How We Process Your Data (Jotform & Google Drive Integration)

 

To manage our high school exchange program efficiently and securely, the Global Outreach Program utilizes cloud-based third-party processors to collect and store student application materials, including personal identifiers and special category health data.

 

1. Data Collection and Transmission (Jotform)

When you submit an application, health form, or inquiry through our website, your data is captured via Jotform Inc.

• Data Residency: All data captured via our forms is explicitly routed to and stored on secure servers located within the European Union (Frankfurt, Germany) to comply with GDPR data residency standards.

• Security Measures: Data transmitted from your browser to Jotform is encrypted in transit using 256-bit Secure Sockets Layer (SSL) encryption.

 

2. Data Storage and Management (Google Drive)

Once an application is submitted, our system securely replicates and transfers these files to Google Workspace (Google Drive) via an automated API integration. Google acts as our data processor under an executed Cloud Data Processing Addendum (CDPA).

• Access Control: Access to student folders within Google Drive is strictly restricted using the principle of least privilege. Only authorized National and Regional Coordinators of the Global Outreach Program who require this data for student placement and safety are granted access.

• Security Controls: All staff and volunteers accessing these folders are required to use Multi-Factor Authentication (2-Step Verification). Downloading, printing, or copying files containing sensitive medical data is restricted to prevent local, unauthorized data leakage.

 

3. Processing Special Category Data (Health & Medical Records)

As an exchange program involving minors, we must process sensitive health information (such as vaccination records, medical history, and dietary restrictions) to ensure student safety, obtain medical insurance, and finalize school placements.

• We process this data only when we have obtained your explicit, affirmative consent via our application forms.

• This data is isolated from standard marketing data and is never shared with third parties outside of verified host families, schools, and insurance providers essential to the student's exchange program.

 

4. Data Retention and Your Right to Be Forgotten

We do not store personal or health data longer than is necessary to fulfill the purposes of the exchange program and meet our legal or financial archiving obligations in the United States.

• Under the GDPR, EU residents have the Right to Erasure (The Right to Be Forgotten).

• Upon a valid deletion request, the Global Outreach Program will permanently purge your data from both our Jotform production servers and our Google Drive storage within 30 days, provided there are no overriding legal requirements to retain it.