PACON Privacy Notice

1. About this notice

This notice explains what personal data PACON collects, why, and what you can do about it. It applies to the PACON registry specifically — a distinct initiative from PAID-ESA's own admissions and academic systems, which have their own privacy notice.

It sits alongside, not instead of, the PACON Terms of Use: the terms cover the rules of using PACON, this notice covers what happens to personal data along the way.

2. Who is responsible for your data

PAID-ESA operates PACON and is the data controller for the personal data described below. Section 14 has our contact details for any question about this notice or your data.

3. What we collect, and about whom

Most of what PACON holds is organisational, not personal — legal name, thematic areas, project history and the like. But several parts of a profile are personal data about identifiable people, and this notice covers all of it:

• Your account — the name, email and password of everyone your organisation invites into its PACON account, and their role
• Primary and general contact details recorded on the organisation's profile — a named person's email and phone number
• Reference contacts you provide for a project — a named individual's role, email and phone number at another organisation
• Named donors, where you choose to list them by name rather than just a category
• Consent records — tied to the individual account that made each decision, kept even after a consent is withdrawn

4. Our basis for processing it

Account and profile data: you provide it to create and operate your organisation's account, which is how we're able to offer PACON to you at all.

The four optional processing activities — being contacted about opportunities, verification checks, contacting your references, and PACON news — each run on your organisation's explicit, separately-given consent, which you can withdraw at any time from Team & Settings without affecting the rest of your account.

5. How we use it

To operate your account and let your team manage your organisation's profile; to review and progressively verify your organisation against the four-level framework described in the Terms of Use; to make a listed profile discoverable to partners searching PACON; and to identify and invite organisations to opportunities that fit their profile.

We do not sell personal data, and we do not use it for anything beyond operating and improving PACON without telling you.

6. Who can see it

Your own team sees everything on your organisation's profile. PACON staff who manage the registry can see everything, including internal notes, due-diligence outcomes and reference-contact details that are never shown to anyone else.

Once your organisation is listed, the profile fields you completed become visible to partners searching PACON — but reference contact details, internal notes, due-diligence outcomes and engagement reviews are never included in that, regardless of registry status. Documents you mark confidential are never included in anything exported or shared externally.

7. Where your data is processed

PACON runs on secure cloud infrastructure operated by our technology provider. We take reasonable technical and organisational measures to protect your data wherever it is processed.

8. How long we keep it

We keep your organisation's profile for as long as your account remains active. You can request deletion of your organisation's account at any time from Team & Settings. Where there's no recorded engagement or invitation history, we delete the record outright. Where there is, we anonymise identifying and contact information, archive the profile, and keep the engagement history itself — the same standard we apply to our own records of who we worked with. Consent records are kept even after a consent is withdrawn, so we can show what was agreed and when.

9. Your rights

You can review and correct most of your organisation's profile directly, at any time, from the portal. For anything you can't change yourself — including a request to access, correct, or delete personal data we hold about you specifically (rather than the organisation's profile as a whole) — contact us using the details in section 14.

10. If you gave us someone else's details

Reference contacts and named donors are people who didn't sign up to PACON themselves — you gave us their details, generally in the same way you would for any professional reference or funder acknowledgement. If one of them wants to know what we hold about them or wants it corrected or removed, they — or you, on their behalf — can contact us using the details in section 14.

11. Keeping your data secure

Access to PACON data is restricted by role — your own team only ever sees your organisation's data, and staff access is limited to the registry team. Documents marked confidential are handled accordingly throughout. Contact us if you'd like more detail about our security practices for your own due-diligence purposes.

12. If something goes wrong

If we become aware of a breach affecting your personal data, we will assess it and notify affected organisations without undue delay.

13. Changes to this notice

This is version v1, in effect from 2026-08-21. If we make a material change, we'll update the version here and, where practical, let registered organisations know.

14. Contact us

For any question about this notice or the personal data PACON holds, contact PAID-ESA using the details below.