Version 1.0 -- 1 July 2019
This policy outlines Chapter policies with respect to the treatment of the personally identifiable information (PII) of the following individuals:
- Current and past website users and individuals who purchase materials;
- Members (both current and past);
- Event attendees, speakers, sponsors, survey respondents, and other participants in Chapter programs; and
- Non-member volunteers who participate on Chapter projects and/or volunteer groups.
This policy does not describe Chapter policies with respect to personally identifiable information of employees, consultants, contractors, vendors, licensees, sponsors, or advertisers.
This policy applies to handling of personally identifiable information stored in all forms (whether on paper, electronically – including on computer hard drives, CD ROMs, removable flash drives – or otherwise) by Chapter. It does not describe the treatment of information by legally independent entities that may work with Chapter, including ISACA International.
This policy is for internal use by Chapter volunteers, employees and by others (such as contractors, vendors, committee members, and the like) who have access in the course of their duties for Chapter to PII (as defined below) maintained by or on behalf of Chapter.
Responsibility and Accountability
The Audit Committee Director, George Baxendale, is responsible for Chapter’s privacy program, which responsibilities include maintaining the ISACA New England External and Internal Privacy Policies and responding to inquiries provided to the ISACA NE secretary.
Chapter provides notice about its policies and practices relating to personally identifiable information and identifies the purposes for which information is collected, used, stored shared, and secured. Chapter’s notice program includes the following elements:
- When feasible (and/or legally required) Chapter provides notice to individuals before their personally identifiable information is collected.
- Chapter provides notice and obtains consent (as legally required) before information it maintains is used for a purpose that is either unrelated to the purpose for which the information was originally provided, or that is for a purpose that was not disclosed in the original notice to the individual.
- Chapter provides external notice about its privacy practices on its website. The notice describes how personally identifiable information is collected, used, stored, and shared, and secured
- Chapter provides notice in its various printed information collection forms about how personally identifiable information will be used.
- Chapter also provides notice in situations other than traditional online or offline information collection, such as when people are taking surveys or attending meetings, and instructs its employees about when notice must be provided.
Collection of Personally Identifiable Information
Chapter uses fair and lawful means to collect information, collects information using methods that have been reviewed and approved by the chapter designee responsible for the Chapter privacy program, and analyzes third-party sources of personally identifiable information to determine if those third parties are reliable data providers.
It is Chapter’s policy not to develop or acquire additional information about those individuals whose personal information is covered by this policy, unless it has obtained consent from those individuals. Certain exceptions apply, including to build behavioral profiles or to obtain information to verify applicants for courses or certification.
Chapter currently collects the following types of personally identifiable information (for the purposes described in the “use” section of this policy):
Personal data type:
Your ISACA registration details including membership number, certifications with dates of exams passed and certified, membership payment status and certification status
(Restricted access to scoped database extracts)
Event registration details
(Members and Non-Members)
ISACA NE event registration
Membership survey details, including name, email, gender, work status
ISACA NE online surveys
Name, personal contact details, query Information
Queries from Members/Non-Members
Personal Data Shared with ISACA International
The personal information shared by ISACA International is used to meet ISACA NE objectives as an affiliate of ISACA International and provide membership services to ISACA NE members. We use your personal data to provide following services:
- Maintain your record of registration for attending the ISACA NE event and share it with event venue host/provider to print and issue attendee badges for security, health and safety;
- Keep you informed of future ISACA NE and partner educational events (including meetings, conferences, courses etc.);
- Send you ISACA NE newsletters;
- Contact you to participate in appropriate surveys and research initiatives supported by ISACA NE; and
- Contact you to participate in the ISACA NE Annual General Meeting.
Personal Data Collected by Cvent
The registration information that you provide when you register for ISACA NE educational events is limited to name, email address, company name & ISACA membership number.
This event registration information is used by ISACA NE and its service provider and venue hosts to provide following services:
- Issue event ticket;
- Authenticate on arrival;
- Provide name badges; and
- Record evidence of entry and attendance to the event to ensure compliance with security, health and safety requirements.
To the extent that information requested is not required for your participation in a given ISACA NE Chapter program, you will be told which information is optional. Should you fail to provide optional information, certain ISACA Chapter programs or features may not be available to you.
If you are an ISACA NE member, your ISACA membership number and duration of the event will be passed to ISACA International to update your CPE records. For audit purposes, the information collected during event registration will be retained by ISACA NE for a maximum of five years.
If you are not an ISACA member, ISACE NE will delete your data within twelve months of the event.
Passive Online Data Collection
Choice and Consent
To the extent feasible – keeping in mind Chapter’s legal obligations, business goals and resources – Chapter gives individuals choice about how their information will be used. This choice includes, for example, seeking consent and/or providing clear notice about use of personally identifiable information.
Chapter informs individuals what choices they have about how information will be used, stored, or shared with third parties.
Use of Personally Identifiable Information
Chapter uses personally identifiable information it obtains for the following purposes:
- To process individuals’ requests;
- For purposes that a reasonable individual would view as related to the purpose for which an individual provided information; and
- For other legitimate business purposes of Chapter that are permitted by applicable laws, rules and regulations, and/or that are in keeping with appropriate industry guidelines and practices
- Sharing of Personally Identifiable Information
Chapter shares personally identifiable information with third parties only for legitimate business purposes and as permitted by applicable law, rules and regulations. Instances when Chapter may share information include:
- To vendors or third-party to deliver or provide goods and services, including, for example, exam testing agencies and training providers and partners, product-fulfillment companies, or third-party event hosts;
- To the IT Governance Institute, ISACA Headquarters, and from time to time volunteers (such as ISACA board members) performing tasks on Chapter’s behalf;
- To those who wish to determine if an individual is certified provided that the requester of the information provides to Chapter the certification number and last name of the individual;
- To investigate potentially fraudulent or questionable activities;
- In anticipation of and in the course of an actual or potential sale, reorganization, consolidation, merger, or amalgamation of all or part of Chapter’s business or operations; and
- When Chapter believes it is necessary to cooperate with law enforcement or in response to a government request
When sharing information, Chapter limits the amount and type of information shared to that which the other party needs or that is relevant to the other party.
If Chapter shares personally identifiable information with a vendor or other third party providing services on Chapter’s behalf, Chapter requires that the third party use the data as directed by Chapter and that it maintain the confidentiality and security of the data.
Chapter will take appropriate remedial actions if it becomes aware of any situation in which a third party misuses personally identifiable information.
Retention of Personally Identifiable Information
For audit purposes, the information collected during event registration will be retained by ISACA NE for a maximum of five years.
If you are not an ISACA member, ISACE NE will delete your data within twelve months of the event.
ISACA NE Chapter retains personally identifiable information for as long as necessary for its legitimate business purposes, and as otherwise permitted by applicable law.
Completion and Accuracy
Chapter relies on individuals to provide it with complete and accurate personally identifiable information, and in certain circumstances may require individuals to represent and warrant that the details they have provided are their own, are complete, and are accurate.
How to Contact ISACA NE Chapter and Modify Your Information or Preferences
To help us keep your personal information up to date, or to request access to the personal information ISACA NE Chapter maintains about you, you may contact us at firstname.lastname@example.org.
Modifications to this Policy