Privacy Policy

Last updated: October 2026

NEJM Group is a division of the Massachusetts Medical Society (“MMS”), and this Privacy Policy addresses our website (nejm.org), and other NEJM Group Sites, applications, programs and services (collectively “Services”).

This Policy explains our practices regarding your personal information, including how we collect, use, and share your personal information, and your rights regarding the personal information we collect when you use our Services.

Please read through this Policy in its entirety and understand its terms. We may update this Policy from time to time. Where we make material changes, we will take appropriate steps to bring those changes to your attention, which may include providing a notice through the relevant Service or contacting you directly where appropriate. The updated Policy will apply from the date it is posted or otherwise notified.

THIS POLICY DESCRIBES THE FOLLOWING:

• Personal Information We Collect
• How We Collect Your Personal Information
• How We Use Your Personal Information
• How We Share Your Personal Information With Third Parties
• How We Protect Your Personal Information
• Your Rights and Choices
• Other Information
• Changes to the Policy
• Questions About This Policy
• Privacy Information for Users in the EU, EEA and UK

PERSONAL INFORMATION WE COLLECT

Information You Provide to Us

We may collect, use, store and transfer different kinds of Personal Information about you, which we have grouped together as follows:

• Identifiers such as your first name, last name, alias, National Provider Identifier (NPI), profile photograph, unique identifiers, and online identifiers (cookies, mobile advertising IDs, and device IDs).
• Contact Information such as your mailing address, email address, and telephone numbers.
• Sensitive and Special Category Information. Certain information we collect may be sensitive under applicable law, which may include information revealing racial or ethnic origin, gender, health information, or other protected characteristics. We may collect race and ethnicity from authors and reviewers on a voluntary basis when they interact with our manuscript processing system and share it on an aggregated and de-identified basis for research or publishing-related purposes, where permitted by law. We may also process information about your interest in medical or scientific topics, which in some contexts may reveal or suggest information about health. We do not ask users to provide patient-level health information through our general Services unless expressly requested for a specific Service or submission process.
• Demographic Information such as age and gender. Gender may be collected from authors and reviewers on a voluntary basis only when they interact with our manuscript processing system and shared on an aggregated and de-identified basis.
• Financial Information such as credit or debit card information, payment details, or other payment information.
• Profile Data such as CV, education, occupation and professional background, specialty, professional board membership, certifications, school name, year in school, year of graduation, products and services you obtain from us, your comments on our content, your registration to participate in events (either in-person or online), and when you submit material to a Service.
• Technical Information such as your hardware model, internet protocol (IP) address, other unique identifiers, operating system version, browser type and settings, and the settings of the device you use to access a Service.
• Usage Data such as information about the Services you use, the date and time, the duration of your usage, the files downloaded or viewed, and other information about your interaction with content offered through a Service.
• Marketing and Communications Information such as your preferences in receiving marketing from us and third parties, email communications, and your communication preferences.
• Inference Data including inferences drawn from the Personal Information identified above.

For each of these categories of Personal Information, we will not hold such information longer than is reasonably necessary for the disclosed purpose and as required by law.

HOW WE COLLECT YOUR PERSONAL INFORMATION

Information You Provide to Us

We may collect Personal Information from you that you voluntarily provide to us, including, but not limited to, when you contact us in the following ways:

• Submit an inquiry or comment using our online contact form
• Call, email or otherwise communicate with us
• Respond to surveys or marketing communications
• Register with our Services
• Otherwise use or interact with our Services

Information We Collect From You

Information You Voluntarily Provide. We may collect Personal Information from you that you voluntarily provide to us in various ways, including when you contact us or otherwise interact with us or our Services.

Automated Technologies or Interactions. As is true of most websites, we receive and store certain types of Personal Information whenever you interact with us or our Services. This information may include Technical and Usage Data. You may manage how your mobile device and mobile browser share location information with us, as well as how your mobile browser handles cookies and related technologies by adjusting your mobile device privacy and security settings. Please refer to instructions provided by your mobile service provider or the manufacturer of your device to learn how to adjust your settings.

Cookies and Similar Technologies. We use cookies, pixels, web beacons, local storage, device identifiers and similar technologies in connection with our Services. These technologies may be used to operate and secure our Services, remember your preferences, understand how our Services are used, personalize content, measure performance, and support advertising or marketing activities.

For more information about the cookies and similar technologies we use, the purposes for which we use them, the third parties involved, and how you can manage your choices, please see our Cookie Notice.

Information We Collect From Third Parties

We may collect Personal Information from various third parties, including those listed below. We do not control third-party websites and are not responsible for any information they may collect. The collection, use, and disclosure of Personal Information received from third parties is governed by the privacy policies listed on the website where the information was collected by the third party and/or submitted by the user. Third parties may send their own cookies and pixel tags to you and may collect information and use it in a way that is different from this Policy. Please carefully review these third-party privacy policies to understand how your information may be collected, used, and disclosed by these third parties.

National Provider Identifier (NPI). We may collect NPI numbers from third parties and match those numbers to personal information in our system to provide you with content and advertisements tailored to your individual interests and needs.

Third-Party Service Providers. We collect Personal Information from service providers including website hosting platforms and email service providers.

Third-Party Advertising Partners. In some cases, we may work with third-party advertising partners to help deliver advertisements on our behalf across the Internet. We collect Personal Information received from third-party advertising partners that may place or recognize Cookies and Tracking Technologies to track anonymous information, in part, to measure and analyze the efficacy of the advertising they place at the Services. They may also have the ability to link the information they collect when you use the Services, such as the identifier for the device you are using, with other information they collect elsewhere on the Internet to gain additional insights into their target audience. We only share pseudonymous information with such third parties that does not include an individual’s name, email address, or contact information.

Analytics Providers. We may use analytics providers to help us understand how users interact with our Services and to improve their functionality, performance and content. Where these analytics services use cookies or similar technologies, further information is provided in our Cookie Notice, including how users can manage their choices.

Your ‘Do Not Track’ Browser Setting. Some web browsers incorporate a Do Not Track (“DNT”) feature that signals to the websites that you visit that you do not want to have your online activity tracked. At this time, our Services do not respond to DNT signals. We may allow certain third-party advertising partners to place tracking technology, such as cookies and pixels on our Services. This technology allows us and/or third-parties to collect personally identifiable information about your online activities over time and across different websites.

HOW WE USE YOUR PERSONAL INFORMATION

We will use your Personal Information for the following purposes:

Transactional Purposes:

• Process, fulfill, and deliver your requests for content and services
• Where applicable, report points and credits to credentialing organizations
• Provide customer support
• Review content or publishing material

Marketing Purposes:

• Provide content to individuals in an effort to create a personally relevant experience
• Contact you periodically with information, surveys, and offers relating to the Services, unless you have indicated you do not wish to receive such further information
• Information collected automatically is used to monitor users’ interests and usage patterns in order to help us enhance and improve our service offerings, personalize content, measure performance, and support advertising or marketing activities patterns in order to help us enhance and improve our service offerings
• Other sales and marketing efforts

Other Business Purposes:

• Resolve disputes and troubleshoot problems and support
• Enforce our terms and this Policy
• Customize, measure and improve our services and content
• To protect our interests, including establishing, exercising and defending legal rights and claims
• As necessary to comply with legal requirements, to prevent fraud, to cooperate with law enforcement and regulatory authorities, and to stop other prohibited, illegal, or harmful activities
• For purposes disclosed at the time you provide/we request your Personal Information or as otherwise set forth in this Policy

HOW WE SHARE YOUR PERSONAL INFORMATION

We share your Personal Information with third parties in the ways described below.

Information You Instruct Us to Share. You may be presented with a survey or an option on our Services to have us send certain information to third parties or give them access to it. If you choose to do so, your Personal Information and other information may be disclosed to such third parties and all information you disclose will be subject to the third-party privacy policies and practices of such third parties.

NEJM Group. We may share your information within NEJM Group.

For NEJM Catalyst users and NEJM Group event registrants, if we think you would enjoy some of the latest products and offers from sponsored content providers, event sponsors, event organizers, or other third parties, we may share your name, email address, and professional background information. If you would prefer not to receive these communications, please contact us at nejmcust@mms.org.

For NEJM CareerCenter users, CVs and cover letters uploaded to our site are not shared or forwarded, except at the option of the jobseeker. Jobseekers are not required to create a physician profile to apply for an open position but are encouraged to do so. The contact information included in the physician profile is controlled by and may be limited by the jobseeker and you have the option to hide your profile so that it is not available to prospective employers.

Trusted Partners. We may share your Personal Information with medical credentialing and accreditation organizations in connection with our continuing medical education and maintenance of certification offerings. Trusted Partners are obligated to maintain your personal information as confidential and have access to your personal information only as necessary to perform their requested function on your behalf.

Other Business Partners. We may share aggregated or pseudonymous information (including demographic information) with partners, such as publishers, advertisers, measurement analytics, apps, or other companies. We may also share personal information with third parties who enter into business relationships with us. These business partners may include direct marketers, publishers, and unaffiliated third parties.

Service Providers. We may use third-party service providers to perform certain business services and may disclose Personal Information to such service providers as needed for them to perform these business services. Business services provided include, but are not limited to, hosting vendors, advertising service providers, data analytics and customer support providers, IT service providers, list managers, communications services, website development services, payment processing services, compliance services, analytics services, and survey services.

Advertisers. From time to time, we rent our print subscriber list, which includes personal identifiers such as subscriber names and postal addresses, to third parties that have products or services that we believe will be of interest to our customers. We do not share your email address or credit card information. We may also share your name and email address with LinkedIn and other social media sites to provide you with tailored ads about our services. If you do not want us to rent your postal address information or share your name and email address with LinkedIn and other social media sites to provide you with tailored ads, contact us at dpo@mms.org.

We will use or share personal information for targeted advertising, social-media matched audiences, sponsored content, list rental or similar direct marketing activities where permitted by applicable data protection, ePrivacy and direct marketing laws. Where required, we will obtain your consent before using non-essential cookies or similar technologies or before sending electronic marketing. You may object to direct marketing at any time by contacting us at dpo@mms.org, by using the unsubscribe link in our email, or by using preference-management tools we provide.

Business Transactions. We may do business with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Information in the same way as set out in this Policy.

Legal Process. Subject to applicable law, we may disclose information about you: (i) if we are required to do so by law, regulation, or legal process, such as a subpoena; (ii) in response to requests by government entities, such as law enforcement authorities; (iii) when we believe disclosure is necessary or appropriate to prevent physical, financial, or other harm, injury, or loss; or (iv) in connection with an investigation of suspected or actual unlawful activity.

HOW WE PROTECT YOUR PERSONAL INFORMATION

We have reasonable security measures in place to prevent your Personal Information from being accidentally lost, used, or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions, and they are subject to a duty of confidentiality.

We endeavor to keep your Personal Information confidential and protected against unauthorized access, misuse, or alteration with commercially reasonable physical, technical, and administrative measures. However, as effective as these measures are, no security system is impenetrable. We cannot guarantee the security of electronic data, nor can we guarantee that the information you supply will not be intercepted.

OTHER INFORMATION

Cookie Choices
You can find more information about how we use cookies and similar technologies, and how to manage your cookie choices, in our Cookie Notice. Where required by applicable law, we will obtain your consent before using non-essential cookies or similar technologies. You may change or withdraw your cookie choices at any time using the tools described in our Cookie Notice.

User-Generated Content Forums
If you submit comments, forum posts, responses, profile information or other user-generated content to public areas of the Services, that information may be visible to other users and the public. We may moderate, use, reproduce, publish and archive user-generated content in connection with the Services and related NEJM Group and MMS publications and offerings, subject to our terms and applicable law. Please do not include information in public areas that you do not want to be publicly available, including patient information or sensitive personal information.

Cross-Border Transfer of Your Information
The Services are headquartered in the United States. Your Personal Information may be transferred outside of your country of residence to the United States or another country for processing. For persons in the EU, EEA, and UK, please see Privacy Information for Users in the EU, EEA, and UK below.

Children
Our Services are intended for adult use only and are not directed towards children, minors, or anyone under the age of 18. If you are under 18, please do not provide us with personal information. If a parent or guardian believes that a child has provided us with personal information, they may contact us using the details below and we will take appropriate steps.

YOUR RIGHTS AND CHOICES

We are a not-for-profit entity and are exempt and/or do not meet the thresholds set forth in various state privacy laws. Therefore, we are not required to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and its amendments or other comprehensive state privacy laws. We do, however, take privacy issues seriously and while we may choose to offer you some rights regarding your Personal Information, those rights are not offered pursuant to CCPA or any other comprehensive state privacy laws and may be rescinded by us at any time.

Know: You may request to know the categories of Personal Information that we collected about you over the past 12 months, the categories of sources from which the Personal Information was collected, the business or commercial purposes for which the Personal Information was collected, sold, and shared, the categories of third parties with whom we share the Personal Information, and the specific pieces of personal information we collected about you.

Correct: You may request to correct inaccurate personal information that we maintain about you.

Delete: You may request that we delete Personal Information that we collected from you and retained, subject to certain exceptions.

Opt-Out of the Sale/Sharing: You may request to opt out of the future sale of your Personal Information. The law defines “sale” very broadly to include making data available to third parties in some cases. As noted above, we may share certain information with advertisers or social media sites. In doing so, we may make available or transfer your Personal Information (e.g., Identifiers and Contact Information) to Advertising Companies (e.g., advertising agencies, advertising servers, sponsored content providers, social media platforms, and other similar technology companies). Making such information available to third parties may constitute a “sale” or “sharing” of data. You may adjust your device or browser’s settings to limit how your online usage data and device data are shared with third parties or request to opt-out.

Limit the Use or Disclosure of Sensitive Personal Information: You may request that we limit the use of your Sensitive Personal Information to that which is necessary to perform Services or provide the goods you request.

Non-Discrimination: Unless permitted by applicable law, we will not discriminate against you for exercising any of your privacy rights under applicable law, including, but not limited to the following:

1. Denying you goods or services
2. Charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties
3. Providing you a different level of quality of goods or services
4. Suggesting that you will receive a different price or rate for goods or services or a different level of quality of goods or services

Making a Privacy Request: Only you or an authorized agent may make a verifiable consumer request related to your Personal Information. Each of these requests may be exercised by sending an email to dpo@mms.org

Designating a Third Party to Act on Your Behalf: In order to designate a third party to act on your behalf, that person must have valid written evidence of authority from you to act on your behalf, e.g., a validly executed Power of Attorney or some other written documentation that they can provide to us. Absent such documentation, we reserve the right to refuse to comply with third-party requests for information.

Verifying Your Requests: During the verification process, depending on the nature of your request, e.g., whether you are seeking access to information versus deleting information, we will first seek to verify your identity against known information in our environment, such as your name, e-mail address, and telephone. Upon receiving your request, we may also contact you via email and/or other secured communication channels to verify your identity. In certain instances, e.g., a mismatch against known information or where you are seeking information on behalf of another person with authorization, we may seek additional verification from you.

Response Timing and Format
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Exceptions: We may deny certain requests, in whole or in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or recordkeeping or to comply with legal obligations, to process transactions, perform continuing obligations, and facilitate requests.

CHANGES TO THIS POLICY

This Privacy Policy may be periodically updated. We will post a notice that this policy has been amended by revising the “Last updated” date at the top of this page. Use of a Service constitutes consent to any policy then in effect.

QUESTIONS ABOUT THIS POLICY

Please direct any questions regarding this privacy policy to our Data Protection Officer at dpo@mms.org.

NEJM Group offices are located at

NEJM Group
Attn: Data Protection Officer
860 Winter Street
Waltham, MA 02451 USA

PRIVACY INFORMATION FOR USERS IN THE EU, EEA, AND UK

For our users in the European Union and UK we are providing some additional information below as required by the EU General Data Protection Regulation (“GDPR”) and UK General Data Protection Regulations (together, “GDPR”).

Please make sure you also consult our general privacy policy above for complete information.

1. Controller
The data controller for the Services is Massachusetts Medical Society, 860 Winter Street, Waltham, MA 02451 USA.

2. Data Protection Officer
You can contact our Data Protection Officer at Attn: Data Protection Officer, Massachusetts Medical Society, 860 Winter Street, Waltham, MA 02451 USA.
Email: dpo@mms.org

3. Representative in the EU
Rickert Rechtsanwaltsgesellschaft mbH
-MMS-
Colmantstraße 15
53115 Bonn
Germany
art-27-rep-mms@rickert.law

4. Representative in the UK
Rickert Services Ltd UK
-MMS-
PO Box 1487
Peterborough
PE1 9XX
United Kingdom
art-27-rep-mms@rickert-services.uk

5. Additional Information about Processing of Personal Data
MMS will process your personal data only as it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (Art. 6 (1) (b) GDPR), on the basis of your express and voluntary consent (Art. 6 (1) (a) GDPR), in order to comply with a legal obligation to which MMS is subject (Art. 6 (1) (c) GDPR); see e.g. the “Compliance with Legal Process” section of our general privacy policy) or as otherwise permitted by applicable law.

Where we process special category personal data for GDPR purposes, we will do so only where an Article 9 condition applies. Depending on the context, this may include your explicit consent, processing necessary for reasons of substantial public interest where applicable under local law, processing necessary for scientific, historical research or statistical purposes subject to appropriate safeguards, or processing of information you have manifestly made public. We will provide further information at the point of collection where required.

5.1 Processing for or Prior to Entering into a Contract
In most cases processing of your personal data will be on this legal basis. For details on which categories of personal data, from which sources, and for which purposes your information may be collected and used in relation to which services or products offered by MMS, please refer to the general privacy policy above.

5.2 Processing on the Basis of Your Consent
In some situations, and for some Services or applications, we may ask you to provide express, voluntary consent as a basis for processing your personal information. For details on which categories of personal data, from which sources, and for which purposes your information may be collected and used in relation to which services or products offered by MMS, please refer to the information in the respective consent declaration and to the general privacy policy above.

You may at any time revoke a consent granted hereunder in accordance with GDPR. In case of revocation, MMS will not process the personal data subject to this consent any longer unless legally required to do so. However, any revocation of your consent has, by law, no effect on past processing of personal data by MMS up to the point in time of your revocation. Furthermore, if your use of a Service, requires your consent, MMS will no longer be able to provide the relevant Service to you after your revocation.

5.3 In Order to Comply with a Legal Obligation
In some cases, we have to process data to comply with a legal obligation to which we are subjected (see e.g., the “Compliance with Legal Process” section of our general privacy policy). In such cases our processing of such data will be restricted to what is required to fulfill our legal obligations.

Processing on the Basis of Our Legitimate Interests
In some cases, we process your personal data where it is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your interests, rights or freedoms. When we rely on legitimate interests, we consider the nature and impact of the processing and whether you would reasonably expect us to use your personal data in that way.

5.5 Lawful Basis
The table below sets out the main purposes for which we process personal data of users in the EU, EEA and UK, the categories of personal data involved, and the lawful bases (as explained in 5.1 – 5.4 above) on which we rely.

Purpose/activity	Categories of personal data	Lawful basis under GDPR
Providing subscriptions, accounts, access to content, purchases and customer support	Identifiers, Contact Information, Financial Information, Profile Data, Technical Information, Usage Data	Performance of a contract; legitimate interests in administering and improving the Services; legal obligation where applicable
Processing manuscripts, peer review, author/reviewer administration and publication-related activities	Identifiers, Contact Information, Profile Data, submitted materials, reviewer/author data, voluntary demographic data	Performance of contract or pre-contract steps; legitimate interests in managing editorial and publication processes; consent or Article 9 condition where special category data is processed
Providing continuing education, certificates, and credits	Identifiers, Contact Information, Profile Data, Usage Data, course/completion data, credentialing information	Performance of contract; legal obligation where applicable; legitimate interests in administering education services and reporting credits
Operating NEJM CareerCenter and related career services	Identifiers, Contact Information, CVs, cover letters, Profile Data, employment-related information	Performance of contract or pre-contract steps; legitimate interests in providing recruitment and career services
Sending service communications and responding to enquiries	Identifiers, Contact Information, account/service information	Performance of contract; legitimate interests in responding to users and administering the Services
Sending marketing communications, newsletters, surveys and offers	Identifiers, Contact Information, Marketing and Communications Information, Profile Data	Consent where required; legitimate interests where permitted by law, subject to opt-out rights
Personalising content, recommendations and user experience	Identifiers, Technical Information, Usage Data, Profile Data, Inference Data	Legitimate interests in providing relevant content and improving Services; consent where required, including where cookies or similar technologies are used
Analytics, measurement and service improvement	Technical Information, Usage Data, cookie identifiers, device identifiers, aggregated or pseudonymous data	Consent where required for cookies or similar technologies; legitimate interests for non-cookie analytics and internal improvement where lawful
Targeted advertising, sponsored content, list rental and social-media matched-audience advertising	Identifiers, Contact Information, Usage Data, Profile Data, advertising identifiers, pseudonymous audience data	Consent where required; legitimate interests where permitted by law and subject to opt-out; compliance with applicable direct marketing and ePrivacy rules
Security, fraud prevention, troubleshooting and enforcement of terms	Identifiers, Technical Information, Usage Data, account data	Legitimate interests in protecting the Services, users and business; legal obligation where applicable
Legal, regulatory, tax, accounting, reporting, disputes and claims	Relevant categories of personal data	Legal obligation; legitimate interests in managing legal and regulatory risk and establishing, exercising or defending legal claims
Business transactions and organisational restructuring	Relevant categories of personal data	Legitimate interests in managing corporate transactions and organisational changes

5.6 Aggregated Anonymous or Pseudonymous Use of Data
We may use aggregated, anonymised or pseudonymised data to maintain and improve our Services, understand usage, measure performance and deliver relevant content or advertising. Pseudonymised data remains personal data under GDPR where it can be attributed to an individual using additional information, and we treat it accordingly. Data that has been irreversibly anonymised so that individuals can no longer be identified is not personal data.Where these activities involve cookies or similar technologies, please see our Cookie Notice for further information and for details of how you can manage your choices.

5.7 Duration of Processing of Personal Data
Where MMS is processing and using your personal data as permitted by law (including in the context of a contract with you) or under your consent, MMS will store your personal data (i) only for as long as is reasonably required to fulfill the respective purposes (including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements), or (ii) until you revoke your consent (where consent is the basis we use to process your personal data). However, where MMS is required by mandatory law to retain your personal data longer or where your personal data is required for MMS to assert or defend against legal claims, MMS will retain your personal data, in accordance with applicable law, until the end of the relevant retention period or until the claims in question have been settled. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorized use or disclosure of your personal data; the purposes for which we process your personal data and whether we can achieve those purposes through other means; and the applicable legal, regulatory, tax, accounting, or other requirements.

5.8 Where will my personal data be processed?
MMS is a U.S.-based, internationally operating organization. Consequently, whenever MMS is using or otherwise processing your personal data for the purposes set out in its privacy policies, your data may be collected from, processed, or transferred to a country outside of the EU, UK, or European Economic Area (“EEA”).

Whenever we transfer your personal data out of the EU, UK, or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.

Where we use certain service providers, we may use specific contracts approved for use in the UK, EU, or EEA which give personal data the same protection it has in the EU, UK, or EEA.

These safeguards may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, an applicable adequacy decision, certification under the EU-US Data Privacy Framework and/or UK Extension where applicable, or another lawful transfer mechanism. You may contact us for further information about the transfer mechanism relevant to a particular transfer.

5.9 No Decisions Based Solely on Automated Processing (Art. 22 GDPR)
Our processing of your personal data does not involve decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

6. Data Subject’s Rights under GDPR

6.1 Data Access, Correction, and Deletion Right
You can request from MMS at any time information about which personal data MMS processes about you and the correction or deletion of such personal data.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Please note that MMS can delete your personal data only if there is no legal or contractual obligation or prevailing right of MMS to retain it. Please also note that if you request that MMS delete your personal data, you will not be able to continue to use a Service that requires MMS’s use of your personal data.

If MMS uses your personal data based on your consent or to perform a contract with you, you may further request from MMS a copy of the personal data that you have provided to MMS. In this case, please contact MMS’s Data Protection Officer and specify the information or processing activities to which your request relates, the format in which you would like this information, and whether the personal data is to be sent to you or another recipient. Please also provide reasonable information and evidence that permits MMS to know that the request originates from you as the data subject entitled to receive such personal information and that no one else is abusively trying to access your personal data by requesting a copy of it from MMS.

You can withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw consent.

Furthermore, you can request from MMS that MMS restrict your personal data from any further processing in any of the following events: (i) you state that the personal data MMS has about you is incorrect, (but only for as long as MMS requires to check the accuracy of the relevant personal data), (ii) there is no legal basis for MMS processing your personal data and you demand that MMS restricts your personal data from further processing, (iii) MMS no longer requires your personal data, but you claim that you require MMS to retain such data in order to claim or exercise legal rights or to defend against third party claims or (iv) in case you object to the processing of your personal data by MMS (based on MMS’s legitimate interest as further set out in Art. 6 (1) (f) GDPR) for as long as it is required to review as to whether MMS has a prevailing interest or legal obligation in processing your personal data.

You have an absolute right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to direct marketing. If you object, we will stop processing your personal data for those purposes.

6.2 Right to Lodge a Complaint
If you believe that MMS is not processing your personal data in accordance with applicable EU/EEA/UK data protection laws, you can at any time lodge a complaint with the data protection authority.

EU residents have the right to lodge a complaint with a data protection supervisory authority (‘DPA’), usually in the country or state where you work, normally live, or where any alleged infringement of data protection laws has occurred. Details of EU Member State DPAs and EEA DPAs can be found here: ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en#answer.

UK residents have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (ico.org.uk).