Privacy Notice

The Association of Trainees Alumni (“The Bubble”, “we”, “us” or “our”) operates this website (the “Website”) and is committed to respecting and protecting the privacy of our members and users (“you”, “your”).

We act as the Data Controller for any Personal Data you provide under this Privacy Notice (the “Notice”). This Notice explains how and why we process Personal Data and the rights you have under applicable data-protection legislation, including Regulation (EU) 2016/679 (GDPR).

The Bubble is a non-profit association established in Belgium. Our registered address is Rue de Venise 42, 1050 Brussels, Belgium and our enterprise number is 1032913210.

For any question about this Notice, about how we handle Personal Data, or to exercise any of the rights described in section 12, please email:

Please clearly indicate the nature of your request.

Requests are handled by the members of the Committee responsible for data protection.

We encourage all users to read this Notice carefully to understand how we handle Personal Data.

The terms Data Controller, Personal Data, Processing, Processor and related terms have the meaning given in the GDPR and other applicable EU data-protection laws.

Alumni refer to individuals who previously completed traineeships in EU institutions, bodies or agencies and participate in The Bubble alumni network.

Alumni network is the professional and social network operated by The Bubble, including online platforms (e.g., LinkedIn groups) and events.

The Association refers to the Association of Trainees Alumni, “The Bubble”.

Committee is the governing and volunteer body managing the activities of The Bubble.

A Member is any person registered with The Bubble or participating in its activities.

A User is any person interacting with the Association and required to provide Personal Data for participation in activities.

Personal Data means any information that can identify you directly or indirectly, such as your name, email address, professional details, or event participation data.

We process Personal Data so that you can participate in The Bubble’s activities and services, including:

We rely on the following legal bases under Article 6 GDPR:

Providing Personal Data is not a statutory requirement, but it is necessary to:

If you do not provide the required Personal Data, we may be unable to provide membership services, consider a volunteer application, reply to your message, or arrange event participation.

We may contact members regarding events, newsletters, and association updates based on your consent. You may withdraw consent at any time by contacting us at the address in section 1.

If you write to us through the contact form on this Website, we ask for:

Before you send, we ask you to confirm that you understand how we will use these details. We rely on our legitimate interest in receiving and replying to the messages people send us.

Your message is delivered by email, through our email provider Resend, to our mailbox on Google Workspace. It is not stored on this Website. Access to that mailbox is limited to the Committee members who handle enquiries.

We use these details only to reply to you and to deal with your enquiry. The same applies if you write to us directly by email.

If you apply to volunteer with us through this Website, we ask for the following:

Volunteer roles at The Bubble are open to people aged 18 and over, so we ask you to confirm your age before the application form is shown. If you indicate that you are under 18, the form is not shown and nothing at all is collected or stored — we simply invite you to write to us if you would like to ask about other ways to take part.

Completed applications are stored in a spreadsheet hosted on Google Workspace, together with the date of submission and a reference number. Access is limited to the Committee members involved in volunteer recruitment.

When an application arrives we send ourselves a short notification by email. That notification deliberately contains no information from your application — not your name, not your email address and not your answers. Applications are read in the spreadsheet, never in an inbox.

We use your answers only to assess your application, to contact you about it, and to discuss which team would suit you best. We do not use them for any other purpose, and we do not share them outside the Committee.

Volunteer roles are open to people aged 18 and over, and we ask you to confirm this before the application form is shown.

Our website is intended for adults, and our contact form is not aimed at children. We do not knowingly collect Personal Data from anyone under the age of 13. If you are under 13, please ask a parent or guardian to contact us on your behalf.

If you believe that a child has provided us with Personal Data, please contact us at the address in section 1 and we will delete it.

This Website does not use analytics or tracking tools, and it does not set cookies or store identifiers on your device.

The typefaces used on this Website are served from our own domain rather than from a third party, so opening a page does not disclose your IP address to a font provider.

Like any website, this one cannot be delivered without some technical information about each visit. Our hosting provider, Vercel, automatically records it in its server logs — for example your IP address, the type of browser and device you use, the page you asked for and when. These logs are used only to deliver the Website, keep it secure and fix it when something goes wrong, which is our legitimate interest. We do not use them to identify you or to build profiles of visitors. Section 9 explains how long they are kept.

We keep Personal Data only for as long as it is needed for the purpose it was collected for, and delete it afterwards. In practice:

Where the law requires us to keep information for longer, we do so and delete it once that obligation ends.

We may share Personal Data with selected third parties, including:

We rely on the following service providers, which process Personal Data on our instructions as our Processors:

Google and Resend are each bound by a data processing agreement limiting them to processing Personal Data on our instructions. Vercel processes the server logs described in section 8 under its own terms of service and privacy policy.

Event partners and sponsors who receive Personal Data for a specific event are required to delete it once that event has ended.

Some links on this Website take you to services operated by others — event registration forms and calendar invitations hosted by Google, and our profiles on LinkedIn and Instagram. Once you follow such a link, that provider processes your data under its own privacy notice, not this one.

Some of the service providers named in section 10 are established in, or belong to groups established in, the United States. Personal Data you give us may therefore be transferred outside the EU/EEA.

Where that happens, we rely on one or both of the following safeguards under Chapter V GDPR:

Google, Resend and Vercel are each certified under the EU–US Data Privacy Framework. Resend’s data processing agreement additionally incorporates the European Commission’s Standard Contractual Clauses, and Google’s applies them to transfers to countries other than the United States.

You may ask us for more information about these safeguards by writing to the address in section 1.

Under data-protection law, you may have the right to:

Your right to object. Where we rely on our legitimate interests — to reply to your messages, to keep the Website secure, and for the server logs described in section 8 — you may object at any time, on grounds relating to your particular situation. Where we send you newsletters or other association communications, you may object at any time and without giving a reason, and we will stop.

These rights are not absolute and may be subject to legal limitations.

To exercise your rights, write to us at the address in section 1. We will respond within one month, and will tell you if we need longer.

We implement appropriate technical and organisational measures to protect Personal Data from unauthorised access, loss, or misuse.

Personal Data may be stored:

Access to volunteer applications and to messages sent through the contact form is limited to the Committee members who need it for the purposes described above.

Our web forms carry automated anti-spam measures, and submissions identified as automated are discarded rather than stored.

We regularly review our security practices to maintain appropriate protection levels.

If you have concerns about how we handle your Personal Data, please contact us at the address in section 1.

You also have the right to lodge a complaint with a national Data Protection Authority within the EU. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels.

We do not use Personal Data for automated decision-making or profiling that produces legal or similarly significant effects.

The only automated steps in our web forms are a check that you have confirmed you are 18 or over before a volunteer application is accepted, and the anti-spam measures described in section 13. Neither builds a profile of you, and you are always welcome to write to us instead.

We may update this Privacy Notice from time to time. The date shown at the top of this Notice indicates when it was last changed.

If we make significant changes — in particular, if we start using your Personal Data for a new purpose — we will tell you by email or through our usual communication channels before the change takes effect.

We encourage you to review this Notice periodically.