Privacy Statement for the Consultation Platform

Introduction

Thank you for participating in the FSC Public Consultation Platform (“Consultation Platform”). We at FSC International Center GmbH (“FSC IC”, “we”, “us”) respect your privacy and want you to understand how we collect, use, and share your personal data in compliance with applicable data protection laws.

This Privacy Statement describes our data collection practices and your rights to access, correct, or restrict the use of your personal data. Unless we provide a link to a different privacy statement or reference other privacy documentation, this Privacy Statement applies when you access or participate in the Consultation Platform.

By participating in the Consultation Platform, you accept the practices described in this Privacy Statement.

1. Controller and Contact Details
2. Description of the Consultation Platform
3. What Personal Data We Collect
4. How We Collect Your Personal Data
5.How We Use Your Personal Data
6. Use of Your Email Address
7. Who We Share Your Personal Data With
8. How Long We Keep Your Personal Data
9. Security
10. Your Rights
11. Cookies & Similar Technologies
12. Changes to this Privacy Statement

1. Controller and Contact Details
The data controller responsible for processing your personal data for the purposes of this Consultation Platform is:
FSC International Center gGmbH
Adenauerallee 134, 53113 Bonn, Germany
Phone: +49 (0) 228 36766 0
Email: privacy@fsc.org
Data Protection Officer (DPO)
Scheja & Partner Rechtsanwälte
Mr. Boris Reibach
Adenauerallee 136, 53113 Bonn, Germany
Tel.: +49 (0) 228-227 226-0vEmail: info@scheja-partner.de
Contact form: http://www.scheja-partner.de/kontakt/kontakt.html

2. Description of the Consultation Platform

The Consultation Platform facilitates public consultations on FSC policies, standards, and procedures. Participants may register, review consultation materials, and submit feedback.

The information collected helps FSC:

Manage consultation participation
Conduct internal analyses
Improve engagement strategies
Support communication about FSC services
Ensure transparency and inclusiveness in consultation processes

Aggregated and anonymized participation data may be published to illustrate levels of stakeholder engagement. Only FSC staff (FSC Global Development GmbH and FSC International Center) are authorized to manage and oversee consultations.

The platform is hosted on secure servers in Europe by FSC Global Development GmbH, acting as a processor.

3. What Personal Data We Collect

To fulfill the consultation purpose, we may collect the following personal data:

Mandatory

Full name (title, first, middle, last name)
Email address

Voluntary

Country / Region
Organization or company name
Stakeholder category (e.g., FSC member, certificate holder, government, NGO)
FSC Certificate Holder type (if applicable)
FSC membership chamber (if applicable)
Gender identity (Female / Male / Non-binary / Prefer not to say)
Age group
Stakeholder interest indicators (e.g., where you heard about the consultation, materials used, previous events attended)

Automatically collected technical data.

When accessing the Platform, your device may automatically transmit:

Date and time of access
IP address
Operating system and browser type
Device type
Volume of data transferred

This data is processed solely for technical access and security.

4. How We Collect Your Personal Data

We collect personal data:

When you register or create an account
When you submit comments or feedback
Through consultation forms or related communications
Automatically through your device (see section 3)

We only collect data necessary to provide and manage the consultation services.

If you need to correct your data, please contact psu@fsc.org.

5. How We Use Your Personal Data

We use your personal data only for the purposes described below:

a) Contractual Necessity (Art. 6 para. 1 b GDPR)

We process personal data to:

Register and manage your participation
Organize and administer the consultation
Follow up on your submitted input
Provide consultation materials or updates
Ensure proper documentation of participation

b) Legitimate Interests (Art. 6 para. 1 f GDPR)

We process personal data to:

Improve consultation formats and engagement strategies
Evaluate and analyze consultation input
Conducting internal and aggregated analyses to understand stakeholder participation and engagement levels better, and enhancing the accuracy, consistency, and efficiency of data collection and analysis processes — including through the use of automation — to improve event planning, outreach efficiency, and engagement strategies.
Participation management, including the documentation of participant lists
Information for the speaker for better event planning
Enhance stakeholder services
Supporting communication about our services
Ensuring inclusiveness and transparency in consultation and communication processes

Additionally, aggregated and anonymized participation data may be made publicly available through our platforms to illustrate levels of stakeholder engagement and support transparent communication efforts. Please note that your data will not be used to create individual evaluations under any circumstances.

We may use AI-assisted tools to analyze aggregated, anonymized qualitative feedback (e.g., open-text responses), thereby identifying common themes and enhancing the inclusiveness, clarity, and effectiveness of our engagement processes. These tools operate under strict access controls, do not make automated decisions about individuals, and results are reviewed and interpreted by FSC staff.

You have the right to object to processing carried out under legitimate interest (see Section 10).

c) Consent (Art. 6 para. 1 a GDPR)

If data cannot be processed under legitimate interest or contractual necessity, we request your explicit consent (e.g., for optional demographic information). You may withdraw consent at any time.

d) Legal Obligations (Art. 6 para. 1 c GDPR)

We process personal data necessary for compliance with legal requirements, such as tax and record-keeping obligations.

6. Use of Your Email Address

We use your email address to:

Confirm your registration
Notify you about new or ongoing consultations
Send reminders when consultations open or close
Communicate about your submitted comments
Send system messages (e.g., password reset)

We do not use your email address for marketing without your explicit consent.

Your data is processed only by authorized FSC staff involved in consultation management.

In certain cases, we may engage external service providers who process encrypted personal data on our behalf under strict confidentiality and in compliance with Article 28 GDPR.

If data is transferred outside the EEA, we implement appropriate safeguards such as:

Standard Contractual Clauses (SCCs)
Verification of adequate protection levels

We do not share your personal data with third parties unless:

Required by law
Necessary for the purposes described in this Privacy Statement
You provide explicit consent

8. How Long We Keep Your Personal Data

We retain your personal data only as long as necessary for processing.

Additionally:

Business-related records: 6 years
Tax-related records: 10 years
Certification-related data: 10 years after termination of the relationship with FSC

9. Security

We implement organizational, technical, and physical security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, for example, encryption, access controls, and secure data storage.

10. Your Rights

You have the following rights under GDPR:

Right of access: Request confirmation and a copy of your personal data
Right to rectification: Correct incomplete or inaccurate data
Right to erasure: Request deletion where no legitimate reason for retention exists
Right to restrict processing
Right to data portability: Receive your data in a machine-readable format
Right to object when processing is based on legitimate interest
Right to lodge a complaint with your data protection authority

To exercise your rights, contact privacy@fsc.org or the DPO

11. Cookies & Similar Technologies

The Consultation Platform uses cookies to support:

Basic functionality
Basic functionality
Analytics cookies (e.g., Google Analytics) are only used after you have consented to them.

Google Analytics may collect data such as IP address and session behavior. However, IP anonymization is applied prior to storage or transfer, so only a truncated, non-identifiable IP address is processed by Google.

You can:

Disable cookies via your browser settings
Install Google’s opt-out browser add-on
Use the Platform’s cookie consent options (where applicable)

12. Changes to this Privacy Statement

We may update this Privacy Statement to reflect legal requirements or improvements to our services. The revised version will be posted on the Platform, together with an updated ‘Last Updated’ date. If we make material changes that significantly affect how your personal data is processed, we will notify you through a platform notice and/or email (where appropriate) before the changes take effect.

Last updated: 12.12.2025