Website Terms, Privacy and Responsible AI Notice
People to People International AISBL
Version 1.0 | Effective 25 August 2026 | ptpi.network
At a glance
If you read nothing else, read this. The detail that follows says the same thing more carefully.
| What this website does | What this website does not do |
|---|---|
|
|
1. Who we are and how to contact us
People to People International AISBL (PTPI) is the organisation responsible for this website and for the personal data described in this notice. In data protection language, PTPI is the controller.
- Legal address: c/o ACE of Brussels, Drève du Prieuré 19, 1160 Brussels, Belgium
- Registration number: BE1013316636
- Email: office@ptpi.network
- Telephone: +32 478 48 20 23
Privacy questions are handled by the Director General at the Global Coordination Centre in Brussels, using the contact details above. PTPI has not appointed a Data Protection Officer, because our processing does not meet the conditions in Article 37 of the GDPR that make one compulsory. If that changes, we will publish the contact details here.
This notice applies to ptpi.network and to the forms and services linked from it. A specific programme or event may provide additional privacy information where its data use is different.
2. Who is responsible: PTPI, chapters and partners
PTPI is a network. That has a practical consequence for your data, and we would rather explain it than leave you guessing.
The Global Coordination Centre in Brussels is responsible for this website and for the data described in this notice.
PTPI chapters and national associations are separate organisations with their own legal identity in their own countries. When you deal directly with a chapter, that chapter is normally responsible for your information, under its own local law and its own privacy information.
Where PTPI and a chapter or partner genuinely decide together how and why information is used, for example a shared programme or a joint event registration, we are joint controllers. In those cases we agree in writing who does what, and we will tell you the essential parts of that arrangement on request. You may exercise your rights against either organisation.
If you are not sure who holds your information, ask us. We will tell you, or point you to the right organisation.
3. Using our website
You may use this website for lawful, personal and community purposes. Please do not misuse it, interfere with its security, impersonate another person, submit unlawful or harmful material, or infringe anyone's rights.
Unless stated otherwise, PTPI owns or is licensed to use the website's text, design and materials. You may share links and quote short extracts with clear credit. Please ask before reproducing substantial content, or before using PTPI names, logos or materials commercially.
If you send us material: If you send us text, photographs, film or other material for possible publication, you confirm that it is yours to share and that anyone identifiable in it has agreed. You give PTPI permission to use it in PTPI communications on a non-exclusive, royalty-free basis. You may ask us to stop using it at any time. We will stop future use and remove it from channels we control, but we cannot recall printed material or copies already shared by others.
Availability and accuracy: We work carefully to keep information accurate and useful, but some content may become outdated or contain errors. The website is provided for general information and is not legal, medical, financial or other professional advice. We may change, suspend or withdraw parts of the site, and we do not promise uninterrupted availability. External links are provided for convenience; PTPI does not control third-party websites. Nothing in these terms excludes liability that cannot lawfully be excluded.
General: The membership portal may have its own separate terms. If any part of these terms is found to be unenforceable, the rest continues to apply. A delay in enforcing these terms is not a waiver of them. Nothing here creates a partnership or agency relationship between you and PTPI.
Belgian law applies to these terms. Belgian courts have jurisdiction, subject to any mandatory rights that apply where you live.
4. What personal data we use, why, and on what legal basis
Depending on how you engage with us, we may use the following information.
- Contact and correspondence data, such as your name, email address, telephone number and message, to answer you and manage our relationship. The legal basis is usually your request, our legitimate interest in communicating with our community, or steps connected with an agreement.
- Membership, chapter, event, mobility, volunteer and partnership data, to deliver the activity, manage safety, keep appropriate records and meet legal duties. The legal basis may be an agreement, a legal obligation, legitimate interests, consent, or protection of vital interests in an emergency.
- Newsletter preferences and email address, to send Connections and other updates where you have subscribed. You can unsubscribe at any time.
- Donation and transaction records, to process and account for donations and meet financial and legal duties. Payment providers process payment-card details under their own notices. PTPI does not receive or store full card details.
- Technical and security data, such as IP address, browser information, timestamps and server logs, to operate, secure and improve the website. We rely on legitimate interests and, where required, consent.
- Photographs, stories and other contributions, to communicate PTPI's work where we have permission or another lawful basis. See section 8.
The legitimate interests we rely on: Where we rely on legitimate interests, those interests are: running and securing this website; communicating with the PTPI community; keeping accurate records of membership and programme participation; preventing fraud and misuse; understanding in aggregate which of our articles are read; and protecting PTPI's rights. We have weighed those interests against your rights and freedoms. You may ask us for a summary of that assessment, and you may object at any time.
Automated decisions: We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects. See section 13 for how this applies to AI.
Please do not send sensitive personal information, such as health, religious or political details, unless we have asked for it and explained why it is needed.
5. Where your information comes from, and whether you have to give it
Most of the time, your information comes directly from you. We may also receive it from:
- a PTPI chapter or programme partner that nominates, registers or refers you;
- a school, university or employer arranging a placement or exchange;
- a person who names you as a reference, an emergency contact or a next of kin;
- a payment provider confirming a donation or a membership payment; and
- publicly available sources, such as an organisation's own website, when we are establishing a professional or partnership contact.
Where we obtain your information from someone else, we will tell you within one month, or at our first contact with you, unless an exemption in the GDPR applies.
You are never obliged to give us personal data. Where information is genuinely needed, for example to process a membership, arrange travel, meet a safeguarding duty or satisfy Belgian accounting law, we will say so and explain the consequence. Usually the consequence is simply that we cannot deliver that particular service.
6. Cookies, embedded content and similar technologies
We use strictly necessary cookies and similar technologies to make the website work and keep it secure. These do not require consent. We ask for consent before using optional analytics, advertising, social-media or other non-essential technologies.
How we ask: These are the standards we hold ourselves to.
- Refusing is as easy as accepting. There is a clear refuse option at the same level as accept.
- Nothing optional is switched on or pre-selected before you choose.
- We do not use a cookie wall. Refusing optional cookies does not restrict access to anything published on this site.
- You can change or withdraw your choices at any time through Cookie settings.
- We record your choice and will not ask again for a reasonable period.
We are completing a full review of our consent banner and of every request this site makes to another organisation. When that review is finished we will publish the current list of cookies, with their purposes and lifetimes, in the cookie settings panel. See section 17.
Content loaded from other organisations: Some pages may load resources hosted elsewhere, for example web fonts, video players, maps or social-media posts. When your browser fetches these, your IP address and browser details reach that organisation, even when no cookie is set. Our aim is to host what we reasonably can ourselves, to load the rest only after consent, and to use privacy-enhanced or click-to-load modes for embedded video. Some third-party requests remain on this site, including web fonts. Removing them is one of the improvements listed in section 17.
7. Email and newsletter tracking
Connections and our other email updates are delivered through our membership platform. Those emails may record whether a message was opened and whether links were clicked.
We use this only in aggregate, to judge whether our communications are useful and to stop sending to addresses that are no longer active. We do not use it to build a profile of you, to score you as a donor, or to make decisions about you.
You can unsubscribe at any time using the link in any message, or by emailing us. If you would prefer that we did not record opens and clicks for your address, tell us and we will do whatever the platform allows. You can also read our messages with images turned off, which prevents open tracking.
8. Photographs, film and personal stories
PTPI exists because people meet people, so photographs and personal stories are central to what we publish. They are also personal data, and for many people they are the most sensitive thing we hold.
At PTPI events we tell people in advance when photography or filming is planned, and we offer a practical way to opt out, for example a marked lanyard, a designated area, or simply telling the photographer.
Where we publish an identifiable image or a personal story, we rely on the person's permission unless another lawful basis clearly applies.
You may ask us to remove a photograph or story at any time, and you do not need to give a reason. We will remove it from our website and from channels we control. We cannot recall printed material, or copies already shared by others.
We do not sell images, and we do not license them to third parties for commercial use.
9. Sharing, service providers and international transfers
We do not sell personal data. We share it only where needed, with:
- authorised PTPI team members, chapters or programme partners;
- suppliers that support hosting, email, forms, membership, events, payments, storage, security and communications;
- professional advisers;
- public authorities where legally required; or
- another party at your direction or with your permission.
Suppliers act on our written instructions and may not use your information for their own purposes. We are completing written data processing agreements with each of our suppliers and contractors, including the independent contractors who administer our systems. See section 17.
Who we actually use: People are more willing to trust an organisation that names its suppliers. Where a supplier is an individual contractor rather than a company, we describe the role rather than publishing that person's name and contact details, because they are entitled to the same privacy as anyone else. The internal record names them.
| What it is used for | Provider | Where processed |
|---|---|---|
| Website hosting and content platform | WordPress with an external hosting provider | Being confirmed |
| Website hosting backups | Hosting provider | Switzerland, under an adequacy decision |
| Server and Microsoft 365 administration | External IT contractor | Belgium |
| Website production, maintenance and backup copies | External web production contractor | Romania |
| Email, documents and file storage | Microsoft 365 | European Union |
| Inbound mail filtering | Microsoft 365 | European Union |
| Membership portal and newsletter delivery | Raklet | Being confirmed |
| Donations and payments | PayPal; ING (banking) | European Union and United States |
| Accounting and Belgian statutory filing | Accountable | Belgium |
| AI-assisted drafting, research and translation | Commercial AI tools on our internal register | Being confirmed |
| Web fonts | Google Fonts | United States, being removed |
Where an entry says "being confirmed", we are completing that check during 2026 and will update this table. We would rather show you the gap than leave the row out.
We keep a current list of our service providers and will tell you which ones are relevant to your information if you ask.
International transfers: Most of our processing takes place inside the European Economic Area. Two exceptions are worth naming plainly.
Backup copies of the website are held in Switzerland by our hosting provider and kept for seven days. Switzerland is outside the European Economic Area, but the European Commission recognised it as providing an adequate level of data protection on 26 July 2000 and confirmed that finding on 15 January 2024. Transfers to Switzerland therefore need no additional safeguards.
Some payment and communications providers process data in the United States. Where that happens we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on European Commission standard contractual clauses with any additional safeguards needed.
You may ask us which mechanism applies to your information, and for a copy of the relevant clauses with commercially confidential parts removed.
10. How long we keep information
We keep personal data only for as long as needed for the purpose described, then delete or anonymise it, unless the law requires longer retention. We consider the nature of the data, the person's relationship with PTPI, safety needs, legal limitation periods and accounting or reporting duties. In general:
- Unsuccessful or routine enquiries: normally up to 24 months after the last meaningful contact.
- Newsletter data: until you unsubscribe, or until the address remains inactive after our periodic review.
- Membership, programme, event, volunteer and partnership records: for the activity and a proportionate follow-up period, with core governance or safeguarding records retained longer where necessary.
- Financial records: for the period required by Belgian law.
- Web server access logs: 10 days.
- Website backups: 7 days at the hosting provider. Backup copies held by our web production contractor are kept for a period we are confirming.
- Records of cookie choices: for the period described in section 6.
Where we no longer need to identify anyone, we may keep anonymised or aggregated statistics indefinitely. These cannot be linked back to you.
11. Your choices and rights
Subject to the law, you may ask us to:
- give you access to your personal data and a copy of it;
- correct inaccurate or incomplete data;
- delete data, or restrict how we use it;
- provide portable data where that right applies;
- stop direct marketing, or object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier lawful use; and
- give you a human review of any decision where AI has been used, and not to be subject to a decision made by automated means alone.
Email office@ptpi.network. There is no charge. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, and we will explain why in writing.
We may need to verify your identity, and we will not ask for more information than is needed to do so. We normally respond within one month, as the GDPR requires. If a request is complex or you have made several, we may extend by up to two further months. We will tell you within the first month and explain why.
If you are not satisfied: Please contact us first, so that we have the chance to put matters right. You also have the right to complain to the Belgian Data Protection Authority, or to the supervisory authority where you live or work.
Belgian Data Protection Authority (Autorite de protection des donnees / Gegevensbeschermingsautoriteit), Rue de la Presse 35, 1000 Brussels, Belgium. Website: dataprotectionauthority.be
12. Security, and what we do if something goes wrong
We use proportionate technical and organisational measures to protect personal data and limit access to people who need it. In practice this includes:
- access restricted by role, with a named internal list of the people who hold administrative credentials, reviewed when roles change;
- multi-factor authentication on our Microsoft 365 administrator accounts and on the website hosting control panel;
- encryption at rest for our Microsoft 365 storage and its backups;
- keeping the website platform and its components updated; and
- choosing providers who commit to appropriate security.
No online service can promise absolute security, and we will not pretend otherwise.
If a personal data breach is likely to result in a risk to people's rights and freedoms, we notify the Belgian Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we will also tell you directly, without undue delay and in plain language. We keep an internal record of incidents, including those we are not required to report.
Reporting a security problem: If you believe you have found a security weakness in this website, please email office@ptpi.network with enough detail for us to reproduce it. We will acknowledge your report, we will not pursue action against anyone who reports in good faith and who does not access, alter or publish other people's data, and we will tell you when the issue is resolved.
13. How we use artificial intelligence
PTPI uses AI-assisted tools for tasks such as drafting, research, translation, summarising, administration, accessibility and image work. We use these tools; we do not build them. Under the EU Artificial Intelligence Act we act as a deployer, not a provider.
Some of our administrative and accounting software includes automated classification and summarising features. These tools save us time. They do not make decisions. A person validates every statutory filing and every financial statement we issue to our members before it is used, and no automated output is treated as the accounting record.
These are our standards:
- Human responsibility: A named person remains accountable for PTPI's work. Every article, newsletter and public statement is reviewed and approved by a person before publication, and that person takes editorial responsibility for the published version.
- We do not use your data to train AI models: We do not supply member, donor, participant or correspondence data to AI providers for the training or improvement of their models. Where we use commercial AI tools, we choose terms or settings that exclude our content from model training, and we are confirming this in writing for every tool on our register during 2026.
- Data minimisation: We minimise the personal data entered into AI tools. We do not knowingly enter confidential information, special category data or children's data unless the use is authorised, necessary and appropriately protected. Personal and financial data are processed only in approved tools, never in public or consumer ones.
- No solely automated decisions: We do not use AI alone to make decisions with legal or similarly significant effects on a person, including decisions about membership, safeguarding, employment, volunteering, complaints, grants or access to opportunities.
- What we do not do at all: We do not use AI for emotion recognition, biometric categorisation, facial recognition, social scoring, or the profiling of members, donors or young people.
- Transparency: We tell you when you are interacting directly with an AI system rather than a person. We label AI-generated or materially altered images, audio or video where the law requires it, or where a reasonable reader could otherwise be misled.
- Accuracy and dignity: We verify significant claims against primary sources, correct material errors promptly and visibly, and do not use AI to impersonate a real person, to discriminate, to exploit or to deceive.
- Competence: People who use AI tools on PTPI's behalf, including staff and volunteers, receive proportionate guidance so that they understand what these tools can and cannot do.
- We keep a record: We maintain an internal register of the AI tools in use, what they are used for, who approved them, and whether the provider excludes our content from model training.
If you are concerned about the role of AI in a PTPI communication or decision, contact office@ptpi.network and ask for human review. A person will look at it.
14. Children and young people
Our work involves young people through chapters, school links, youth exchange and mobility programmes. We use age-appropriate information, collect only what an activity needs, obtain consent or authorisation where required, and apply safeguarding controls.
In Belgium the age of digital consent is 13, under Article 7 of the Data Protection Act of 30 July 2018. Where we rely on consent for an online service offered directly to a child under 13, we seek the authorisation of a person with parental responsibility and make reasonable efforts to verify it.
We do not direct marketing at children and we do not profile them.
A programme involving children will have its own privacy information, consent forms and safeguarding arrangements. Where a chapter or a school runs the activity, they will normally hold the consents, and we will tell you who to contact.
Images of children are covered by section 8.
15. Accessibility
We want everyone to be able to read and use this website. We aim to follow recognised accessibility good practice, including meaningful alternative text on images, sufficient colour contrast, clear headings, keyboard navigation and plain language.
We do not currently claim a formal conformance level.
If any part of this site is difficult for you to use, or you need information in another format, email office@ptpi.network and tell us what would help. We will reply and provide an alternative wherever we reasonably can.
16. Changes to this notice
We may update this document when our services, technology or legal duties change. We publish the current version and its effective date here, and we keep earlier versions. You may ask us for a previous version.
Where a change materially affects people's rights or expectations, we will give additional notice, on the website and through Connections.
17. What we are still improving
We would rather tell you what is unfinished than let you assume otherwise. This notice describes a real organisation with limited resources, and the honest position is that some of what we intend is still being put in place. These are the improvements we are working on, with the aim of completing them during 2026.
- Removing the remaining third-party requests from our pages, including web fonts, so that nothing about your visit reaches another organisation before you have chosen.
- Completing a review of our consent banner and publishing the current list of cookies with their purposes and lifetimes.
- Confirming that secure connections are enforced on every page of this site.
- Completing written data processing agreements with each of our suppliers and contractors.
- Confirming in writing, for each AI tool on our register, that our content is excluded from model training.
- Naming a safeguarding contact and creating a dedicated address for concerns about a child.
- Completing the confirmations marked in the supplier table in section 9.
- Deciding whether to commit to a formal accessibility conformance level, and by when.
If any of these matters to you, ask us how it is going and we will tell you. Email office@ptpi.network.