Legal Notice

The Members’ Portal is an internet-based technology providing FSC Members with a tool of interaction and engagement with FSC Group’s processes, allowing you to make decisions, comment, upload or download your materials via internet for FSC or for other users. The duties of hosting, maintenance and data processing are conducted by FSC International IT Services and their implementation partners on behalf of FSC AC. 

FSC AC is a ´controller´ of the personal data you provide to the Members’ Portal and FSC International IT Services acts as a ‘processor’ in providing the technical infrastructure of the platform.

In order to provide these services, we may need to collect some personal data. The data we collect can include the following:

• Full name (first name, last name)

• Member ID

• Email address

• User name

• Encrypted password

• Salutation

• Job title

• Company name

• Relation to FSC

• Type of Membership

• Chamber and sub-chamber

• FSC License code

• Telephone number

• Address

• Country

• Language

• State of activities

• Log in times to the platform 

• IP address

• Users’ personal opinions and further materials

• Skills, chosen by the user

• Areas of expertise, chosen by the user

• Tell us something about yourself, free text field to be filled out by the user

You directly provide us with most of the data you collect.  As User of the Members’ Portal you are responsible of providing accurate, complete and up-to-date information during registration on the Members’ Portal and completion of the access request form. 

This information includes your full name (first name, last name), email address, salutation, job title, company name, relation to FSC, FSC License code, country and language. The registration allows the User to access content and services of the Members’ Portal that are offered only to the registered Users. Registered Users have the option of changing or deleting the data specified during registration at any time. 

During the use of the Members’ Portal we will collect data concerning your activities and log-in times to the Members’ Portal.

We need to know your basic data in order to provide service of the Members’ Portal or for the reasons that might be reasonably expected. 

We use your data to do things like provide our services, improve and update our services, communicate with you, secure against fraud and abuse, analyze how people use our Services, troubleshoot issues, and as is required by law or necessary for safety and integrity.

All the personal data we process is processed by FSC International IT Services, however for the purposes of IT hosting and maintenance this information is located on servers in West Europe (Netherlands).

We will not collect any personal data from you that we do not need to provide and oversee this service to you.

Your personal data will be accessible to the data controller FSC AC and to the data processor FSC International IT Services with servers in West Europe (Netherlands). We will not share your information with other third parties, unless required to do so by law.

We will keep your personal data for 5 years following the termination of your account on our Members’ Portal. In some cases, we may be legally obliged to keep your data for 10 years.

FSC AC is committed to ensuring the privacy of your personal information. In order to prevent unauthorized access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

FSC would like to make sure you are fully aware of all your data protection rights. Every user is entitled to the following:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

Upon your request, we provide you with information about the personal data we hold about you. You have the right to access or verify your personal data FSC AC is holding and to have your personal data modified, corrected or deleted under certain conditions at any time.   If you would like to exercise one of your data protection rights, please do not hesitate to contact us privacy@fsc.org.

What are cookies?

Cookies are text files placed on your computer to collect standard internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. 

How do we use cookies?

Like many other websites, we also use "cookies".  Cookies are text files placed on your computer, to help the website analyze how users use the site. This automatically gives us certain data, such as IP address, browser used, operating system from your computer and your connection to the Internet. The information generated by the cookie about your use of the website (including your anonymized IP address) will be transmitted and stored on our servers in France and Germany. FSC AC will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage. Unless the law requires so, in no case will the data collected by FSC AC be passed on to third parties or a link with personal data will be established without your consent, unless the law requires so.

Only the people from within the FSC Network (which may include affiliates of FSC AC (collectively, "FSC") who need it to respond to your communication will use this information. We do keep track of the countries and domains from which people visit us, the browser and/or Internet Service Provider used and other related data. We analyze this data for trends and statistics. We do not collect any personal data and user sessions are anonymous.

You can view our website without cookies. You can refuse the use of cookies by selecting the appropriate settings (“do not accept cookies”) on your browser. Please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by FSC AC in the manner and for the purposes set above. 

We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. 

The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies we need your permission.

This site uses different types of cookies. Some cookies are placed by third party services that appear on our pages.

You can at any time change or withdraw your consent from the Cookie Declaration on our website.

Learn more about who we are, how you can contact us and how we process personal data in our Privacy Statement.

If you have any request for access, rectification, blocking and/or erasure of your personal data or if you have a complaint, please contact our Data Protection Officer directly (see below) in the first instance so that we can address your request and/or complaint.

If you have questions about this Privacy Statement, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us:

Email us at:   privacy@fsc.org 

Postal Address and further company details:

Forest Stewardship Council A.C., 

Calle Margarita Maza de Juárez # 422, Col. Centro, 68000 Oaxaca, Mexico 

Phone: +52 951 502 6533, +52 951 502 6594

Director General: Dr. Subhra Bhattacharjee and Marion Barriskell 

Public Registry of Property and Commerce: Oaxaca • Mexico • Registration No. 38602

IT Development and Maintenance:

FSC International IT Services

Adenauerallee 134 · 53113 Bonn · Germany
Phone: +49 (0) 228 367 66-0, Fax: +49 (0) 228 367 66-30

Managing Director: Dr. Subhra Bhattacharjee and Marion Barriskell 

Commercial register: Bonn HRB 15990

VAT-Ident-No: DE258067376

If you have a complaint about our use of your personal data, please contact our Data Protection Officer to address your complaint:

Rolf Poschmann
Sanddornweg 8, 45481 Mülheim
E-mail: poschmann@iitr.de 
Phone: +49 2102-87 99 181

We reserve the right to change this Privacy Policy Statement from time to time to ensure that it complies with current legal requirements or to implement changes to our services in the Privacy Statement, for example, when introducing new services. In this case your further visit will be subject to the new privacy policy. Be sure to check back here periodically for any changes.

This Privacy Policy Statement does not extend to anything that is inherent in the operation of the internet, and beyond the control of FSC and is not to be applied in any manner contrary to applicable laws, rules or regulations. 

This Privacy Statement was last updated on 18  November 2019.

Forest Stewardship Council, A.C. (“FSC”), located at Margarita Maza de Juarez 436, Colonia Centro, Oaxaca de Juarez, Oaxaca, Mexico, zip code 68000, Mexico, in compliance with the Federal Law on the Protection of Personal Data Held by Private Parties (the “Law”), its Regulations, the Guidelines of the Privacy Notice, and the FSC’s internal policies and procedures, makes this Privacy Notice (the “Privacy Notice”) available to you.

This Privacy Notice applies to the personal data we collect from FSC members (associates) based on their membership. It also details how we process your personal information for key events, such as the General Assembly of members.

Your personal data is very important to us. We will process it based on the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility under the Law, per the duties of care and confidentiality, and exclusively for the purposes described in this document.

Questions or clarifications

If you have questions or require any clarifications about this Privacy Notice, you can contact us at the following email privacy@fsc.org. If your question is related to the General Assembly event, please contact us in the email ga2025@fsc.org.

What personal data do we collect?

In order to comply with the purposes outlined in this Privacy Notice, we will process the following personal data of which you are holder:

• Identification and contact data, such as: full name, email address, cell phone number, home address, home phone number, federal taxpayer registration number, or tax identification number to issue invoices for the payment of fees as a FSC associate, username on social networks, and nationality.
• Financial data, such as: bank account(s), for example, in the event that you are subject to receive financial support from the FSC in order to attend a General Assembly (GA) and the need arises to make a transfer of resources.
• Employment data, such as: category, level, position in the workplace, previous employment, reference contacts in jobs, work history, work experience, and training.
• Photographic image and voice data.
• Data regarding your standpoint and opinions expressed in in-person or online meetings or webinars.
• Sensitive data, such as health condition, in case of a medical emergency during an FSC event.

Please note that, for the purposes set out in this Privacy Notice and as part of any travel arrangements and participation in in-person events of the FSC where medical assistance may be requires or due to a medical emergency in said events, the FSC will need to use sensitive personal information pertaining to your health condition in order to deal with the emergency. 

Additionally, for General Assembly (GA) events and other FSC events (e.g. regional members meetings), we collect and process various types of personal data to ensure a seamless event experience. This includes:

• Your name, contact details, job title, and organization.
• Sensitive data for event logistics: Dietary restrictions and accessibility needs to provide necessary accommodation.
• Travel data for subsidized members: Passport details, vaccination records (for compliance with travel regulations), and travel arrangements for hotel reservations and ticket purchases.
• Interaction data: Engagement in Q&A sessions, chat discussions, and polling activities during events to enhance participation.

Third parties’ personal data

If you provide the FSC with third-party’s personal data (for example, personal and/or professional references) to fulfill the purposes outlined in this Privacy Notice, you must advise said third parties that their personal data will be processed by the FSC and of the content of this Privacy Notice. By virtue of your provision of said information, you also state that you have the data subjects’ consent to transfer their information to the FSC and that the personal data is correct and complete.

Purposes of processing personal data

The FSC requires processing your personal data for the following purposes:

• To receive and evaluate FSC membership applications.
• To review documents and references submitted by FSC membership applicants.
• To manage the FSC’ active members’ registry.
• To manage the registration of and exit of FSC members.
• To register and manage the FSC’s Members Portal.
• To manage the FSC’s membership fees.
• To manage, control, and administer the files corresponding to FSC members.
• To publish the contact details of the members of the FSC.
• To manage and control all communications between the FSC and its members.
• To send invitations to events.
• To manage the registration process for events.
• Where appropriate, to record images, photographs, and audio of participants in events organized by the FSC, as well as the dissemination and promotion of such events.
• To prepare minutes or reports related to FSC events.
• To address questions, complaints, clarifications and/or suggestions.
• For statistics and historical record purposes of the members of the FSC.
• To provide care and assistance in case of any medical emergency that takes place in FSC in-person events.
• For General Assembly (GA) events and other FSC events (e.g. regional members meetings), personal data is processed to manage registration, event logistics, and accommodations. It is also used for communication, travel arrangements, and session participation. Interaction data from Q&As, chats, and polls is collected to enhance engagement.

In addition, we inform you that the FSC does not use your personal data for advertising, marketing and/or commercial prospecting purposes.

How long do we keep your personal data?

The FSC retains personal data for the necessary duration to fulfill the purposes outlined in this Privacy Notice, in accordance with applicable regulations and internal policies:

• General personal data (identification, contact, financial, and employment data): Retained for five (5) years following the last interaction with FSC, unless a longer retention period is required by law.
• Photographic image and voice data: Retained for five (5) years unless consent is withdrawn or earlier deletion is requested, provided that no legal or archival obligations require longer retention.
• Standpoint and opinion data from meetings/webinars: Retained for five (5) years for record-keeping.
• Sensitive data (health, dietary, and accessibility needs): Retained only for the duration of the event and securely deleted immediately after, unless retention is required to comply with legal or health-related obligations.
• Travel data for subsidized members (passport details, vaccination records, travel arrangements): Retained for one (1) year post-event for compliance and auditing purposes, after which it is securely deleted.
• Interaction data (Q&A, chat discussions, polling activities): Retained for five (5) years to improve engagement insights and event experiences.
• General Assembly (GA) event  and other events recordings: Retained internally for minute-taking purposes only and not shared externally unless required by law.

Once the retention period expires, the FSC securely deletes or anonymizes the data to prevent unauthorized access or misuse, ensuring compliance with privacy regulations.

Who can we share your personal data with?

The FSC may share your personal data, whether within or outside Mexico, with the third parties and for the purposes identified below:

• FSC’s controlling entities, subsidiaries and/or affiliates operating under the same internal processes and policies, for the purposes of managing, administrating and centralized protection of information, as well as statistical purposes.
• Federal, state, and/or municipal administrations and public authorities; commissions; institutes; regulatory bodies; judicial or administrative authorities; and national and/or foreign governmental entities, for the fulfillment of reporting obligations, to comply with obligations and for the recognition, exercise, or defense of the FSC’s rights and interests.
• Medical professionals or institutions, for the prevention or medical diagnosis, provision of health care, medical treatment or management of health services.
• Service providers or other third parties with whom the FSC has a relationship, where the transfer is necessary under a contract or when the transfer is necessary for the maintenance or fulfillment of the FSC’s relationship with you.
•  For General Assembly (GA) events and other FSC events (e.g. regional members meetings), attendees will have access to the participant list, which can include details such as name, organization, contact information, chamber, sub-chamber, country, and sessions registered to but this will only occur if participants agree to be added to such a list.
• Photos/videos taken during events may be shared on the GA website and FSC’s official social media channels.

Please contact us if you have any questions or concerns in this regard. 

Also, we inform you the FSC will ensure that it obtains the corresponding guarantees from any third party with whom it shares your personal data, so that they are safeguarded in terms of the Law, its Regulations, the Guidelines of the Privacy Notice and the FCS’ internal policies and, where appropriate, we will also provide them with this Privacy Notice so that its terms are complied with. 

ARCO Rights

We have implemented the legally required processes to comply with any request to exercise any ARCO Rights you communicate to us. Please note that ARCO Rights include:

• Access: the right to know what data we have belonging to you and to know how we use or share it.
• Rectification: the permanent right to request the rectification of your data if it is incorrect, inaccurate, or incomplete in our databases for any reason.
• Cancellation: the right to request that we delete your information from the moment it is blocked to its subsequent permanent erasure.
• Opposition: the right to indicate a legitimate cause for which we must stop using your personal data.

Your request must be sent in a signed format to the following email address: privacy@fsc.org or submitted to the following address: Margarita Maza de Juarez 436, Colonia Centro, Oaxaca de Juarez, Oaxaca, Mexico, zip code 68000.

The ARCO Rights request, whether physical or electronic, must include the following:

• Your full name and address or other means of communicating our response to your request.
• Copy of your official identification (and, where applicable, the official identification and power of attorney granted to the person exercising the right on your behalf).
• A clear and precise description of the personal data in respect of which you seek to exercise your ARCO Rights and the right or rights you wish to exercise. Your application must be signed at the end of the document and including your initials on each page
• Your address to hear and receive the response from the FSC, and when applicable, for any future communications and/or notifications, or the statement that our response and/or future notifications or responses can be sent by email, indicating the corresponding email address.
• If applicable, please provide any other information you consider important so that we can fulfill your request or locate your personal data.

The following procedure applies to any ARCO Rights application:

• We will respond to you within a maximum period of 20 (twenty) business days from the date we received your request.
• Upon receipt of the FSC’s response, you will have 15 (fifteen) business days to issue your response. If you are not satisfied, you may contact the FSC immediately through the means we have previously indicated, and the FSC will be happy to address any concerns you may have. If you fail to respond to the FSC’s response within the specified time, the FSC will understand bona fide that you agree with the response.
• Any such request shall be effective within 15 (fifteen) business days from the date we communicate our response to you.
• If, for any reason, your request is incomplete or contains errors that prevent us from responding, we will ask you to correct it within 10 (ten) business days after we inform you of the situation.
• If you do not respond within that time, we will consider the application unfiled, and you will need to start the process again.
• We will email you our response unless you state that you prefer to receive it by different means.

The cancellation right is not absolute. Please note that the FSC must retain certain information in order to comply with various legal obligations, and in order to do so, it may share your personal data with other governmental entities or agencies. In such cases, the cancellation right may need to be requested from the entity that received your personal data.

As the responsible party, the FSC may deny the exercise of your ARCO Rights in the cases permitted by the Law and its Regulations. In such case, it will inform you of the situation in response to your request. The refusal may be partial, wherein the FSC will comply with your access, rectification, cancellation, or opposition request regarding the appropriate information.

Do you want to revoke your consent to process your personal data?

In some instances, you may revoke the consent to process your personal data. However, this revocation is not retroactive, i.e., it cannot affect situations, formalities, or transfers made before the revocation of your consent, nor in cases where such revocation involves a breach of the legal provisions that establish the obligation to maintain the processing of your personal data for a certain period.

You can send your request to revoke your consent to the following email address privacy@fsc.org, following the instructions for exercising your ARCO Rights.

Limitations on the use and disclosure of your personal data

When you provide your information, or subsequently, you can limit the use or disclosure of your personal data. You may request that the FSC restricts the use of your personal data. In addition, you can indicate whether or not you authorize the FSC to share your personal data with other FSC entities in search of similar profiles. To exercise this right, you must follow the procedure and instructions applicable to exercising your ARCO Rights.

The FSC has implemented means and procedures to ensure that some of your data is included in its opt-out lists to prevent its disclosure. If you request registration on these exclusion lists, we will provide you with the corresponding proof of registration.

Confidentiality and Safety Measures

The confidentiality and protection of your personal data are priorities for the FSC, so we have established and maintained administrative, technical, and physical safety measures to prevent their damage, loss, alteration, destruction, use, improper access, or disclosure.

Cookies

In order to improve your experience on our website, it may use "cookies." "Cookies" are text files automatically downloaded and stored on your device to enable our systems to recognize your device and other features, including username and password.  We inform you that information on our use of cookies can be consulted in our cookies policy, published on the website https://fsc.org/en, in the section Privacy Notices.

Changes to our Privacy Notice

We reserve the right to modify, update, extend, and/or otherwise change the content and scope of this Privacy Notice at any time and in FSC’s sole consideration. In such cases, we will post such changes on the website https://fsc.org/en in the section Privacy Notices. The Privacy Notice that regulates the processing of your personal data will be the one that appears published on the website https://fsc.org/en in the section: Privacy Notices.

Consent and exceptions to consent

By providing us with your personal data and accepting this Privacy Notice, you acknowledge and accept it and grants us your implicit consent to process them. This consent gives us the right to process your personal data in the manner indicated in this Privacy Notice and with strict adherence to it, the corresponding Laws and Regulations, other applicable legislation, and the FSC’s internal policies.

Additionally, please note that it is not necessary to obtain your consent in the cases provided by law, specifically when processing the data is necessary to fulfill situations related to your relationship as a member of FSC (contractual necessity), or if the processing is required by applicable legislation, or also, for example, in the event of a medical emergency where we need to process your data to deal with the emergency.