Privacy Policy

How Genspect collects, uses, shares and protects personal information

1. Who we are and when this policy applies

Genspect is an international not-for-profit organisation providing education, advocacy, research, events and support programmes, including Beyond Trans. This policy explains how personal information is handled through genspect.org and services directly operated by Genspect.

The data controller is the legal entity that decides why and how personal information is used. The controller for a particular interaction will be the Genspect entity named on the relevant form, confirmation, contract or receipt. Genspect Alliance CTR is the controller for personal information collected through genspect.org, unless another Genspect entity is identified as the controller on the relevant form, confirmation, contract or receipt.

Independently governed national organisations, external therapists, event partners and linked websites may be separate controllers with their own privacy notices. This policy does not govern their independent processing.

2. The information we may collect

• Contact and identity information — name, email, telephone number, country or region, postal address, age confirmation and participant or membership ID.
• Communications — emails, enquiries, feedback, complaints, correspondence and information voluntarily provided in forms, calls or meetings.
• Support-service information — registration details, attendance, support needs, emergency contact where justified, facilitator notes held for administration or safety, and safeguarding concerns.
• Special-category information — information about health, disability, sex life, sexual orientation, beliefs or gender-related experience where you choose to provide it or it is necessary for an agreed service.
• Membership, event and training information — bookings, attendance, accessibility and dietary needs, course activity, certificates, preferences and membership status.
• Donation and payment information — amount, date, currency, transaction reference, tax or gift-aid information where applicable, and limited billing details. Payment providers ordinarily process full card or bank details; Genspect does not ordinarily receive or store full card numbers.
• Professional and applicant information — CVs, qualifications, registration, insurance, references, vetting information and employment or volunteer applications.
• Research information — survey, interview, consent and study-administration data described in the participant information for each project.
• Media and content information — photographs, recordings, biography, testimony or published contribution where separately agreed.
• Website and technical information — IP address, device and browser data, pages viewed, referral source, cookie identifiers, security logs and consent choices.

Please provide only the information needed. Do not send full medical records, intimate images, identity documents or another person’s sensitive information unless Genspect has specifically requested it through a secure and appropriate process.

• The right to access – You can request a copy of the personal data we hold about you. We may charge a small fee if the request is excessive or repetitive.

• The right to rectification – You can ask us to correct any information you believe is inaccurate or incomplete.

• The right to erasure – You can ask us to delete your personal data in certain circumstances (e.g. if it’s no longer needed or you withdraw consent).

• The right to object to processing – You can object to our processing of your personal data in specific situations, such as for direct marketing.

• The right to data portability – You can ask us to transfer your data to another organisation, or directly to you, in certain situations.

To exercise any of these rights, please contact us at: info@genspect.org. We may need to verify your identity before processing your request.

3. Where information comes from

Most information comes directly from you when you contact us, join a programme, register for an event, become a member, donate, apply for a role, take part in research or use the website. We may also receive information from a person acting with your authority, a referring organisation, an event or research partner, a payment provider, publicly available professional sources, or website and communications providers.

If you provide information about another person, you must have a lawful reason to do so and, where appropriate, tell them that you have shared it. This does not apply where doing so would place someone at risk or obstruct a lawful safeguarding report.

4. Why we use information and our lawful bases

Under EU and UK data-protection law, Genspect must have a lawful basis for each use. More than one basis may apply. The table below gives the usual basis.

5. Sensitive information

Because of Genspect’s work, people may disclose highly sensitive information. Genspect will not infer that a person has a medical condition, belief or sexual orientation merely because they visit the website, subscribe, donate or contact the organisation.

When special-category information is requested, the form or programme notice should explain why it is needed, whether providing it is optional, the Article 9 condition relied on, who will see it and how long it will be kept. Consent must be specific and capable of withdrawal; withdrawal does not make earlier lawful processing unlawful and may affect a service that cannot be provided without the information.

6. Children’s information

Genspect-operated clinical and support-group services are for adults aged 18 and over. The website is not intended to invite children to submit sensitive personal information. If Genspect learns that a child has submitted information, it will assess safety, legal duties and whether the information should be deleted, restricted or retained for safeguarding reasons.

Where children may appear at events, in research or in published material, Genspect will use an appropriate child-specific notice and obtain the necessary consent or authorisation. A child’s welfare and expressed wishes will be taken seriously.

7. Who we may share information with

Genspect does not sell personal information. It does not share personal information for another organisation’s independent marketing. Information may be shared, only as needed, with:

• Genspect personnel and directly operated programmes whose roles require access;
• website hosting, cloud storage, email, CRM or mailing-list, videoconferencing, registration and IT-security providers acting under contract;
• payment and fundraising providers, currently including Stripe, PayPal and GoFundMe where you choose those services;
• professional advisers, auditors, insurers, banks and accountants;
• event venues, training providers, research partners or funders where the relevant notice or agreement permits it;
• police, emergency services, child-protection or adult-safeguarding bodies, courts, regulators and professional bodies where necessary and lawful;
• a successor organisation in a lawful merger, reorganisation or transfer, subject to appropriate safeguards and notice; and
• any other recipient you specifically authorise.

Service providers must use information only for agreed purposes and protect it appropriately. Some organisations, such as payment providers, may also act as independent controllers; their own notices apply when you use their services.

8. International transfers

Genspect operates internationally and uses providers in more than one country. Personal information may therefore be accessed or stored outside Ireland, the European Economic Area or the United Kingdom. Where transfer law requires safeguards, Genspect will use an adequacy decision, approved contractual clauses, an applicable certification framework or another lawful mechanism, and will assess supplementary protections where required. You may ask for information about the safeguard used for a relevant transfer.

9. How long we keep information

Information is kept only as long as reasonably necessary for the stated purpose, legal and accounting duties, safeguarding, dispute resolution and the defence of claims. It is then securely deleted or anonymised.

10. Security

Genspect uses technical and organisational measures proportionate to the sensitivity and risk of the information. These may include access controls, multi-factor authentication, encryption in transit, secure backups, role-based permissions, confidentiality commitments, staff training, processor contracts, incident response and periodic access review.

No system is completely secure. If a personal-data breach is likely to create a risk to people, Genspect will assess notification to the Data Protection Commission or other relevant regulator within the applicable period and will notify affected people where the law requires it.

11. Email, newsletters and fundraising communications

Genspect may send administrative messages needed for a programme, event, membership or donation. It may separately send newsletters, campaign information, fundraising appeals and event notices where consent has been given or another lawful route is available. You may unsubscribe from non-essential messages at any time using the link in the message or by contacting info@genspect.org. Unsubscribing from marketing does not stop necessary service or transaction messages.

Genspect will not use health, support-group or safeguarding information to target fundraising or political communications.

12. Cookies and similar technologies

Cookies and similar tools may be used for essential website functions, security, preferences, audience measurement and embedded content. Non-essential cookies must not be set before valid consent where consent is required. Refusing non-essential cookies should not prevent access to the main website.

The cookie banner and a separate Cookie Notice should list each cookie or provider, purpose, duration and category, and allow consent to be withdrawn as easily as it was given. Links to social media, video, payment or fundraising sites may allow those providers to collect information under their own notices when you click or interact.

13. Your rights

Depending on the law that applies, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• correct inaccurate or incomplete information;
• request deletion in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent; and
• not be subject to a solely automated decision with legal or similarly significant effects, except where law permits it.

To exercise a right, email info@genspect.org. Genspect may request proportionate proof of identity and clarification of the request. It will normally respond within one month under GDPR, subject to any lawful extension. No fee is normally charged; a reasonable fee or refusal may apply only where a request is manifestly unfounded or excessive and the law permits it.

Rights are not absolute. For example, information may be retained where required by law, safeguarding obligations, freedom of expression, research safeguards or the establishment, exercise or defence of legal claims. Genspect will explain any refusal and the available complaint route.

14. Automated decisions and profiling

Genspect does not currently intend to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. If this changes, the relevant people will receive the information and protections required by law before the processing begins.

15. Links and third-party services

The website links to services that Genspect does not control, including social media, video, payment, fundraising and partner websites. Their privacy notices apply to their independent collection and use of information. A link does not make Genspect responsible for another organisation’s privacy practices.

16. Changes to this policy

Genspect will review this policy regularly. The current version and effective date will be posted on the website. Material changes will be brought to the attention of affected people where reasonably possible and required by law. A new purpose that is incompatible with the original purpose will not be introduced without an appropriate lawful basis and notice.

17. Contact and complaints

Questions, rights requests and privacy concerns may be sent to info@genspect.org or to the postal address stated at the beginning of this policy. Please use the subject line ‘Privacy’. Safeguarding concerns should use the separate ‘Report a safeguarding concern’ route.

If you are dissatisfied with Genspect’s response, you may complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. See https://www.dataprotection.ie/en/individuals/exercising-your-rights/raising-concern-commission. You may also have the right to complain to the data-protection authority where you live or work or where the alleged infringement occurred.