Last updated: 8 October 2026
This policy explains what personal data the WAMCA Global sites collect, why, who receives it, how long we keep it and what rights you have.
1. Who we are
WAMCA Global is run by UnionX Sphere Federation OÜ, a company registered in Estonia (registry code 17455822, Vesivärava tn 50, 10152 Tallinn, Estonia). We are the controller of the personal data described in this policy, which means we decide why and how it is used.
Write to privacy@wamcaglobal.org with any question about your data or to use any of your rights. We have not appointed a data protection officer, because the processing we do does not require one.
The same company also runs WABBA Global (wabbaglobal.org, the B2B Exchange and B2B Platform marketplaces, and the WABBA Global dashboard and candidate portal). Those sites have their own privacy policy at https://wabbaglobal.org/privacy/.
2. Which sites this policy covers
This policy covers wamcaglobal.org, the site of the World Accredited Manufacturing Companies Association (WAMCA), and the sites of its nine industry associations. WAMCA and the nine associations are brands of one organisation, not separate legal entities, so the same controller and the same policy apply to all of them:
| Association | Site |
|---|---|
| Automotive Industry & Components Manufacturers’ Association (AICMA) | aicma-association.org |
| Agricultural Products Manufacturers Association (APMA) | apma-association.org |
| Chemical Manufacturers Association (CMA) | cma-association.org |
| Construction Materials Manufacturers Association (CMMA) | cmma-association.org |
| Equipment & Machinery Manufacturers’ Association (EMMA) | emma-association.org |
| Food & Beverage Industry Association (FBIA) | fbia-association.org |
| Metal Products Manufacturers Association (MPMA) | mpma-association.org |
| Pharmaceutical & Health Technology Industry Association (PHTIA) | phtia-association.org |
| Textile & Apparel Manufacturers’ Association (TAMA) | tama-association.org |
3. What we collect and why
Each part below says what we collect, what we use it for and the legal basis for doing so under the General Data Protection Regulation (GDPR).
When you visit any of our sites
Our hosting provider’s web servers record technical data about each request: your IP address, browser type, the page requested and the time. We use it to deliver the pages and keep the sites secure. Legal basis: our legitimate interest in running secure sites (Art. 6(1)(f)).
The sites have no contact forms, no newsletter sign-up, no comments and no visitor analytics. We will update this policy before any of these is added.
When you write to us or call us
If you e-mail or phone WAMCA or one of the associations, we receive your name, your contact details and whatever you tell us, and we use them to answer you. Legal basis: our legitimate interest in answering enquiries (Art. 6(1)(f)), or steps you ask us to take before a contract (Art. 6(1)(b)).
When you join an association
The sites do not take membership applications yet. If you write to us about joining, we handle your message as described above. Before applications open, this policy will be updated to say what an application and a membership hold and how long we keep them.
Running the sites
Our staff sign in to edit the sites. A security log records the changes signed-in users make, with their IP addresses, so we can trace mistakes and misuse. Legal basis: our legitimate interest in keeping the sites secure (Art. 6(1)(f)).
4. Who receives your data
We do not sell personal data. We share it only with the service providers below, who process it for us under a data processing agreement unless the table says otherwise. We may also disclose data when the law requires it, or to establish or defend a legal claim.
| Provider | What they do for us | Where the data is |
|---|---|---|
| Zone Media OÜ (Zone.ee) | Hosts the sites and our e-mail. | Estonia |
| nopress.io (SAMPO SEPP OÜ) | Backs up the sites every hour, encrypted. | Amsterdam, Netherlands |
Our pages also load fonts, icons and a font-loading script from Google and Fonticons, and profile pictures from Gravatar. Those companies receive your IP address and browser details when your browser fetches the files; see the Cookie Policy.
5. How long we keep it
We keep personal data only as long as its purpose needs, or as long as the law requires. The periods below are the longest we keep each kind of data.
| Data | How long |
|---|---|
| E-mails and enquiries | 24 months after our last exchange, unless you become a member or client |
| Invoices and accounting records | 7 years, as the Estonian Accounting Act requires |
| Web server logs | About a week: the hosting provider rotates them daily and keeps the last few days |
| Security log of editors’ changes | 3 months |
| Backups | Hourly copies 7 days, daily copies 30 days, copies made by hand or before an update 180 days |
6. Cookies
Our sites use cookies and similar browser storage. Our Cookie Policy lists each one, what it does and how long it lasts.
In short: visitors get no cookies from our sites. Only our staff receive sign-in cookies when they edit a site.
7. Transfers outside the European Economic Area
We keep data in the European Economic Area (EEA) wherever we can choose where it is held. When a provider receives data outside the EEA, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified under it, and otherwise by the European Commission’s Standard Contractual Clauses. Write to us for a copy of the safeguard that covers a particular transfer.
Our sites and our e-mail are hosted in Estonia. The only data that leaves the EEA is the technical data your browser sends when it loads fonts, icons and a font-loading script from Google and Fonticons, and profile pictures from Gravatar (Automattic), all in the United States. Those companies receive it under their own terms and privacy policies. We plan to serve these files from our own server, so that nothing leaves the EEA, and will update this policy when we do.
8. Your rights
Under the GDPR you have the following rights.
- Access (Art. 15). You can ask whether we process personal data about you and, if we do, get a copy of it, together with the purposes, the kinds of data, the recipients, how long we keep it, where it came from if not from you, and your other rights.
- Rectification (Art. 16). You can have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17). You can have your data erased when it is no longer needed for the purpose we collected it for; when you withdraw the consent the processing was based on and there is no other basis; when you object and we have no overriding legitimate grounds, or you object to direct marketing; when it was processed unlawfully; or when the law requires us to erase it. We may keep data we need to meet a legal obligation, such as accounting records, or to establish, exercise or defend legal claims.
- Restriction (Art. 18). You can have us only store your data and not otherwise use it: while we check its accuracy after you contest it; when the processing is unlawful and you prefer restriction to erasure; when we no longer need the data but you need it to establish, exercise or defend a legal claim; or while we check whether our legitimate grounds override your objection.
- Notification (Art. 19). We tell everyone we have disclosed your data to about any rectification, erasure or restriction, unless that is impossible or would take disproportionate effort, and we tell you who they are if you ask.
- Portability (Art. 20). For data you gave us that we process by automated means on the basis of your consent or a contract, you can receive it in a structured, commonly used, machine-readable format, and have it sent directly to another controller where that is technically possible.
- Objection (Art. 21). You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time, without giving a reason, and we then stop using your data for it.
- Withdrawing consent (Art. 7(3)). Where we rely on your consent, you can withdraw it at any time. That does not affect what we did before.
Write to privacy@wamcaglobal.org. Using your rights is free. We may ask you to confirm your identity, and we answer within one month. If a request is complex we may take up to two more months and will tell you why.
What you have to give us. No law requires you to give us personal data, and you can use the sites without giving any. When you write to us, we need your e-mail address to answer.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, https://www.aki.ee, or to the data protection authority where you live or work.
9. How we protect it
Only the people who need personal data for their work can reach it. Every connection to our sites is encrypted (HTTPS).
Each editor signs in with a personal account, and a security log records the changes they make.
10. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
11. Children
Our sites are for adults. They are not directed at children, and we do not knowingly collect personal data about anyone under 18. If you think a child has given us personal data, write to us and we will delete it.
12. Changes to this policy
We update this policy when our services or the law change. The date at the top shows the last change. If a change affects how we use data we already hold about you, we will tell you before it takes effect, by e-mail where we have your address.
13. Contact
UnionX Sphere Federation OÜ, Vesivärava tn 50, 10152 Tallinn, Estonia.
E-mail: privacy@wamcaglobal.org