Scope
‍This policy outlines our practices for gathering, storing, and utilizing personal data from the following categories of individuals:

Data types:
-Registrants of the U4U Program
-Applicants, Candidates, and Finalists
-Additional Contacts: Supporters, donors, referral partners, and website visitors

Data processing:
-Personal data may be used to send commercial information, including marketing related to our products and services, over the internet and/or phone. The legal basis for processing personal data is Article 6, section 1, letter a of the GDPR, which is the data subject's consent.

This policy is applicable globally to all Alight Fundacja operations and is obligatory for all Alight Fundacja staff.

Principles
Our data protection practices are based on the following principles:

-Transparency and Consent: We clearly communicate why, how, and when we use personal data and always obtain clear consent from individuals before using their data.
‍
-Necessity and Proportionality: We only collect, store, or use personal data that is essential to achieve our project goals.
‍
-Lawfulness and Integrity: We comply with the laws of each country we operate in and handle personal data with integrity.
‍
-Privacy and Security: We prioritize and safeguard the privacy of all individuals whose data we handle.
‍
-GDPR Compliance: All our data collection, storage, and processing methods comply with Article 13 of Regulation (EU) 2016/679 from the European Parliament and Council dated April 27, 2016, which relates to personal data protection and the free movement of such data.

Definitions
-Applicants: These are individuals who have completed an "intake" process either in-person or online through the interest form by Kuja Kuja.
‍
-Candidate: These are applicants that Alight Guides have vetted and deemed suitable for the Jobs Sponsorship Program.
‍
-Finalists: These are candidates who have been matched with a US employer and whom Alight has decided to sponsor for humanitarian parole in the US. They must also have received travel authorization from USCIS.
‍
-Sponsorship: This refers to a person or organization taking on the responsibility of supporting an individual or family immigrating to a new country.
‍
-Jobs Sponsorship Program: This is a program by Alight that enables Ukrainians and their immediate family members to live and work in the US for up to two years. Alight will sponsor successful candidates and their families, assist in their relocation, and connect them with additional resources upon arrival in the US.
‍
-Uniting for Ukraine: This program offers a way for Ukrainian citizens and their immediate families living outside the US to temporarily come and stay in the US for a 2-year parole period. Participants in Uniting for Ukraine must have a US-based sponsor committed to providing financial support throughout their stay.
‍
-USCIS: The U.S. Citizenship and Immigration Services, a government agency within the Department of Homeland Security, is responsible for managing lawful immigration to the US.
‍
-Alight Guides: These are specially trained local staff who assist displaced persons at critical junctures of their journey to help them process, orient, connect, and navigate. Alight Guides provide experience and stability to those who are distressed, traumatized, and in need of support, both logistically and emotionally.

-Alight: This is a humanitarian organization with over 40 years of service to displaced populations worldwide.
‍
-Resettlement Agencies: These organizations provide services and support to refugees and other displaced persons resettling in designated cities/counties in the US.

-TBB Catalogue: This is a digital database for labor mobility where refugees and other displaced people can upload their CVs to find employment in a new host country.
‍
-Consent: This is the freely given and informed agreement by a data subject to the processing of their data in writing, verbally, or by a clear affirmative action.
‍
-Data Processing: This refers to any operation or operations, whether automated or not, performed on personal data. It includes but is not limited to collection, recording, organization, structuring, storage, adaptation, use, transfer, dissemination, and destruction.
‍
-Data Protection Officer: This is the staff person who supervises, monitors, and reports on compliance with this policy.
‍
-Data Subject: This is an individual whose personal data is processed.

-Partner: This is an independent organizational entity separate from Alight that has an agreement with Alight to advance its mission.
‍
-Personal Data: This is information about an identifiable individual, which may include: name, sex, marital status, date and place of birth, country of origin, registration number, ethnicity, occupation, and biometric data. It does not include aggregated, anonymized, or otherwise de-identified data.
‍
-Personal Data Breach: This is the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, transfer, or storage of personal data.
‍
-Personal Data Collected: This refers to the data gathered from the data subject.

Personal data collected
Applicants
Alight Jobs Sponsorship applicants are invited to share:

-First name and Last name
-Contact information
-Current Location (Country and City)  
-Family demographics
-Uniting for Ukraine basic qualifications
-Interested in finding a job and working in the US
-Field of expertise
-English proficiency level
-Gender
-Age group
-How did you hear about Alight Jobs Sponsorship Pathway opportunity?

Candidates
Candidates are vetted by an Alight guide who confirms their eligibility for our program. Their CVs are shared directly with our partners through the TBB Catalogue.
‍
Finalists
Finalists are clients who have passed interviews and received or accepted a job offer in the US. Clients transition to finalists once they meet these requirements, are sponsored by Alight for humanitarian parole under Uniting for Ukraine, and obtain travel authorization.  

Typically, personal information is collected for humanitarian parole applications, allowing Alight to request permission from U.S. Citizenship and Immigration Services (USCIS) to sponsor the candidate and their immediate family members.  

Alight may also gather information about a candidate's income, banking arrangements, and financial needs to help them obtain necessary financing for relocation. Once candidates have successfully obtained travel authorization, Alight will gather information to arrange their travel. After arriving in the US, Alight will collect feedback about their relocation experience, job satisfaction, and living conditions through surveys and interactions with specific resettlement agencies.  

Website visitors
Data collection

Alight's Jobs Sponsorship website, hosted by Webflow, collects the following personal data from visitors:
‍
-Device and Browser Information: Information about the device and browser used to access the website may be collected by Webflow. This includes the IP address, browser type and version, device type, and operating system.
-Website Usage Information: Webflow may gather information about visitor interactions with the website. This includes data about visited pages, the duration of visits per page, and clicked links.
-Contact Information: If visitors voluntarily provide their contact details (like name and email address) via a website form or otherwise, Webflow may collect and store this information.
-Cookies and Tracking Technologies: Webflow may utilize cookies and other tracking technologies to gather data on visitor browsing habits, such as the pages visited and the links clicked on.

Data collection
When gathering data from all individuals, Alight must clearly convey:

-The specific reason for the data collection.
-Whether the data will be shared with any partners, and if so, under what conditions.
-The options for individuals to modify, delete, request, or correct their data in the future.
-The individual's right to refuse to provide personal data.
-Any repercussions for not providing the requested data.
-A contact point and procedure for individuals to file a complaint about the collection, usage, or processing of their data.  

All platforms used by Alight uphold high levels of data protection and are GDPR compliant.
‍
Alight applicants
-When individuals register via the initial Kuja Kuja survey, they agree to the use of their data in accordance with this policy.
-We gather data from the Kuja Kuja database. Alight gains access to this data when Kuja Kuja transfers it to Alight, which is hosted on Notion, benefiting from its security measures.
‍
Active candidates and finalists
-Alight stores extra personal information about active candidates on platforms like Microsoft Sharepoint, Google Drive, and WhatsApp, leveraging their security features.
-Active candidates who partake in interviews or media opportunities give explicit written or verbal consent to be surveyed about their experience with our program.
‍
Website visitors
-Visitors to our website are informed that by browsing the site, they consent to our use of cookies.
-Webflow retains data related to the visitors of our website.
‍
Data use
Alight applicants, candidates and finalists
-Personal information in Alight's database(s) is used to determine suitability for our Jobs Sponsorship program, i.e., for job placements and Uniting for Ukraine sponsorship.

-Alight shares the information provided by applicants through TBB profiles and initial information with employers, project, or resettlement partners solely to identify potential employment and resettlement opportunities.

-If Alight intends to share a profile with an additional third party beyond employers or for formal employment/referral purposes, we will only do so in a de-identified form, removing all identifiable information (such as full name, contact information, date of birth, etc.).

-Personal information gathered through surveys is used to document the outcomes candidates have achieved through Alight's support, primarily for monitoring and evaluation purposes.

-Alight utilizes personal information about active candidates in its data analysis to inform future programming, providing monitoring and evaluation reports to be shared both internally and externally.

-Alight uses aggregate, de-identified data from the Talent Catalog for advocacy and communication about the depth and breadth of talent within displaced populations.

-Alight only uses the contact information on the Talent Catalog to reach out to an individual regarding gathering further information relevant to potential employment or immigration opportunities, or to notify individuals of a data breach.

Data storage, rectification & security
Organizational security measures  
-All new staff members or partner representatives must sign the Alight Fundacja Confidentiality Agreement. This agreement emphasizes the need to safeguard personal data from loss, accidental destruction, misuse, or disclosure, ensuring that data is accessed only by employees, contractors, or interns in the course of their duties.
-Every new team member with access to personnel data is required to read this policy and undergo training on the appropriate use of each of Alight Fundacja's data collection and storage platforms.

Technical security measures
-Passwords - All systems storing personal data must be password protected. Alight Fundacja mandates robust password security measures through our technology providers, Notion and MS O365. We require our staff to change their passwords every 90 days and use Multi-Factor Authentication (MFA) when accessing MS O365 accounts.

-Account Sharing - Sharing of accounts is not permitted on any digital platform.

-Departing Personnel - When an employee leaves Alight Fundacja, we delete their relevant storage accounts within 3 months of their departure and transfer their data to appropriate staff remaining in the organization.

-Paperless Working - Data Destruction - We retain data only as long as it's relevant to our operations and program. Any individual has the right to request the deletion of their personal data, which will then be erased or destroyed.

-Data Rectification - Individuals who provide personal data to Alight Fundacja have the right to modify, request, delete, or stop the processing of that data. For data held on other platforms (Google, Notion, MS O365, etc.), any individual may request access to or deletion of their data.

-Data Breach - If we discover a breach posing a risk to the rights of any individual whose personal data has been exposed, Alight Fundacja will comply with GDPR Art.33 and Art. 34 by:
*Reporting the personal data breach to the appropriate supervisory authority in line with Article 55, unless the breach is unlikely to risk the rights and freedoms of individuals.

*Reporting this to any relevant country's Information Commissioners within 72 hours of discovery. All data breaches will be recorded, regardless of their impact. If the breach is likely to result in a significant risk to individuals' rights and freedoms, we will inform those affected about the breach, its likely consequences, and the measures we have taken to mitigate it. Breaches might include the loss of a computer or phone, an instance of hacking or password loss, or other unintentional data loss or destruction.

Data-sharing partnerships
Personal information will be collected, shared, and processed by Alight, our trusted partners, and resettlement agencies for the express purpose of assisting clients through the humanitarian parole application, flight purchasing, and United States resettlement processes. Alight commits to taking all necessary measures to ensure that client personal data is handled with the highest level of confidentiality and is used solely for the stated purpose. Alight pledges to adhere to GDPR standards for data protection and confidentiality and will immediately notify clients in the event of any breach of their personal data. Clients reserve the right to withdraw their consent at any time by notifying Alight in writing at GDPR@wearealight.org.