This Privacy Notice covers the processing of personal data necessary for the certification activities of the International Board of Lactation Consultant Examiners® (IBLCE®).
WHO WE ARE
We are the International Board of Lactation Consultant Examiners (IBLCE) and our global Headquarters are located at 10301 Democracy Lane, Suite 400, Fairfax, VA 22030, USA (Phone: +1 703-560-7330; Fax: +1 703-560-7332; e-mail: firstname.lastname@example.org). You can find a list of all our contact points HERE.
If you have any questions about how we process your personal data, please contact email@example.com. IBLCE serves as the controller of the information you submit to us or we collect from you in connection with your application, certification and the maintenance of your certification and the means through which it is processed.
The purposes of the processing activities relate to organising the certification exam, the administration of the exam, managing the application process, evaluating your knowledge and preparedness for obtaining the certification, and if you become certified, maintaining and managing your certification.
We will use your contact information for sending occasional communications necessary for the certification process and the maintenance and management of your certification, if you obtain one.
The legal basis we rely on for processing the personal data that you submit by filling out the “Exam application” form or “Recertification Form” and for the creation of your online login for the administration of the test or for recertification by CERPs is the performance of a contract to which you are party and taking steps at your request prior to entering the contract. For other processing we use a different lawful ground.
As part of the application process and during the examination we may process special categories of data at your request (in particular data related to health when accommodations are requested). For processing this data we rely on your consent.
For processing of personal data related to your activity while logged in on our website and for generally maintaining and managing your certification (if you obtain one), we rely on our legitimate interest to prevent unauthorized access, ensure security of our online presence and of your personal data, and ensure the accuracy of your personal data. For using your contact details to keep you informed about your certification application (including the exam) and your actual certification, if you obtain one, we rely on our legitimate interest.
CATEGORIES OF PERSONAL DATA
We process the personal data you submit with your application form, when contacting us to tell us about your particular situation, when making a specific request for examination accommodations, or in connection with your actual certification or recertification. The required information that is strictly necessary for the administration of the exam is marked with an asterisk in the application form. Failure to provide this information will result in the impossibility to take the certification examination or for us to certify or recertify you.
RECIPIENTS OF YOUR DATA
IBLCE does not make your personal data available to any third party, other than our vendors, who process personal data on our behalf and following a strict mandate (they act as processors).
IBLCE relies on vendors to support the administration of the certification examination, maintenance of certification and evaluation. Specifically, our vendors provide the following services:
- technical support for the administration of the exam (US and UK)
- e-mail and cloud storage service provider (US)
- applicant and candidate management service provider (US)
According to our retention policy, we only keep personal data in our records as long as they are necessary for the purposes they have been collected and processed for. We adhere to our Data Retention Policy to determine how long we retain data, including personal data.
- We retain certification applications and all related materials and personal data for 10 years.
- We retain correspondence with you surrounding the organisation and administration of the exam for 3 years.
- We delete special categories of data you share with us for the organisation of the exam as soon as possible and we strictly restrict access to such data.
- We retain names, addresses, exam scores, and certification status dates permanently.
If you are located outside of the United States, IBLCE transfers personal data related to applications and administration of the exam to the United States. The United States has not sought nor obtained adequacy status for ensuring an equivalent level of protection of personal data, from the European Commission. There are risks associated to the transfers, but IBLCE has put safeguards in place to protect your data after it is transferred.
To ensure the lawful transfers of personal data from the European Economic Area (EEA), IBLCE relies on necessity for the performance of a contract as a derogation that allows international transfers to occur (Article 49 GDPR).
IBLCE is committed to facilitate the exercise of your rights granted by data protection laws in a timely manner – the right to access your data, to ask for erasure, correction, restriction, portability of your data or to object to the processing of your data.
In order to be able to reply to your request and if we are not certain of your identity, we may need to ask you for further identification data to be used only for the purposes of replying to your request. If you have any inquiries or requests, write to firstname.lastname@example.org or contact us through our postal address.
Access, correction and other requests
You have the right to obtain confirmation whether we process or not your personal data, as well as the right to obtain information about the personal data we process about you and to obtain a copy of this data.
You have the right to obtain erasure, correction (updating or completing your personal data), restriction and portability of your personal data, under certain conditions.
Right to object
You also have the right to object at any time to receiving marketing materials from us by following the opt-out instructions in our commercial emails, as well as the right to object to the processing of your personal data based on your specific situation (only in those cases where we process the data on the basis of our legitimate interest, as detailed above). In the latter case, we will assess your request and provide a reply in a timely manner, according to our legal obligations.
For all the processing operations that are based on your consent, as described above, you can withdraw consent at any time and we will stop those processing operations.
If you have any concerns or questions about how your personal data is used, please contact our Privacy Officer at email@example.com.
However, if you are in the EU and you believe we have not been able to deal with your concern, you have a right to raise this issue with your local data protection authority. If you are located in the EEA, you have the right to submit a complaint in the Member State of your residence, place of work of an alleged infringement of the General Data Protection Regulation (GDPR).