Your trust is the foundation.

1 · Introduction

SEESALT Institute (“SEESALT”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This policy governs the collection, use, disclosure, retention and protection of personal information submitted by or collected from applicants, participants, alumni, partners and others who interact with our programmes, platforms, websites and services worldwide. By engaging with SEESALT or applying to a programme you acknowledge that you have read and agree to this policy.

2 · Data controller

SEESALT Institute is the data controller for personal information processed under this policy and determines the purposes and means of processing in accordance with applicable law, including the General Data Protection Regulation, the California Consumer Privacy Act and the Personal Information Protection Law of the People’s Republic of China. Questions and requests go to the Data Protection Officer at cat661@aliyun.com.

3 · Lawful basis and purposes

We process personal data on the basis of consent; contractual necessity for programme agreements and service delivery; legal obligation; legitimate interests, except where overridden by your rights and freedoms; and vital interests in emergencies affecting life or safety. Purposes include application evaluation and selection; programme administration and delivery; participant safety and welfare; academic and professional development support; impact assessment and research; alumni network management; fundraising; and legal compliance.

4 · What we collect

Identification information (name, date of birth, nationality, gender, and government identification numbers only where legally required); contact information, including emergency contacts; educational and professional information, including transcripts, degrees, employment history and references; application materials such as essays, statements, portfolios and recommendation letters; programme participation data, including attendance, submissions, evaluations and peer feedback; financial information limited to scholarship administration and fee processing; technical data such as IP addresses, device identifiers and usage analytics; and, only with explicit consent, special-category data such as ethnic origin or religious or philosophical beliefs, solely where relevant to programme objectives or participant welfare.

5 · Sharing and international transfers

We may share personal data with internal stakeholders (staff, advisers, mentors) on a need-to-know basis; partner organisations such as host institutions, funders and programme partners, under data-protection agreements; service providers, including cloud storage, communication platforms, payment processors and analytics, bound by contract; and legal authorities where required by law. Because our work crosses borders, we transfer personal data internationally under appropriate safeguards — standard contractual clauses, adequacy decisions, binding corporate rules or explicit consent — and keep a record of transfers and the safeguards applied.

6 · Retention

We keep personal data only as long as needed for the purpose it was collected, plus any period required by law. Unsuccessful application data is kept for one year after the decision; successful applicants’ data for the duration of participation plus five years for alumni relations and impact assessment; financial records for seven years; anonymised or aggregated research data may be kept indefinitely. At the end of the period, data is securely deleted or anonymised.

7 · Your rights

Subject to applicable law you may access your personal data; have it corrected; have it erased in certain circumstances; restrict processing; receive it in a portable, machine-readable format; object to processing based on legitimate interests or for direct marketing; withdraw consent at any time where consent is the basis; and lodge a complaint with a supervisory authority. Send requests to cat661@aliyun.com; we respond within thirty days or as the law otherwise requires.

8 · Security

We apply technical and organisational measures proportionate to the risk: pseudonymisation and encryption; measures for the confidentiality, integrity, availability and resilience of systems; the ability to restore access after an incident; regular testing and evaluation; staff training; and least-privilege access. No transmission or storage method is completely secure, and we cannot guarantee absolute security.

9 · Children

We do not knowingly collect personal data from children under thirteen without verifiable parental consent. For participants aged thirteen to eighteen (or the age of majority where they live) we require parental or guardian consent for participation and data processing. Parents and guardians may review, correct or request deletion of their child’s data and withdraw consent. If we learn we have collected a child’s data without appropriate consent, we delete it promptly.

10 · Cookies

Our websites use cookies and similar technologies. Essential cookies are necessary for operation and cannot be disabled; analytics cookies help us understand how the site is used. You can control cookies through your browser or our consent tool; disabling some may affect functionality.

11 · Third-party links

Our platforms link to third-party websites and services we do not operate; this policy does not cover them, and we encourage you to read their policies. Where we integrate third-party services for programme delivery or communication, we put data-protection agreements in place.

12 · Changes to this policy

We may update this policy to reflect changes in practice, law or operations. Material changes are announced prominently on our website and, where appropriate, by email. Continued use after notice constitutes acceptance. Previous versions are archived and available on request.

13 · Governing law

This policy is governed by the laws of the People’s Republic of China, without regard to conflict-of-law provisions. Disputes are first subject to good-faith negotiation. Nothing in this policy limits your right to complain to the data-protection authority in your jurisdiction.

14 · Contact

Data Protection Officer, SEESALT Institute — cat661@aliyun.com. We aim to answer all privacy inquiries within thirty days. You may also contact the supervisory authority in your jurisdiction.