1. Members:
   If you are a member of one of our working groups, we use your data only to inform you about the EU policy issues that are relevant for the working group(s) that you are a member of. We consider such processing to be necessary for the performance of your company’s membership agreement with ACEA. 
2. Non-members:
   If you are not a member of ACEA, we use your data only to inform you about our position on EU policy issues, invite you to our events and send you our press releases. We consider such processing to be in the legitimate interest of ACEA as a trade association whose mission it is in a representative democracy with a free press to represent the European automobile manufacturers at EU level and to act as an interface between our member companies and the EU institutions, the media and other companies and associations that try to influence EU decision-making. We believe our legitimate interest outweighs your right to the protection of your personal data since we process your data only to contact you in your professional capacity and to send you only information that is relevant for your professional activity.
   
   
3. Data Sharing:

   By using Office 365 software for data storage, we share your data with Microsoft Corporation. This company processes your data on servers located in the European Union.   

   If you are a member of one of our working groups, we share your data with the other members of the group(s) that you are a member of.  

   We may share your data with our affiliates and with other partners such as companies that host or (co-)organise our events insofar as this is necessary for specific purposes such as logistics and security. Where these companies act as data processors on our behalf, we require them to process your data in accordance with this privacy policy. 

   We may also disclose your data comply with a reasonable request from competent law enforcements agents, judicial authorities and governmental agencies or bodies including competent data protection authorities. 

   We do not share your data with any third party in any other way. 

We store your data as long as they are current. We will send you a notice once a year to verify whether your data are still accurate. We instruct our staff to inform our database managers whenever they become aware of any changes in your professional situation so that we can update or remove your data as appropriate.

We do our utmost to protect your data against destruction, loss, alteration or unauthorised disclosure. In terms of organisational measures, we have limited the access to your personal data to specifically appointed employees who have been trained to handle such data properly. To prevent anyone else from accessing your personal data, these employees use Microsoft’s Identity and Access Management solutions to access our devices, apps and cloud services.

In terms of technical measures, we use Microsoft Intelligent Security Graph (ISG) to protect, detect, and respond to security incidents. For example, malware gets detected by Office 365 Advanced Threat Protection, shares that information with services like Windows Defender ATP and Advanced Threat Analytics, that collectively protect our user identities, apps and data, devices, and infrastructure against advanced persistent threats.