Effective May 25, 2018, the General Data Protection Regulation (GDPR) is a significant change to European Union (EU) privacy law. The regulation gives EU citizens and residents more control over how their personal data is used by organizations by providing the right of an individual to control their personal information. This law contains rules that are imposed on companies, government agencies, non-profit organizations, and other organizations outside of the EU that process personal data related to providing goods and/or services to anyone in the EU.

Church World Service (CWS) is committed to upholding and ensuring that all persons’ private information is generated and managed in a responsible and respectful manner. CWS is providing this GDPR Privacy notification to clarify information that may be collected by CWS and how this information can be managed by the individual. CWS is committed to compliance with the GDPR standards.

CWS collects personal information such as name, address, communication method (such as phone number), email, and other personal information as needed to adjudicate a person’s best fit for a role within CWS. Personal information is voluntarily entered by those seeking employment with CWS.

GDPR identifies six legal bases for data controllers such as CWS to maintain and process personal data. These are: contractual necessity, legal obligation, vital interest, public interest, legitimate interest, and consent. Personal data collected by CWS is stored in the United States within its recruitment system and is shared with third parties for the purpose of verifying employability.

CWS is committed to ensuring the privacy and security of personal information it stores and manages from cyber attacks and data breaches. CWS has implemented appropriate secuirty controls throughout business systems and computing environment. In the event of a data breach CWS will honor GDPR notification requirements.

CWS provides mechanisms for individuals to maintain control over the use and storage of their personal information as required per GDPR law by providing the following abilities to individuals: personal information consent revocation, personal information access request, personal information correction request, personal information download request, personal information restrict processing request, personal information deletion request, and personal information residency status change request.