Privacy Policy

1. Scope and definitions

“We,” “us,” and “our” refer to SBMT and WBMF to the extent
each organization is responsible for the relevant website,
program, or processing activity. “Personal information”
means information that identifies, relates to, describes,
or can reasonably be associated with an identifiable
individual, as defined by applicable law.

The responsible organization may vary by program or
transaction. Certain service providers may independently
process information under their own privacy notices.

2. Information we collect

The information collected depends on how you interact with
us, which features you use, and what you choose to provide.

A. Identity and contact information

Name, email address, telephone number, mailing address,
professional title, institutional affiliation, and other
contact details submitted through forms, correspondence,
subscriptions, or registrations.

B. Donations and payment information

Donation amounts, transaction dates, payment status, receipts,
billing details, and records required for accounting,
acknowledgments, fraud prevention, and legal obligations.
Payment card details may be processed by the applicable
payment processor. Whether we receive or retain card details
depends on the payment method and system configuration.

We should not retain complete payment card numbers or card
security codes in our own records. This practice must be
verified against the payment systems actually in use.

C. Events, memberships, and programs

Where relevant, we may collect registration details,
attendance records, membership information, professional
interests, communication preferences, and accessibility
requests you choose to provide.

D. Technical and website information

Depending on the technologies enabled, we may collect IP
address, browser and device type, operating system, referral
URL, approximate location derived from IP address, pages
viewed, timestamps, and interactions with website features.

E. Comments and communications

We may retain inquiries, feedback, support requests,
public comments, and related correspondence. If a comment
feature uses Gravatar, an anonymized hash of an email
address may be sent to that service to check for a profile
image. Approved comments and associated profile images may
be publicly visible.

F. Sensitive information

Please do not send medical records, patient-identifiable
data, government identification numbers, payment credentials,
or other sensitive information through general forms or
email unless a service expressly requests it through an
appropriate channel.

3. How information is collected

• Directly from you: when you contact us,
  donate, register, subscribe, complete a form, or
  participate in a program.
• Automatically: through server logs,
  cookies, analytics tools, and similar technologies,
  depending on website configuration.
• From service providers: such as payment,
  registration, hosting, and email delivery providers.
• From public or professional sources:
  where reasonably necessary for legitimate organizational
  activities and permitted by law.

We should limit collection to information reasonably
necessary for disclosed purposes and provide required
notices or obtain required consent.

4. How we use information

Subject to applicable law, we may use information to:

• Respond to inquiries and provide requested services.
• Process donations, issue acknowledgments, and maintain financial records.
• Administer events, registrations, memberships, and programs.
• Send confirmations, service messages, and important updates.
• Send newsletters and fundraising communications where permitted.
• Maintain, secure, troubleshoot, and improve our websites.
• Detect fraud, abuse, unauthorized access, and security incidents.
• Meet legal, regulatory, accounting, and recordkeeping obligations.
• Establish, exercise, or defend legal claims.

5. Disclosure and sharing

We may disclose information to the following categories
of recipients where reasonably necessary and legally permitted.

• Service providers: hosting, security,
  payment processing, event registration, communications,
  analytics, and technical support vendors.
• Authorized personnel: individuals who
  need access to perform legitimate organizational duties.
• Professional advisers: legal, accounting,
  auditing, insurance, and other professional advisers.
• Legal and safety recipients: courts,
  regulators, law enforcement, or other parties where
  disclosure is required by law or reasonably necessary
  to protect rights, safety, or security.
• Organizational transactions: parties
  involved in a restructuring or transfer, subject to
  appropriate safeguards and applicable law.

Service providers processing information on our behalf
should be contractually restricted to authorized purposes
and required to maintain appropriate safeguards.

We do not intend to sell personal information for money.
Certain advertising or analytics technologies may nevertheless
qualify as a “sale,” “sharing,” or targeted advertising under
some privacy laws. Our actual configuration must be reviewed
to determine whether those activities occur.

We do not disclose information to third parties for their
independent marketing purposes unless permitted by law and,
where required, supported by consent.

6. Cookies and tracking technologies

Cookies are small files stored on your device. Depending on
the features enabled, our websites may use cookies for:

• Essential operations: login, security, and core functionality.
• Preferences: remembering display and user settings.
• Analytics: understanding traffic and website usage.
• Embedded services: enabling third-party content and tools.

WordPress may set temporary cookies, authentication cookies,
and editing-related cookies. Actual cookie names and lifetimes
depend on the installed WordPress version, plugins, and settings.

Where required by law, non-essential cookies and tracking
technologies should remain disabled until the necessary
consent is obtained. You may also manage cookies through
your browser, although blocking essential cookies may affect
website functionality.

We may use Google Analytics or other analytics services if
enabled. The tools currently installed and their retention
and consent settings must be verified.

7. Third-party services and embedded content

Our websites may link to or embed third-party video, social
media, payment, registration, mapping, or profile-image
services. These providers may collect information directly
from your browser, set cookies, receive technical identifiers,
or record interactions under their own privacy policies.

We do not control independent third-party privacy practices.
Review the applicable provider’s privacy notice before
submitting information or using its services.

Where applicable, integrations should be configured to
minimize unnecessary data transfers and respect required
consent and opt-out choices.

8. Security safeguards

Appropriate safeguards should be selected according to the
nature of the information, the risks involved, and applicable
legal requirements.

• Access controls based on legitimate need.
• Reasonable protection for information in transit and at rest.
• Secure maintenance of websites, software, and plugins.
• Vendor review and appropriate contractual safeguards.
• Retention limits and secure disposal procedures.
• Processes for detecting, investigating, and responding to incidents.

No website, transmission, or storage system can be guaranteed
completely secure. We cannot promise that unauthorized access,
loss, or disclosure will never occur.

If a security incident affects personal information, we will
assess it and notify affected individuals or authorities
when required by applicable law.

9. Data retention and disposal

Personal information should be retained only for as long
as reasonably necessary for its collection purpose, legitimate
operational needs, dispute resolution, security, and legal
or accounting obligations.

Retention periods may differ for donations, financial
transactions, event registrations, correspondence, security
logs, marketing preferences, and account records.

When information is no longer needed, we should delete it,
anonymize it, or securely dispose of it in accordance with
applicable law. Backups and legally required records may
persist for a limited period under appropriate safeguards.

10. Your privacy rights

Depending on your location and applicable law, you may have
the right to:

• Access: request access to or a copy of your personal information.
• Know: request information about the categories of data collected and their uses.
• Correct: request correction of inaccurate information.
• Delete: request deletion, subject to legal exceptions.
• Port: request a portable copy of certain information where applicable.
• Opt out: opt out of certain sales, sharing, or targeted advertising where applicable.
• Limit certain uses: limit specified processing of sensitive personal information where the law provides this right.
• Withdraw consent: withdraw consent where processing is based on consent.
• Object or restrict: object to or restrict certain processing where provided by law.
• Appeal: appeal a denied request where an appeal right applies.

California residents may have additional rights under the
California Consumer Privacy Act, as amended by the California
Privacy Rights Act, if the organization and processing are
subject to those laws.

Privacy rights are not absolute. Exceptions may apply for
legal obligations, completed transactions, security, and
the establishment, exercise, or defense of legal claims.

To submit a request, email
babak.kateb@worldbrainmapping.org
with the subject “Privacy Rights Request.”

We may need to verify your identity or clarify your request.
Verification information should be limited to what is
reasonably necessary. Authorized agents may submit requests
where permitted by law, subject to applicable requirements.
We aim to respond within the time required by applicable law.

We will not discriminate against you for exercising privacy
rights where non-discrimination is required by law.

11. Marketing and communication preferences

We may send organizational news, educational updates,
invitations, newsletters, fundraising communications, and
information about our initiatives where permitted by law.

You may opt out of promotional email using the unsubscribe
link in the message or by contacting
babak.kateb@worldbrainmapping.org.
Requests will be processed within the time required by law.

Opting out of promotional messages does not necessarily stop
essential administrative communications, such as donation
receipts, registration confirmations, security notices, or
responses to your inquiries.

12. Children’s privacy

Our general websites are not intended to knowingly collect
personal information directly from children under 13 without
the consent or authorization required by applicable law.

If you believe a child has provided personal information
inappropriately, contact
babak.kateb@worldbrainmapping.org.
We will review the concern and take appropriate action
consistent with applicable law.

Programs specifically directed to children should have
additional procedures and notices appropriate to the program.

13. International visitors and transfers

Our websites may be accessed from countries other than the
location where a service operates. Information may be
processed in the United States or other locations where we
or our service providers operate.

Where cross-border transfers are subject to legal requirements,
appropriate safeguards and transfer mechanisms should be
implemented. Depending on your location, you may have
additional rights relating to transfers or regulatory complaints.

14. Changes to this policy

We may revise this policy to reflect changes in our activities,
website functionality, service providers, or applicable law.

The revised version will be published on this page with an
updated revision date. Where required by law, we will provide
additional notice or obtain consent before implementing a
material change.

15. Contact and privacy requests

For questions about this policy, requests concerning your
personal information, or privacy-related complaints, contact us.