Yesod Europe Notice and Policy for the Collection and Use of Personal Data
Yesod Europe (“Yesod Europe”) is a program of the American Jewish Joint Distribution Committee Europe, Asia and Africa Foundation located at H-1053 Budapest, Ferenciek tere 7-8. II. lph. Email: info@jdc.org (“AJJDC EAA”). AJJDC EAA is the data controller. This Privacy Policy explains what personal data we collect about you, why we collect it, how we use it, and what rights you have in relation to it. It is important that this information is handled lawfully and appropriately in line with pertinent law, including, where applicable, the requirements of the EU General Data Protection Regulation (“GDPR”). We take data protection duties seriously because we respect the trust that is being placed in us to use personal information appropriately and responsibly. This Privacy Policy does not cover the practices of our licensees or business partners (such as vendors, sponsors, or advertisers).
The Policy is effective as of August 6, 2026.
What is Personal Data?
Personal data means data (whether stored electronically or paper based) relating to a living individual who can be identified directly or indirectly from that data (or from that data and other information in our possession).
Processing is any activity that involves use of personal data. It includes obtaining, recording or holding the data, organizing, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring personal data to third parties.
Under the GDPR, certain categories of personal data are subject to heightened protection and are referred to as “special category data.” These include: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a person, data concerning health, and data concerning a person’s sex life or sexual orientation. Data relating to criminal convictions and offences is subject to similar additional protections. Special category data may only be processed where a specific condition under Article 9 GDPR is met, in addition to a lawful basis under Article 6.
Data Protection Principles
In processing personal data, we will take all reasonable measures to ensure that data is:
- Processed fairly, lawfully and in a transparent manner.
- Collected for specified, explicit and legitimate purposes and any further processing is completed for a compatible purpose.
- Adequate, relevant and limited to what is necessary for the intended purposes.
- Accurate, and where necessary, kept up to date.
- Kept in a form which permits identification for no longer than necessary for the intended purposes.
- Processed in line with the individual’s rights and in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
- Not transferred to people or organizations situated in countries without adequate protection, except where appropriate safeguards or a lawful transfer mechanism under Chapter V of the GDPR is in place.
Collection and Processing for Limited Purposes
We collect information directly from you through, for example, program registration forms and meetings, or indirectly from a select group of JDC entities and affiliates, or from local community partners/grantees. Information is collected and maintained from participants in our programs, application and registration forms, survey respondents, and others. To the extent that information requested is not required for your participation in a given program/opportunity, you will be told which information is optional.
We process the following of your personal data collected from you during your application, registration and participation in our programs and in the course of your interactions with us:
Basic personal information: your name, organisation, job title, age group, mobile phone number, email.
We may also process the following of your personal data, including and not limited to:
- Basic personal information: including your nationality, address, date of birth, passport number and country of issuance, e-mail, and phone number.
- Demographic information: including gender, education, profession, and occupation.
- Data concerning health: including information regarding your dietary restrictions, allergies, and any current medical conditions.
- Religious affiliation data: including your participation in movements, events, and organisations relative to the Jewish culture.
- Photographs, video recordings and audio recordings: including of your voice, image, simulated likeness, and other personal characteristics
Use, Sharing and Retention of Personal Data
We use Personal Data as described at the time of collection, including for the purpose of receiving information about general Yesod Europe initiatives and specific initiatives that we think will be of interest to you; and for Yesod Europe to evaluate the reach and impact of its initiatives. We may also use your personal data to tailor your experience at our sites, to compile and display content and information that we think you might be interested in, and to provide you with content according to such preferences.
Legal Bases for Data Processing
The GDPR is not intended to prevent the processing of personal data, but to ensure that it is done fairly and without adversely impacting the rights of the individual. In accordance with the GDPR, we will only process personal data where it is required for a lawful purpose.
The legal grounds for which we may process data in relation to you are outlined below:
Contract (1): we rely on this legal basis if our data processing is necessary for performance of a contract with you or to take steps at your request to enter into a contract. This covers carrying out our contractual duties and exercising our contractual rights, including the registration and participation in programs and activities or complying with grant requirements if you apply for a grant. If you do not provide the necessary information, your participation in the relevant programs might be delayed or declined.
Legal obligation (2): we process data if necessary to comply with our legal and regulatory obligations, such as, for example, to comply with tax reporting and accounting data retention obligations.
Legitimate Interests (3): we rely on legitimate interests if processing is necessary for our or a third party’s legitimate purposes. We, or a third party, have legitimate interests in carrying on, managing and administering our respective operations effectively and properly, and, in connection with those interests, processing your data. Your data will not be processed on this basis if our or a third party’s interests are overridden by your own interests, rights and freedoms.
Consent (4): We may process data if and to the extent you have given specific consent to the processing of your data. We may ask for your consent to send newsletters and similar communications to you; or we may ask for your consent so that we may use and publish your photo, image, video and audio recordings for specific promotional and fundraising purposes, as further described in the relevant consent form at the time your consent is sought. The provision of personal data is voluntary. If we have relied on consent as grounds for processing, you may withdraw your consent at any time – though, if you do so, that will not impact the lawfulness of our actions prior to your withdrawal of consent.
We will only process special category data about you if one or more of the grounds for processing special category personal data applies. Our activities serve ideological purposes; therefore, we may process information about your religious affiliation, such as your participation in movements, events, or organisations relative to the Jewish culture, to the extent data processing relates to persons who have regular contact with us. The additional legal grounds we are most likely to rely on for processing special category personal data in relation to you are outlined below:
Consent: You have given specific consent to the processing of your religious affiliation data and personal data concerning health. If we have relied on consent as grounds for processing, you may withdraw consent at any time – though, if you do so, that will not impact the lawfulness of our actions prior to your withdrawal of consent.
Legal claims: Processing is necessary for the purpose of establishing, making or defending legal claims. Those could be legal claims made by you, us or others, including claims relating to grants.
Recipients of Personal Data
We may transfer your personal data to the below third parties for the following reasons:
Within the JDC Group: personal data may be transferred within a select group of JDC entities and affiliates. The list of such entities and affiliates can be found at www.jdc.org/about/privacy-policy/jdc-entities/. In each case, the transfer is for purposes of carrying on, managing and administering our respective operations effectively and properly; to administer programs, communicate with donors, monitor and ensure compliance with applicable internal procedures (e.g., corporate financial responsibilities), and to respond to and comply with any grant requirements and legal demands.
Donors and/or partnering agencies: The Rothschild Foundation Hanadiv Europe and other JDC partners and funders, where necessary for the administration of joint programmes and grant compliance*. These entities are independent data controllers and their respective privacy notices apply to any personal data shared with them.
*The Rothschild Foundation Hanadiv Europe’s Privacy Policy is available at https://rothschildfoundation.eu/privacy-policy/.
Service providers and processors: Personal data may be shared with vendors or third parties who deliver goods and services on our behalf. These include, for example, hotels, travel agencies, training providers and partners (product-fulfillment companies, third-party event hosts, banks or credit card companies processing payment, and independent external advisors (e.g., auditors, lawyers). Our online service providers include Jotform (online application and registration forms), Zoom (online seminars and event recordings), ServiceNow (internal case management), Canva (graphic design of bios, promotional materials), Whatsapp (communications channel for seminar groups), Mailchimp (mailing), Open CRM (internal database software), QuestionPro (processing surveys), Microsoft 365 (internal working environment,). All such service providers are engaged under written data processing agreements as required by Article 28 GDPR. If you are an event attendee, speaker, or sponsor, certain of your information will be included in the event programme and may also be shared with third-party event sponsors and exhibitors. We may also share personal data with third parties in the following circumstances: (i) to investigate potentially fraudulent activities; (ii) in connection with an actual or potential reorganisation of operations or transfer of employees; and (iii) when we believe it is necessary to cooperate with law enforcement or in response to a lawful government request.
Duration of Data Processing
We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law.
- Programme participant data (application forms, registration, attendance): 7 years from end of programme
- Grant applicant and recipient data: 7 years from close of grant, in line with applicable audit/reporting obligations
- Newsletter and mailing list subscribers: Until unsubscribe, or 3 years from last interaction, whichever comes first
- Photographs, video and audio recordings: until consent is withdrawn
- Financial and accounting records: 10 years as required by Hungarian law
Personal data will be securely deleted or anonymised when the applicable retention period expires.
Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are designed to provide a level of security appropriate to the risks involved. Whilst we take all reasonable steps to protect your information, no method of data transmission or storage is 100% secure. We encourage you to use caution when sharing information online.
International Visitors
Our registered office is located in Hungary. Yesod Europe is administered by staff primarily based in Israel. Israel has been recognised by the European Commission as providing an adequate level of data protection for the purposes of GDPR transfers (Commission Implementing Decision (EU) 2011/61/EU, as confirmed under the GDPR framework). Accordingly, transfers of personal data to our staff in Israel are lawful without the need for additional transfer safeguards. If you are a resident of an EU or EEA member state, the GDPR applies to our processing of your personal data as described in this Policy.
International Transfer of Data
We may transfer any personal data we hold to a country outside the European Economic Area (“EEA”) or to an international organisation, provided that one of the following conditions applies:
- The European Commission has recognised the country as providing an adequate level of protection (an “adequacy decision”).
- Appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or Binding Corporate Rules.
- The transfer is necessary for the performance of a contract between us and the data subject, or to protect the vital interests of the data subject.
- The transfer is legally required on important public interest grounds or for the establishment, exercise or defence of legal claims.
- The transfer is authorised by the relevant data protection authority where we have adduced adequate safeguards with respect to the protection of the data subjects’ privacy, their fundamental rights and freedoms, and the exercise of their rights.
Subject to the requirements above, personal data we hold may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Those staff may be engaged in, among other things, the fulfilment of contracts with the data subject, the processing of payment details and the provision of support services.
Links to Third-Party Sites
We may provide links to third-party websites. These links are provided as a service to you. These websites are operated by independent entities that have their own privacy policies. Our Privacy Policy does not apply to such other websites or to the use that those entities make of your information. We have no control over the content displayed on such websites, nor over the measures, if any, that are taken by such websites to protect the privacy of your information.
Your Rights
- As a data subject under the GDPR, you have the following rights in relation to the personal data we hold about you. To exercise any of these rights, please contact us using the details in the “How to Contact Us” section below. We will respond to your request within one month. In complex cases, we may extend this by a further two months, in which case we will notify you of the extension and the reasons for it.
- Right to be informed
You have the right to be informed about the purposes of processing your personal data, the retention period for that personal data and with whom your personal data will be shared. This Privacy Policy is designed to provide that information. - Right of access
You have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to that personal data. This includes, among other things, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. You may obtain one copy of the personal data undergoing processing. For additional copies, we may charge a reasonable fee based on administrative costs. - Right to rectification
You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may also have the right to have incomplete personal data completed. - Right to erasure (right to be forgotten)
Under certain circumstances, you have the right to obtain from us the erasure of personal data concerning you. - Right to restriction of processing
Under certain circumstances, you have the right to obtain from us restriction of processing your personal data. In this case, the relevant data will be marked and may only be processed by us for certain limited purposes. - Right to data portability
Under certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit that data to another entity without hindrance from us. - Right to object and rights relating to automated decision-making
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including profiling, where processing is based on legitimate interests. If you object, we will stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. Exercising this right will not incur any costs.Where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Where your personal data is processed for direct marketing purposes, you have the right to object at any time; in that case your personal data will no longer be processed for marketing purposes. - Right to Complaint and Legal Remedies
If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with a supervisory authority. You may do so in the EU member state where you are habitually resident, where you work, or where the alleged infringement occurred. You may also seek judicial remedy if your data protection rights have been infringed.
Modifications to this Policy
From time to time, we may need to update or modify this Privacy Policy, including to address new issues or to reflect changes in our operations or applicable law. To the extent required by law, we will notify you of material changes, including by sharing the most recent version of the Privacy Policy and a summary of changes via e-mail.
How to Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:
American Jewish Joint Distribution Committee Europe, Asia and Africa Foundation
H-1053 Budapest, Ferenciek tere 7-8. II. lph. I/5.
E-mail: jdc-dpo@jdc.org
How to File a Complaint
If you have any complaints about this Policy or our data processing, you may contact the data protection supervisory authority in your country of residence or employment. The supervisory authority for AJJDC EAA is:
Hungarian National Authority for Data Protection and Freedom of Information
Falk Miksa utca 9-11, H-1055 Budapest
Tel: +36 1 3911 400 | Email: privacy@naih.hu | Website: www.naih.hu
You may also lodge a complaint with the supervisory authority in any EU member state where you are resident, work, or where the alleged infringement took place. A list of EU data protection supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en