Source: https://pra.com/privacy-policy/
Timestamp: 2019-04-23 10:28:51+00:00

Document:
PRA is committed to respecting and protecting your privacy.
We may collect personal information data that is associated to or identifies with you when you access PRA’s websites, blogs, mobile sites, social networks, applications, surveys, and when you register to attend an event or program created, managed or hosted by PRA. We may also collect personal information data when we market our services or provide event/program services to you, your employer or any other person who has authorized us to communicate with them regarding the fulfillment of our contracted services to them.
PRA is committed to protecting your privacy.
On May 25, 2018, the European Union (“EU”)’s new data protection legislation, the General Data Protection Regulation (GDPR), took effect. This statement is made in light of the requirements of the GDPR to alert users to PRA’s data processing practices which will govern the “processing” of your “personal data” (see definitions section 2(c) & 2(a)).
GDPR not only applies to organizations located within the EU but also to organizations located outside of the EU if they offer goods or services to, or monitor the behavior of, EU “data subjects” (see definitions section 2(b)). It applies to all companies processing and holding the personal data of data subjects residing in the European Union, regardless of the company’s location. Whilst we understand this means it does not include non-EU citizens, we believe at PRA it is important to protect individual’s personal data regardless of their nationality and therefore we look to apply the same standards across all individual’s personal data regardless of their nationality.
As the controller (see definitions section 2(f)), PRA has implemented numerous technical and organizational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, every data subject is free to transfer personal data to us via alternative means, e.g., by telephone.
This data protection declaration of PRA is based on the terms used by the European legislator for the adoption of the GDPR. Our data protection declaration should be legible and understandable for the general public, as well as our clients and business partners. To ensure this, we would like to first explain the terminology used.
Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Legitimate Interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party or party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
PRA acts as a data controller (Art. 24) for (i) the personal data relating directly to its clients and (ii) for its own employee management purposes.
PRA will from time to time act as a data processor (Art. 28) and may supply personal data to third party service providers, contractors and agents that provide services to us, to support the completion of projects and events (in which case our client is the controller).
Art. 6.1(a) serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. Art. 6(b) serves as the legal basis if the processing of personal data is necessary for the performance of a contract to which the data subject is a party, for example, when processing operations are necessary for the supply of goods or to provide any other service. Art. 6.1(b) further applies to processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Art. 6.1(c) serves as the legal basis if PRA is subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations. Art. 6.1(d) serves as the legal basis when the processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, for example, if a data subject were injured and his name, age, health insurance data or other vital information need to be provided to a doctor, hospital or other third party. Finally, Art 6.1(f) serves as the legal basis for processing operations which are not covered by any of the above-mentioned legal grounds, nonetheless, processing is necessary for the purposes of the legitimate interests pursued by PRA or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are permissible because they have been specifically mentioned by the European legislator, which considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GDPR).
We believe that we have a “Legitimate Interest” in the processing of your personal data, which is to carry out our business, including to grow and improve our services and support our clients, provided those interests are not outweighed by your rights and interests. We have conducted a Legitimate Interest Assessment (LIA) to arrive at this decision, if you wish to receive a copy of this LIA, please contact privacy@pra.com to request a PDF of the LIA.
8) What information do we collect and why?
We will obtain personal information from you when you inquire about our activities, register with us, attend one of our events or otherwise provide us with personal information.
The types of information collected might include name, e-mail address, postal address, telephone number, mobile phone number, credit/debit card details and dietary or access requirements.
9) What do we do with the information?
We are legally required to do so, e.g., by a law enforcement agency legitimately exercising a power or if compelled by an order of the Court.
Our contractual obligations with our clients require us to do so to fulfill our program operations. We are working with carefully-selected partners that are carrying out work on our behalf. These partners may include event organizers, supplier partners and venues, marketing agencies, accountants and IT specialists. The kind of work we may ask them to do include sending emails, event registration and organization, processing card payments, etc.
We only choose partners we can trust and we only share data with such recipients where appropriate standards and safeguards are in place. Whenever we share or transfer your personal information, we comply with the standards set by the GDPR and this privacy statement at a minimum.
We take appropriate measures to ensure that the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used. We have security measures in place to attempt to protect against the loss, misuse and alteration of personal data under our control. For example, only authorized personnel can access user information. While we cannot ensure or guarantee that loss, misuse or alteration of data will not occur while it is under our control, we use our best efforts to try to prevent this.
Where we hold subject data to facilitate the successful completion of business activities PRA will hold this information for a maximum period of 10 years from the last interactive or successful contact with you unless you request removal of this information under your right to erasure (Art.17).
From time to time we may be required to process children’s personal data (Art. 8), as part of completing an event or project, we understand the sensitively around the processing of children’s data and we take very seriously the responsibility for identifying the risks and consequences of the processing. For purposes of this policy, persons under the age of 16 are considered children.
We believe we have a legitimate interest in processing children’s data and we balance our own (or a third party’s) legitimate interest in processing the personal data against the interests and fundamental rights and freedoms of the child. We take appropriate measures, where necessary, to safeguard against those risks when processing a child’s personal data.
If you do not agree to the processing of data about you by Google LLC in the manner and for the purposes set out above, you can select ‘disable cookies’ on your browser.
On this website, the controller has integrated the component of Google Analytics. Google Analytics is a web analytics service. Web analytics is the collection of, gathering, and analysis of data about the behavior of visitors to websites. A web analysis service collects, among others, data about the website from which a person has come (the so-called referrer), which sub-pages were visited, or how often and for what duration a sub-page was viewed. Web analytics are mainly used for the optimization of a website and to carry out a cost-benefit analysis of Internet advertising.
The purpose of the Google Analytics component is to analyze the traffic on our website. Google uses the collected data and information, among others, to evaluate the use of our website and to provide online reports, which show the activities on our websites, and to provide other services concerning the use of our Internet site for us.
Google Analytics places a cookie on the information technology system of the data subject. The definition of cookies is explained above. With the setting of the cookie, Google is enabled to analyze the use of our website. With each call-up to one of the individual pages of this Internet site, which is operated by the controller and into which a Google Analytics component was integrated, the Internet browser on the information technology system of the data subject will automatically submit data through the Google Analytics component for online advertising and the settlement of commissions to Google. During this technical procedure, the enterprise Google gains knowledge of personal information, such as the IP address of the data subject, which serves Google, among others, to understand the origin of visitors and clicks, and subsequently create commission settlements.
On this website, the controller has integrated Google AdWords. Google AdWords is a service for Internet advertising that allows the advertiser to place ads in Google search engine results and the Google advertising network. Google AdWords allows an advertiser to pre-define specific keywords with the help of an advertisement on Google’s search results then displayed; when the user utilizes the search engine to retrieve a keyword-relevant search result. In the Google Advertising Network, the ads are distributed on relevant web pages using an automatic algorithm, considering the previously defined keywords.
If a data subject reaches our website via a Google advertisement, a conversion cookie is filed on the information technology system of the data subject through Google. The definition of cookies is explained above. A conversion cookie loses its validity after 30 days and is not used to identify the data subject. If the cookie has not expired, the conversion cookie is used to check whether certain sub-pages, e.g., The request for a proposal from our website, was called up on our website. Through the conversion cookie, both Google and the controller can understand whether a person who reached an AdWords advertisement on our website generated an inquiry that was, executed or canceled.
The data and information collected using the conversion cookie is used by Google to create visit statistics for our website. These visit statistics are used to determine the total number of users who have been served through Google AdWords advertisements to ascertain the success or failure of each Google AdWords and to optimize our Google AdWords advertisements in the future. Neither our company nor other Google AdWords advertisers receive information from Google that could identify the data subject.
A social network is a place for social meetings on the Internet, an online community, which usually allows users to communicate with each other and interact in a virtual space. A social network may serve as a platform for the exchange of opinions and experiences; or enable the Internet community to provide personal or business-related information. Facebook allows social network users to include the creation of private profiles, upload photos, and network through friend requests.
The controller has integrated components of the LinkedIn on this website. LinkedIn is a web-based social network that enables users with existing business contacts to connect and to make new business contacts. Over 400 million registered people in more than 200 countries use LinkedIn. Thus, LinkedIn is currently the largest platform for business contacts and one of the most visited websites in the world.
On this website, the controller has integrated components of Twitter. Twitter is a multilingual, publicly-accessible microblogging service on which users may publish and spread so-called ‘tweets,’ e.g., short messages, which are limited to 140 characters. These short messages are available for everyone, including those who are not logged on to Twitter. The tweets are also displayed to so-called followers of the respective user. Followers are other Twitter users who follow a user’s tweets. Furthermore, Twitter allows you to address a wide audience via hashtags, links or retweets.
https://about.twitter.com/de/resources/buttons. During this technical procedure, Twitter gains knowledge of what specific sub-page of our website was visited by the data subject. The purpose of the integration of the Twitter component is a retransmission of the contents of this website to allow our users to introduce this web page to the digital world and increase our visitor numbers.
On our website we offer you the opportunity to post comments about individual blog articles. The operating company of Disqus is Disqus, Inc., 301 Howard Street, Suite 300, San Francisco, CA 94105, United States.
Disqus is an interactive comment service that allows users to post comments on all websites that use the Disqus service with a single sign-on to the provider. Users can also sign-up and sign-in with existing accounts with Facebook (via Facebook Connect), Twitter, Yahoo, and OpenID. Posting comments is also possible without registration and sign-in (as “Guest”). More information about Disqus and its service can be found at www.disqus.com.
If you sign-in to Disqus using your Facebook, Twitter, Yahoo or OpenID account, these providers may also collect, process, and store data. Please refer to the privacy policies of the respective provider for further information. We reserve the rights to delete inappropriate comments or spam.
If you subscribe to our mailing list, you will be automatically subscribed to receive email updates.
You can change your email marketing preferences at any time, by clicking ‘unsubscribe’ on any of our emails or by contacting: privacy@pra.com.
If you want to exercise these rights or update your personal details, please contact privacy@pra.com.
To exercise any of these rights, please email privacy@pra.com to get in touch.
If you apply to work at PRA, we will only use the information you give us to process your application and to monitor recruitment statistics. If we need to disclose information to someone outside PRA – for example, if we need a reference, or need to get a ‘disclosure’ from the Criminal Records Bureau – we will make sure we tell you beforehand, unless we are required to disclose this information by law.
If you are unsuccessful in your job application, we will hold your personal information for 12 months after we finish recruiting the post you applied for. After this date we will destroy or delete your information.
If you begin employment with us, we create a file about your employment. We keep the information in this file secure and will only use it for matters that apply directly to your employment.
Once you stop working for us, we will keep this file according to our record retention guidelines. You can contact us, privacy@pra.com, to find out more about this.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art 6