changes to Affiliate Programs;
• changes to security measures;
• changes to data-processing practices; or
• regulatory requirements.

The latest version will be published on the official WLPI website with an updated revision date.

Updated provisions will apply prospectively from their effective date unless applicable law requires otherwise.

48. Contact WLPI

For GDPR requests, privacy questions, data corrections, access requests, deletion requests, objections, marketing requests, security concerns, or questions about WLPI's processing of personal information, contact:

49. Final Data Protection Statement

WLPI considers the personal information entrusted to it an important organizational responsibility.

WLPI uses personal data for legitimate and lawful purposes necessary to operate:

• international events;
• programs;
• services;
• applications;
• partnerships;
• payment systems;
• Affiliate Programs;
• digital platforms;
• visa-support activities; and
• related institutional operations.

WLPI reserves all rights available to it under applicable law to:

• collect information necessary for its services;
• verify information;
• process applications;
• assess applicants;
• maintain records;
• communicate with participants;
• administer programs;
• share information with authorized partners and service providers;
• transfer information internationally using lawful safeguards;
• maintain event documentation;
• protect and verify official documents;
• prevent fraud;
• monitor security;
• enforce contractual obligations;
• protect WLPI's reputation, systems, participants, property, and legal rights;
• retain information where legally or legitimately required; and
• take reasonable measures necessary to ensure the integrity and security of WLPI operations.

At the same time, WLPI applies the protections and rights required by applicable data-protection legislation.

The exercise of a privacy right does not invalidate WLPI's independent:

• legal obligations;
• contractual rights;
• legitimate interests;
• fraud-prevention requirements;
• security requirements;
• financial record-keeping duties; or
• rights relating to the establishment, exercise, or defense of legal claims.

By providing personal information to WLPI in connection with a requested:

• service;
• application;
• registration;
• program;
• event;
• payment; or
• other interaction,

individuals acknowledge that the information will be processed in accordance with:

• this Policy;
• the WLPI Privacy Policy;
• the applicable Terms and Conditions; and
• applicable law.