Effective 20 September 2026.
1. Who is responsible for your data
Vistula Valley Club, a California nonprofit corporation (entity number B20260090548), with its California principal office at 1083 Chloe St, Concord, CA 94518, United States, is the controller of your personal data processed through the Vistula Valley website, membership application process and members service (“Vistula Valley”, “we”, “us” or the “Controller”).
Questions and data-protection requests can be sent to administrator@vistulavalley.org.
2. Who this policy applies to
This policy applies to individuals who interact with our online services or related membership channels, including:
- visitors to the public website and the member’s service;
- people who contact us by email or through online functionality;
- membership applicants and people identified by applicants as referrers; and
- current and former members.
3. Information we collect and where it comes from
We collect information you choose to provide when you apply, contact us, create or update a member profile, request an introduction, use membership functionality, join a Vistula Valley communication channel, or pay for membership. Depending on the interaction, this may include:
- identity and contact information, such as name, email address and telephone number;
- professional and profile information, such as LinkedIn URL, role, employer, industry, chapter, biography, experience, skills, what you seek or offer, other profile links, websites and photograph;
- application and referral information, including the identity or details of a referrer, decisions and related history;
- membership and account information, including login and authentication records, membership status, access rights;
- directory, communication and introduction information, including profile content, contact requests, messages and records of member-requested introductions;
- payment reconciliation information, such as transaction status and identifiers needed to match a payment to a member; and
- technical and security information, such as IP address, request metadata, device or browser information, session records, logs, security and audit events.
Payment card details are handled by the payment service providers and are not stored in the Vistula Valley members database.
Personal data is usually obtained directly from you. It may also come from a membership applicant who identifies you as a referrer, from a referrer contacted as part of an application, from payment providers confirming a transaction, from other members using directory or introduction functionality, and from systems that automatically record technical and security events.
4. Purposes, legal bases and retention
Where the EU General Data Protection Regulation (GDPR) or equivalent law applies, we process personal data for the purposes and on the legal basis described below.
| Individuals / activity | Purpose and principal data | Legal basis, where applicable | Retention |
|---|---|---|---|
| Website visitors | Operate, deliver and secure the public website and member’s service; maintain logs and prevent misuse. Data may include IP address, request metadata, browser or device data, session and security events. | Legitimate interest in operating a reliable and secure online service (Art. 6(1)(f) GDPR); where strictly necessary, steps taken to provide the requested functionality (Art. 6(1)(b) GDPR). | For the duration of the necessary cookie and for a limited log-retention period needed for security and troubleshooting. |
| People contacting us | Respond to enquiries, conduct correspondence and take requested steps. | Legitimate interests in responding and maintaining records of communications (Art. 6(1)(f) GDPR); pre-contractual steps where relevant (Art. 6(1)(b) GDPR). | For the duration of the correspondence and ordinarily up to 2 months after the matter is closed, unless a longer period is needed for claims or legal obligations. |
| Membership applicants | Receive and assess applications, verify referrals, communicate decisions, manage repeat applications within the stated waiting period and handle related claims. | Steps at the applicant’s request before membership (Art. 6(1)(b) GDPR); legitimate interests in selecting members, administering a trusted community and handling claims (Art. 6(1)(f) GDPR); consent only where expressly requested for an optional feature (Art. 6(1)(a) GDPR). | Accepted applications: retained as part of the relevant membership record. Rejected applications: 12 months from the rejection decision, subject to implementation and any longer period necessary for claims. |
| Referrers | Verify and assess a membership application and maintain an audit trail of the process. | Legitimate interests in operating a trusted referral-based community (Art. 6(1)(f) GDPR). | Ordinarily for the same period as the relevant application, unless retained as part of a member record or needed for claims. |
| Members and former members | Administer membership and accounts; provide directory access, communication and introductions; manage renewals, payments and access; maintain security; enforce community rules; meet legal obligations; establish or defend claims. | Performance of the membership arrangement (Art. 6(1)(b) GDPR); legal obligations, including accounting where applicable (Art. 6(1)(c) GDPR); legitimate interests in community administration, security and claims (Art. 6(1)(f) GDPR); consent for optional publication only where the relevant implementation genuinely offers a free choice (Art. 6(1)(a) GDPR). | During membership. Directory visibility and account data after membership are handled as described below. Payment and accounting records are retained for the applicable statutory period; claim-related records until relevant limitation periods expire. |
5. Membership applications
The current application form requires the applicant’s name, email address, LinkedIn profile, telephone number, referrer information and acceptance of the Community Rules via a checkbox. Role, company, nearest chapter and a message describing what the applicant offers or seeks are optional.
Providing the required information is voluntary, but without it we may be unable to assess the application or offer membership. Optional information may be omitted without preventing submission, subject to the actual configuration of the form.
Applicants who are not accepted may reapply no earlier than six months after receiving the decision. We retain rejected applications for 12 months following the decision. This allows us to administer reapplications, ensure consistency in the selection process and handle possible claims.
6. Member directory and member communications
Authorised paid members may access the private member directory after signing in. Depending on the information included in a profile, the directory may display name, photograph, role, company, industry, chapter, biography, experience, skills, information on what the member seeks or offers, links to professional profiles or websites, joining date and member connections. Email addresses and telephone numbers are not displayed in the directory.
Contact may take place through internal request or messaging functionality. When a contact request is sent, the sender’s email address may be provided as the reply address.
Members may edit or remove optional profile information and disable contact requests. Active members cannot hide their entire profile while retaining access to the directory. Each active profile therefore remains visible to other members and contains at least the member’s name.
After membership ends, access to the directory is blocked. We will stop displaying and remove the former member’s profile within 30 working days, subject to technical implementation and any data that must be retained for legal, accounting, security or claims purposes.
Requests concerning directory visibility or membership may be sent to administrator@vistulavalley.org.
7. Who receives personal data
Access within Vistula Valley is limited to persons who need the data for membership administration, communications, payments, security or legal compliance. We may also disclose data where required by law or necessary to establish, exercise or defend legal claims.
The following categories of recipients may receive or otherwise process personal data in connection with the website and membership service:
- Hosting and cloud infrastructure providers, which host the members platform, administration panel, application process, databases, file storage and member photographs, and process technical data necessary to provide and secure these services. The main infrastructure is located in the EEA, although provider logs, backups and support access may involve other countries.
- Software and platform providers, which provide and maintain the technical functionality used for user accounts, permissions, membership records, applications and attachments.
- Website hosting and content delivery providers, which host the public website and process technical request data, such as IP addresses, device information and request metadata. Such providers may operate distributed infrastructure and process data in the United States and other countries.
- Electronic communications and email delivery providers, which send and deliver application, decision, invitation, account, payment and reminder messages and may therefore process recipients’ contact details, message content, delivery information and related technical logs. Processing may take place in the United States and other countries.
- Payment service providers, which process information necessary to administer membership payments, verify transactions, prevent fraud and reconcile payments. Payment information may be processed in Canada, the United States and other countries. We receive the transaction information necessary to confirm and reconcile payments, but we do not receive or store full card numbers or card security codes.
- Business email and correspondence service providers, which store and transmit correspondence, application notifications and other communications. Such processing may take place in multiple countries.
- Domain name, DNS and domain email service providers, which support the operation and routing of the website, domain and associated email services and may process related technical and communications data.
- Software development, code hosting and technical operations providers, which support the maintenance and deployment of the website and membership service and may perform scheduled technical tasks. These providers may process technical data in the United States and other countries. Where scheduled tasks use membership information, they are configured to process aggregate results rather than download complete member lists for message distribution.
Providers receive only the information needed for their role and are required to protect it. We may disclose information where required by law or needed to establish or defend legal claims. We do not sell personal data.
8. International data transfers
We, our providers and their subprocessors may process data in the United States, Canada and other countries.
Where GDPR transfer restrictions apply, Vistula Valley will rely on an applicable adequacy decision or standard contractual clauses approved by the European Commission together with supplementary measures where required. Details of the relevant mechanism may be requested using the contact details above.
9. Cookies and similar technologies
Cookies are small text files that can be used by websites to make the user experience more efficient.
We may store cookies on a user’s device where they are necessary for the website to function.
The members service uses cookies and similar technologies that are necessary to authenticate users, maintain session security and remember whether certain notices have been dismissed. Authentication-related cookies may remain active for approximately 8 hours or, where a user chooses to remain signed in, for up to 30 days. Information recording the dismissal of a notice may be stored for up to 365 days.
Users can restrict or delete cookies through their browser settings. However, blocking or deleting strictly necessary cookies may prevent users from signing in or cause certain features of the members service to function incorrectly.
You can manage or delete cookies through your browser settings. Links to instructions on managing cookies in commonly used browsers are provided below.
10. Security
We use organisational and technical measures designed to protect personal data, including access controls, private attachment storage, encrypted transport and application-level encryption for member and payment identity data at rest. Access is limited on a need-to-know basis. No online service can guarantee absolute security.
Suspected security issues concerning Vistula Valley services should be reported to info@vistulavalley.org.
11. Your rights
Subject to the law applicable to your circumstances, you may have the right to request access to, correction or deletion of your personal data; restriction of processing; data portability; and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise a right, email administrator@vistulavalley.org. We may ask for information needed to verify your identity and understand the request. We will respond within the timeframe required by applicable law.
Where the GDPR applies, you may lodge a complaint with the supervisory authority in your habitual residence, place of work or place of an alleged infringement. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
Depending on your place of residence, additional local rights may apply. Vistula Valley will address valid requests under the applicable privacy law.
12. Automated decision-making
Vistula Valley does not make decisions producing legal or similarly significant effects based solely on automated processing. Membership applications are reviewed by authorised individuals.
13. External services and links
Our services may link to or use external services, including LinkedIn, Zeffy, Stripe and WhatsApp. Those providers may process personal data for their own purposes under their own privacy notices. This Privacy Policy does not replace the privacy notices of those providers.
14. Changes to this policy
We will update this policy when our processing, services, providers or legal details change and will show the effective date above. Material changes affecting members will also be communicated through an appropriate membership channel.