Confidentiality

INTRODUCTION

IMSSA is present in Switzerland. Contact details can be found at https://www.imssa.org/Contact and our Data Protection Officers can be contacted at info@imssa.org.

We make sure that we meet or exceed legislated and industry standards for Data Protection to ensure that your personal information is protected across borders while we assist you worldwide.

In this Notice we make a commitment to protect your privacy. We also describe what information we collect about you and why we collect it, how we use and safeguard that information, and what choices you have, including how to access and update or ask us to delete your information.

OUR PROMISE TO YOU

When we need your Personal Information, we always explain the purpose and will not use your information for any other purpose without asking you first.

We do not retain your personal information longer than required for the purpose of providing our services to you.

Your personal information can only be accessed by authorised personnel.

You can ask to review or update the personal information we hold about you.

We only share information with third parties for purposes either specified in this Privacy Notice, or for reasons required by law or with your explicit prior consent.

We carefully select the third-party service providers who support us with the processing of personal data and implement contractual clauses that hold them accountable to the same data protection and privacy standards we meet ourselves.

We actively monitor external threats and act quickly and transparently to protect your privacy.

We understand that technology develops rapidly. We continuously monitor and enhance the measures we have implemented to protect your information from unauthorised access and accidental loss or disclosure.

PERSONAL DATA

Types of Personal Data
Personal Identifiable Information (PII) is information that can be used on its own or in combination with other information, to identify, contact or locate a single person, or to identify an individual or natural person in context (and includes Personal Data). Personal Data is information pertaining to an identified or identifiable individual. PII and Personal Data do not include anonymised or statistical data that by itself does not allow identification of you as an individual. Sensitive Information or Special Category Personal Data we may collect includes information about an individual’s current health or health history, sexual orientation or religion.

HOW WE PROCESS PERSONAL DATA

In order to provide our services, we will usually need to collect some personal information about the individuals we are assisting. We will also sometimes pseudonymise and anonymise data and use it for statistical analysis and reporting, to help improve our services or for research purposes.

We collect Personal Information about you when you buy, use or benefit from IMSSA’s services or products. We also need to collect your Personal Data if you apply for a role with us.

We may not always receive personal information from you directly but also from other sources, such as the organisation which you are working for or providing service to ("your employer") or your relatives, your insurance company, other assistance companies, financial institutions, medical service providers or travel agencies.

• Information and Advisory Services:
• Web Portal
• Assistance App
• Tracker ("Travel Tracker")
• Travel Ready, Work Ready & Flight Ready (Self-Declared Monitoring)
• Medical Advice & Services
• Security Assistance Services
• Concierge Services (Welcome Desks)
• IMSSA Public Websites

If you cannot find the information you are looking for, please contact info@imssa.org.

DATA PROTECTION FOR CHILDREN

IMSSA recognises the particular importance of protecting privacy where children are involved. "Children" means individuals below the age of eighteen (18) years unless a different age is specified under applicable law.

Our websites are not directed at children, and we do not invite children to provide personal data through websites or applications.

In the event that personal data is collected from children, we take additional steps to protect children’s privacy. Where required by applicable law, we will ask children to obtain consent from their parents or legal guardians before collecting their data.

In the event we become aware that we have inadvertently collected personal data from a child below the age of 18 without parental or its Federation/Association, we will take appropriate steps to erase such information from any of our electronic lists as quickly as possible.

If you believe we might have any information from or about a child below the age of 18 and/or you would like to request that such data will be removed, please contact info@imssa.org.

EXERCISING YOUR RIGHTS AS A DATA SUBJECT

In accordance with applicable Data Protection Regulation and our Data Protection Policy, you can seek information about, access to, or revise, or ask to delete or stop processing the personal information that IMSSA has collected from you. You also have the right to withdraw your consent and the right to portability.

If you have a user account, you can also access and manage your records through our website. You can also contact the Assistance Centre, clinic, medical service facility or individual employee you have been dealing with. Or you can write to us using the contact link on our website. To unsubscribe from email alerts, you can contact info@imssa.org.

Please note that when processing your personal data on your organisation's behalf, in the course of providing digital workforce resilience management and/or mobile services, IMSSA is only permitted to act on instructions from your organisation so please either contact your organisation directly or we will contact them for authorisation before we can fulfil your request.

When you submit a Data Subject Right Request to IMSSA,

1. You will be asked to provide IMSSA with details of the data requested to help us to discover the data more easily;
2. If you are asking to correct your data, we may need to ask for the reasons why that data needs correction;
3. You may be asked to provide proof of who you are;
4. If we act as Data Processor on behalf of your employer, we will need to seek instructions from your employer before we can address your request;
5. Sometimes we may not be able to fulfil your request due to conflicting legal obligations (such as having to maintain medical records for a certain amount of time) or because we have another legitimate interest that we consider lawful under applicable Data Protection Legislation.

We will acknowledge your request within five working days.

We strive to fully address your request as soon as possible and to respond to you within no more than 30 calendar days from the date it is received, and your identity has been verified. In some cases of greater complexity or if you have submitted multiple requests, we may need to extend this period by a further two months. We would let you know if an extension is required before the initial 30 days have elapsed.

If IMSSA is asked to destroy personal information, we will ensure that its recreation is prevented and shall take reasonable care to make sure that there is no unauthorised disclosure during the destruction of the data. To allow us to do this, we will maintain a record of all such requests, including a minimum of personal information required. None of the personal data shared with you via the Privacy Portal under an access request will be retained longer than 30 days.

If you are dissatisfied with our response to your Data Subject Rights Request, please do not hesitate to contact us to discuss further. Please see below RESOLVING DISPUTES for details.

RESOLVING DISPUTES

To resolve a dispute, you can contact the main office or individual employee you have been dealing with. Or you can write to us using the contact link on our website.

You may also direct all enquiries, concerns, or complaints regarding our processing of your personal information to info@imssa.org.

Si vous n'êtes pas satisfait de la manière dont votre demande ou votre préoccupation concernant nos services en ligne est traitée, vous pouvez contacter info@imssa.org.

We promise to investigate and address all concerns and complaints as quickly as possible. We will provide an acknowledgement of your query together with an indication of the approximate length of time that it will take us to review it within a week of receipt. If it will likely take us longer than two weeks to address your query, we will also provide you with regular updates throughout the process. We strive to fully address your request as soon as possible and to respond to you within no more than 30 calendar days from the date it is received. In some cases of greater complexity or if you have multiple concerns, we may need to extend this period by a further two months. We would let you know if an extension is required before the initial 30 days have elapsed.

If we act as Data Processor on behalf of a Data Controller such as your Federation or Association, we first need to seek instructions from your Federation. Similarly, if you receive services from IMSSA SA through International SOS or a third party such as those listed above, and your personal information has been improperly processed as a result of the actions or inactions of that third party, we cannot be responsible for resolving any resulting disputes. In such cases, we will direct you to the appropriate point of contact.

INFORMATION SECURITY

We invest in industry-standard encryption and commission regular penetration testing and continuous threat monitoring

We thoroughly and routinely vet the Information Security Management Systems of all our third-party IT vendors

We have internal policies in place to prevent inappropriate or unauthorised access, disclosure or accidental loss of personal information and all employees receive regular training on data protection.

We have implemented physical security measures to safeguard personal information from misuse, alteration, accidental loss, or destruction.

SHARING YOUR PERSONAL DATA

We do not sell your personal information in any circumstances and our business model does not rely on such action.

Your personal information may be transferred within IMSSA, or to third parties that help us deliver our services to you. These companies may be located in another country. If we need to transfer Personal Data outside of Switzerland, and the recipient country does not have adequacy status, we implement the required guarantees such as the Swiss standard contractual clauses.

We will first ask for your consent whenever we need to transfer sensitive Personal Information (such as medical information) to any third parties other than our sub-processors or suppliers with whom you have explicitly asked us to engage on your behalf (for example, when you ask us to schedule a medical appointment or hospital admission).

We do not share your personal information with third parties unless one of the following conditions or reasons applies:

• We have a legitimate interest to do so
• To be able to provide our services we may share some personal information with third parties in a way that you would expect, such as providing your name to the medical practice where you have asked us to arrange an appointment for you. We also provide personal information within International SOS or other trusted businesses or persons to process it for us based on our instructions and in compliance with Data Protection Legislation, our Data Protection Policy and additional confidentiality and security measures. If you require a list of our third-party data processors, please contact info@imssa.org.
• You have provided explicit consent.
  We will ask for your explicit consent before sharing any sensitive personal information about you. We will provide you with clear explanations to allow you to make an informed choice. You are entitled to withdraw your consent at any time.
• There is a legal obligation
  We may transfer your personal information to Government authorities, agencies and institutions, but ONLY as required or allowed by applicable regulations.
• We need to verify your insurance or employment benefits
  In some cases we may need to notify third parties such as your insurer or employer, for example to verify your benefits before paying for your medical expenses, and share some of your personal information with them. We will always ask for your consent if sensitive data needs to be shared or if we need to share information for additional purposes that you may not expect.