INEX Privacy Policy

Definitions

‘INEX’ means Internet Neutral Exchange Association Company Limited by Guarantee, registered in Ireland No. 253804.

The ‘GDPR’ means Regulation (EU) 2016/679 (General Data Protection Regulation).

An ‘IXP’ (Internet Exchange Point) is a network facility that enables the interconnection of more than two independent Autonomous Systems, primarily for the purpose of facilitating the exchange of Internet traffic.

The terms ‘Personal Data’, ‘Data Controller’ and ‘Data Subject’ are used in this document as they are defined in the GDPR.

Data Controller

Internet Neutral Exchange Association CLG is the Data Controller of all Personal Data that is stored by INEX.

What Personal Data INEX Holds

INEX stores the following categories of Personal Data:

• IXP Manager login account information – email address, name, phone number, login records
• Mailing lists – email address, name
• Electronic Mail – email address, name
• Support management system – email address, name
• Web site logs – IP address, time, url visited
• Email logs – email address, time
• Conference attendee lists – email address, name, attendance
• Customer relationship management – email address, name, phone number
• General Meeting voter information – email address, name
• Board member and board candidate information – personal details as required by
  law

All this data is held either by explicit permission from the individual, or for performance of a contract, or compliance with legal obligations.

This Personal Data is subject to the rights listed below.

What INEX uses Personal Data for

INEX uses Personal Data for the following purposes:

• To provide Internet Exchange and other services to its member organisations
• To provide community support for IXP Manager users and other IXP operators
• To enhance the security of its services
• Administrative purposes (billing, contract management)
• Sales and marketing
• To comply with laws and regulations
• To enable member representatives to vote at General Meetings using online voting

Who Has Access to this Personal Data?

Employees, contractors, service providers and legal or other professional advisers to INEX may be given access to Personal Data held by INEX. This is required to fulfil INEX’s obligations of service and support to its membership and support to users of INEX services.

Some INEX mailing list archives are published on the INEX web site. All subscribers of these mailing lists are notified during the subscription process that anything they post will be made public.

INEX may provide Personal Data to Government authorities, regulatory authorities, law enforcement bodies, the Courts Service of Ireland or the Board of Directors of INEX for the purposes of compliance with legal requirements, or for the exercise or defence of legal claims.

Security of Personal Data

INEX has strict security procedures for storing Personal Data to protect it against loss or damage. All Personal Data stored by INEX is protected by TLS (Transport Layer Security) and firewalls.

INEX may disclose Personal Data to its agents or subcontractors for the purposes set out in this privacy policy. We require all our agents and subcontractors to have appropriate technical and operational security measures in place to protect your personal data, in line with Irish and EU legislation.

INEX requires all agents and subcontractors outside the European Economic Area (EEA) to sign a data processor agreement which provides protection of Personal Data at least equivalent to that provided for by the GDPR.

INEX does not store or process Childrens’ Data.

Retention of Data

INEX deletes or pseudonymises IXP Manager login records, WWW logs and email logs after 6 months.

INEX maintains backups of all data systems and maintains these backups for no more than 13 months.

Rights to Your Personal Data

Data Subjects have the following rights in relation to Personal Data stored by INEX:

• Right of access – you have the right to request a copy of the data that we hold about you.
• Right of rectification – you have the right to request INEX to correct any inaccurate or incomplete Personal Data that INEX holds about you.
• Right to be forgotten – in many situations, you have the right for your personal data to be deleted from our records. There may be situations where INEX is unable to comply with an erasure request, in particular where INEX is required to continue to hold certain Personal Data due to legal obligations or where holding the Personal Data is necessary for the exercise or defence of legal claims, or where it is impossible or unreasonably difficult to remove your personal data.
• Right of restriction – this means that your personal data may, with the exception of storage, only be processed with your consent for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of public interest of the EU or of an EU Member State.
• Right of portability – you have the right to receive your personal data in structured, commonly used and machine-readable formats, or have the data we hold about you transferred to another data controller.
• Right to object – you have the right to object to the processing of your Personal Data in certain circumstances. You also have the absolute right to stop your data from being used for direct marketing.
• Right to object to automated processing – you have the right not to be subject to decisions based solely on automated processing, including profiling.
• Right to judicial remedy – you have the right to an effective judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR.

IXP Traffic

An IXP is a traffic clearing-house. This means that all data transmitted to INEX IXP peering networks is either forwarded to its destination network or else dropped. Traffic data on the IXP is neither stored nor processed under the definition of these terms in the GDPR.

Changes to Privacy Policy

Our Privacy Policy may be updated from time to time. Any changes to our policy will be communicated to you either by e-mail or a notice on our website.

Contact information

All communications concerning privacy related issues should be sent by electronic mail to privacy@inex.ie or by post to Internet Neutral Exchange Association CLG, 4027 Kingswood Road, Citywest Business Campus, Dublin D24 AX06, Ireland.

INEX will respond to and, where appropriate, act on privacy-related communications within one calendar month.

This privacy policy was last updated in June, 2020