The Research Data Alliance (RDA), www.rd-alliance.org (the “Site”), is committed to protecting the personal information of all individuals who use our services. This Privacy Policy explains what personal data we collect, why we collect it, the legal basis for doing so, how we use it, and your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable UK data protection law.
“Personal data” means any information relating to an identified or identifiable living individual.

The Data Controller for this website and all its content is:

The Site is operated on behalf of the RDA Foundation by Marameo Design PTY LTD (Australian Business Number: 33 631 679 25). The RDA Foundation does not have a designated Data Protection Officer (DPO), as this is not currently required under Article 37 GDPR given the nature and scale of our processing. This assessment is reviewed periodically. Any data protection queries should be directed to the contact address above.

This Privacy Policy applies to personal data collected through the Site and through electronic communications sent to the RDA. It does not apply to third-party websites linked from the Site. The RDA does not endorse and is not responsible for the content or privacy practices of third-party websites.

You may browse the Site without providing personal data. However, certain functions — such as registering for events, subscribing to newsletters, or submitting a contact form — require you to provide personal data including:

To become a member of the RDA community and access RDA services, users must register an account. The personal data collected during registration is used to manage your membership, communicate with you, and provide access to RDA resources.

Our servers automatically collect certain technical information when you visit the Site, including:

Some of this information is collected via cookies and similar tracking technologies. Please see Section 11 for further details.

When you register for webinars or other RDA events, data such as your name, organisation, and email address may be collected via third-party event platforms. Those platforms process your data subject to their own privacy policies, which we will make available to you at the point of registration.

The Site is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently done so, please contact us at [email protected] and we will delete the data promptly.

The RDA website uses an AI-powered chat assistant (“RDA Concierge”) provided by Contexto, to help visitors navigate our content and services. This feature is available on a trial basis from 10 June 2026.

When you interact with the RDA Concierge, the content of your conversation — including any personal data you choose to share in your messages — may be processed by Contexto in order to generate responses. We recommend you do not submit sensitive personal data through the chat interface.

Data processed through the AI Concierge is hosted exclusively on Amazon Web Services (AWS) infrastructure located in Frankfurt, Germany (EU) and does not leave the European Economic Area for the duration of this service. No international transfer safeguards under Article 46 GDPR are therefore required.

The RDA Concierge is operated by Contexto as a third-party service provider. Data processed through this tool is subject to Contexto’s own privacy practices, which you can review at contexto.com.au/privacy. Appropriate data processing arrangements are in place between the RDA Foundation and Marameo (RDA web agency who have a direct processing agreement with Contexto).

This processing is carried out on the basis of our legitimate interests in improving the accessibility and usability of our website (Article 6(1)(f) GDPR).

We process your personal data only where we have a lawful basis to do so under Article 6 GDPR. The basis depends on the purpose:

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may request a copy of our Legitimate Interests Assessment by contacting us at [email protected]. Where we rely on consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

We may share certain personal data with RDA organisational and regional members for the purpose of building a shared knowledge base and supporting collaboration within the RDA community. This processing is based on our legitimate interests. You have the right to object to this processing — see Section 9.5.

We use a number of third-party services that may process your personal data on our behalf as data processors. These include analytics providers, email platforms, and event management tools. We ensure appropriate data processing agreements are in place with these providers.

We may disclose your data where required to do so by law or in response to valid requests from public authorities. We will notify you of such requests where legally permitted to do so.

In the event of a merger, acquisition, or restructuring of the RDA Foundation, personal data may be transferred as part of that process, subject to equivalent data protection obligations.

The RDA operates globally and uses third-party service providers (including Google Analytics) that may transfer data outside the European Economic Area (EEA) and the United Kingdom. Where such transfers occur, we ensure they are protected by one or more of the following safeguards:

You may request further information about the safeguards in place for international transfers by contacting [email protected].

We retain personal data only for as long as necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law. The following indicative retention periods apply:

Under the GDPR and applicable UK data protection law, you have the following rights in relation to your personal data. These are not absolute rights and may be subject to limitations.

You have the right to request a copy of the personal data we hold about you, along with information about how we use it. We will provide this free of charge within one calendar month of receipt of your request.

You have the right to request correction of inaccurate or incomplete personal data we hold about you.

You have the right to request deletion of your personal data in certain circumstances, for example where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent. To exercise this right, contact [email protected].

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of the data is being contested.

You have the right to object at any time to processing of your personal data where we rely on legitimate interests as the lawful basis. This includes processing for direct marketing purposes or sharing with RDA members. Where you object, we must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. To object to any processing, contact us at [email protected].

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal. To unsubscribe from newsletters, use the unsubscribe link in any newsletter email, or contact us directly at [email protected]

You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO): www.ico.org.uk / 0303 123 1113. In EU member states, you may also contact your national supervisory authority. To exercise any of the rights above, please contact [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.

We implement commercially reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access or alteration. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
Email communications are generally transmitted unencrypted. If you need to share sensitive information with us, please indicate this so we can arrange a more secure channel.

TWe use cookies and similar technologies to operate the Site, personalise your experience, and conduct statistical analysis. The following third-party services set cookies on your device when you visit the Site:

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Site.

We review and update this Privacy Policy periodically. Where changes are significant, we will post a prominent notice on the Site for a reasonable period and notify registered users by email where practicable. Continued use of the Site after the revised Policy takes effect constitutes acknowledgement of the changes. Where we rely on consent for any new processing, we will seek fresh consent before commencing that processing. If you object to any change, please contact us at [email protected].

For any questions, concerns, or requests relating to this Privacy Policy or our data protection practices, please contact: