Privacy Policy

The Society for People Analytics

Effective Date: May 15 2026 | Last Updated: May 15 2026

The Society for People Analytics ("SPA," "we," "us," or "our") is a 501(c)(3) nonprofit organization dedicated to empowering excellence in the people analytics community. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit societyforpeopleanalytics.org (the "Site"), become a member, register for events, make donations, or otherwise interact with us.

Because our community is global, this policy is designed to meet the requirements of U.S. privacy laws (including the California Consumer Privacy Act, as amended by the CPRA), the European Union General Data Protection Regulation (GDPR), and the UK GDPR. By using the Site or our services, you agree to the practices described here.

1. Information We Collect

We collect information you provide directly to us, information collected automatically when you use the Site, and information from third-party service providers.

1.1 Information You Provide Directly

Membership information: name, email address, employer, job title, professional background, country of residence, and login credentials when you create a member account or sign up for membership.
Payment information: membership dues, donations, and event fees are processed by third-party payment processors (such as Stripe, PayPal, and Squarespace Commerce). We do not store full payment card numbers on our servers. We retain transaction confirmations, billing names, billing addresses, and the last four digits of payment methods for our records.
Donation information: as a 501(c)(3) organization, we collect donor name, contact details, donation amount, and any communications you send us. We may issue tax receipts where applicable.
Event registration information: registration details for conferences, meet-ups, webinars, and other events, including dietary restrictions or accessibility needs you choose to share.
Newsletter and marketing preferences: email address and the topics you elect to receive.
Communications: any messages you send through contact forms, email, or social media.
Volunteer and board information: if you serve on a committee, advisory board, or in a volunteer capacity, we may collect a biography, headshot, and conflict-of-interest disclosures.

1.2 Information Collected Automatically

When you visit the Site, we and our service providers may automatically collect:

IP address, approximate geographic location, browser type, operating system, device identifiers, and referring URL.
Pages viewed, links clicked, time spent on pages, and other usage data.
Cookies, pixels, and similar tracking technologies (see Section 6).

1.3 Information from Third Parties

Authentication providers (e.g., social login services) if you choose to sign in through them.
Event platforms, mentoring platforms (e.g., Mentorloop), and community platforms used for SPA programming.
Publicly available professional sources (e.g., LinkedIn) when reviewing volunteer or board candidates.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Site, our membership program, and our services.
Process membership dues, donations, and event registrations.
Issue tax receipts and other charitable acknowledgments.
Send transactional communications, including confirmations, renewal notices, and important program updates.
Send our newsletter, event invitations, and other marketing communications where permitted.
Operate community programs such as conferences, local meet-ups, mentoring, and research initiatives.
Respond to inquiries, requests, and feedback.
Monitor and analyze usage trends to improve our content and offerings.
Detect, prevent, and address fraud, abuse, and security incidents.
Comply with legal obligations and enforce our Terms of Service.

3. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

If you are in the European Economic Area, the United Kingdom, or a similar jurisdiction, we rely on the following legal bases under GDPR Article 6:

Contract: to provide membership, process payments, and deliver events you have registered for.
Legitimate interests: to operate, secure, and improve our programs and the Site, and to communicate with members about SPA activities.
Consent: for marketing emails (where required), non-essential cookies, and any sensitive information you choose to share.
Legal obligation: to comply with tax, accounting, anti-fraud, and other legal requirements.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How We Share Information

We do not sell your personal information. We share information only as described below:

Service providers: vendors who help us operate the Site and our programs, including Squarespace (website hosting and commerce), Stripe and PayPal (payments), email service providers, analytics providers, community platforms, mentoring platforms, and cloud storage providers. These providers are contractually required to protect your information and use it only for the purposes we authorize.
Event partners and co-hosts: where SPA co-hosts events with another organization, we may share registrant lists with that partner. We will identify the partner at the point of registration.
Volunteers and board members: authorized SPA volunteers, committee members, and board members may access information to deliver programs.
Legal and safety: we may disclose information when required by law, subpoena, or other legal process, or when we believe disclosure is necessary to protect the rights, safety, or property of SPA, our members, or others.
Business transfers: in the event of a merger, dissolution, or transfer of assets, information may be transferred to a successor organization consistent with this policy.
With your consent: for any other purpose with your permission.

5. International Data Transfers

SPA is based in the United States. If you access the Site or use our services from outside the United States, your information will be transferred to, stored, and processed in the United States and in other countries where our service providers operate. These countries may have data protection laws that differ from those of your country.

Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms to protect international transfers.

6. Cookies and Tracking Technologies

The Site uses cookies and similar technologies to operate the Site, remember your preferences, analyze usage, and support our programs. Categories include:

Strictly necessary cookies: required for the Site to function, including authentication and payment processing. These cannot be disabled.
Functional cookies: remember preferences and settings.
Analytics cookies: help us understand how visitors use the Site (e.g., Squarespace Analytics, Google Analytics where applicable).
Marketing cookies: where applicable, support email marketing measurement and outreach.

You can control cookies through your browser settings and, where available, our cookie banner. Disabling certain cookies may affect Site functionality.

The Site does not currently respond to "Do Not Track" browser signals, but we honor Global Privacy Control (GPC) signals where required by law as an opt-out of the sale or sharing of personal information (we do not sell personal information in any case).

7. Your Privacy Rights

7.1 Rights Available to All Users

You may:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Request deletion of your personal information.
Unsubscribe from marketing emails using the link in any message or by contacting us.
Close your member account at any time.

7.2 Additional Rights for EEA, UK, and Swiss Residents (GDPR / UK GDPR)

You also have the right to:

Object to processing based on legitimate interests.
Restrict processing in certain circumstances.
Receive your information in a portable format.
Withdraw consent where processing is based on consent.
Lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office or your national Data Protection Authority).

7.3 Additional Rights for California Residents (CCPA/CPRA)

California residents have the right to:

Know what personal information we collect, use, and disclose.
Request deletion of personal information.
Correct inaccurate personal information.
Opt out of the sale or sharing of personal information (we do not sell or share personal information as those terms are defined).
Limit the use of sensitive personal information (we do not use sensitive personal information for any purpose requiring such a right).
Be free from discrimination for exercising these rights.

You may designate an authorized agent to make a request on your behalf, subject to verification.

7.4 How to Exercise Your Rights

Submit requests by email to admin@societypeopleanalytics.org with the subject line "Privacy Request." We will respond within the timeframes required by applicable law (generally 30 days under GDPR and 45 days under CCPA/CPRA, with extensions where permitted). We may need to verify your identity before fulfilling your request.

8. Data Retention

We retain personal information only as long as needed to provide our services and fulfill the purposes described in this policy, including legal, accounting, and reporting requirements. Examples:

Membership records: for the duration of your membership plus seven years for tax and audit purposes.
Donation records: at least seven years to comply with IRS recordkeeping rules for 501(c)(3) organizations.
Event registration records: up to three years after the event.
Marketing preferences: until you unsubscribe, plus a reasonable suppression period.
Website analytics: typically up to 26 months.

When information is no longer needed, we delete or anonymize it.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, vendor due diligence, and least-privilege access for volunteers and staff. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and applicable authorities as required by law.

10. Children's Privacy

The Site and our services are intended for professionals and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

11. Third-Party Links and Services

The Site may contain links to third-party websites, including social media platforms, partner organizations, payment processors, and event platforms. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date above and, where appropriate, provide additional notice (such as an email to members or a notice on the Site). Your continued use of the Site after changes take effect constitutes your acceptance of the revised policy.