Last Update: February 2026

1.Data Controller

The data controller responsible for the processing of personal data through the AAC2026 mobile application (“the App”) is:

Adventist Development and Relief Agency (ADRA) International
12501 Old Columbia Pike
Silver Spring, MD 20904, United States
Email: [email protected]

ADRA International (“we”) is the entity that determines the purposes and means of processing personal data collected through the App in connection with the ADRA Annual Council 2026 event.

2. Purpose and Scope

The AAC2026 mobile application is developed in-house exclusively with the purpose of supporting participants of the ADRA Annual Council 2026 event. This Privacy Notice explains how the App collects, combines, stores, and ensures the protection of personal data in connection with its operation, in compliance with the highest standards posed by leading Personal Data Protection legislation (e.g. Australia Privacy Act, the EU GDPR, other…) as those may apply.

By downloading and using the App, you acknowledge that you have read and understood this Privacy Notice. Where processing is based on consent, your continued use of the App constitutes your consent to the practices described herein. You may withdraw your consent at any time as described in Section 9 below.

3. Categories of Personal Data Collected

We collect and process the following categories of personal data:

3.1 Data Provided Directly by You

• Name and email address – if voluntarily provided for event communication purposes such as session registration or personalised notifications.
• Communication preferences – your notification and communication settings within the App.

3.2 Data Collected Automatically

• Device information – device type, operating system and version, unique device identifiers (e.g., advertising ID, device token for push notifications).
• Usage data – app interactions, features accessed, session duration, and crash/error logs.
• IP address – collected automatically when the App communicates with our servers.
• Push notification tokens – device tokens issued by Apple Push Notification Service (APNs) or Firebase Cloud Messaging (FCM) to deliver notifications.

3.3 Data Which is Not Collected

The App does not collect precise geolocation data, biometric data, financial information, or any special categories of personal data as defined under Article 9 of the GDPR (e.g., health data, religious beliefs, political opinions). The App does not require account creation or login credentials.

4. Purpose and Legal Basis for Processing

The App processes your personal data for the following purposes and on the following legal basis:

5. Third-Party Services and Processors

The App integrates with the following third-party services to enable its core functionality. Each of these services acts as a data processor on our behalf or operates under its own Privacy Notice:

All processors are required to undertake the processing of personal data in accordance with applicable data protection laws and only for the purposes specified by ADRA. Where personal data is de-localized (transferred to a 3rd country) appropriate safeguards are in place as described in Section 6.

6. International Data Transfers

As the App utilises third-party services based in the United States and potentially other countries (acting as processors) personal data may be transferred internationally. Where such transfers occur, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): Where no adequacy decision applies, we rely on the European Commission’s Standard Contractual Clauses as adopted under Commission Implementing Decision (EU) 2021/914, supplemented by transfer impact assessments where required.
• Supplementary measures: Where necessary, additional technical and organisational measures are implemented to ensure an essentially equivalent level of protection for transferred data.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice. Specifically:

• Event-related data (including any voluntarily provided names and email addresses) will be deleted or anonymised within 90 days following the conclusion of the AAC2026 event, unless a longer retention period is required by applicable law or legitimate organisational record-keeping obligations.
• Device tokens and notification preferences will be deleted when the App is uninstalled or within 90 days after the event, whichever occurs first.
• Usage analytics and crash logs will be retained in anonymised or aggregated form for a maximum of 12 months for the purpose of improving future event applications, after which they will be permanently deleted.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols.
• Access controls limiting data access to authorised personnel only.
• Regular security assessments of the App and its infrastructure.
• Incident response procedures to address any data security breaches promptly.

No data processed through the App is sold, rented, licensed, or shared for marketing, advertising, or any commercial purposes unrelated to the AAC2026 event.

9. Your Rights

Depending on your jurisdiction, you have certain rights regarding your personal data. Under the GDPR, these include:

• Right of access (Article 15) – You may request confirmation of whether your personal data is being processed and, if so, request a copy of that data.
• Right to rectification (Article 16) – You may request correction of inaccurate personal data.
• Right to erasure (Article 17) – You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to restriction of processing (Article 18) – You may request that we restrict processing of your personal data in certain circumstances.
• Right to data portability (Article 20) – You may request to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Article 21) – You may object to processing based on legitimate interests at any time.
• Right to withdraw consent – Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at the email address provided in Section 12. We will respond to your request within 30 days, or within the timeframe required by applicable law.

Right to lodge a complaint: If you believe that your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority in the country of your residency, and/ or (mainly where there is no such entity in your country) directly towards us.

10. Push Notifications

The App uses push notifications to deliver important event updates including schedule changes, transportation notices, session reminders, and general announcements. Push notifications are delivered via Apple Push Notification Service (APNs) for iOS devices and Firebase Cloud Messaging (FCM) for Android devices.

ПРИМІТКА
Consent for push notifications is obtained through your device’s operating system permission prompt when you first use the App. You may disable or re-enable push notifications at any time through your device’s settings. Disabling notifications will not affect other App functionality.

11. Children’s Privacy

The App is intended exclusively for professional event participants attending the ADRA Annual Council 2026 and is not directed toward children. We do not knowingly collect personal data from anyone under the age of 18 (eighteen years of age). This threshold is set at 18 to comply with the highest age of consent provisions under potentially applicable legislation across the Globe.

If we become aware that we have inadvertently collected personal data from a child under the age of 18, we will take immediate steps to delete such data. If you believe that a child has provided personal data through the App, please contact us immediately at the email address provided in Section 12.

12. Data Protection Contact

For any questions, concerns, or requests regarding this Privacy Notice or the processing of your personal data, please contact:

Data Protection Contact

Adventist Development and Relief Agency (ADRA) International
Attn: Mark LeRoux
12501 Old Columbia Pike
Silver Spring, MD 20904, United States
Email: [email protected]