1. Data Protection Principles

NMA is committed to processing data in accordance with its responsibilities under Swiss law and GDPR when applicable. Personal data shall be:

• Processed lawfully, fairly, and transparently.

• Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

• Adequate, relevant, and limited to what is necessary for the intended purposes.

• Accurate and kept up to date; inaccurate data shall be rectified or erased without delay.

• Retained only as long as necessary for the purposes specified, with provisions for archiving where applicable.

• Processed in a manner ensuring appropriate security.

​

2. General Provisions

This policy applies to all personal data processed by NMA. The Responsible Person ensures ongoing compliance, with policy reviews at least annually.

​

3. Lawful, Fair, and Transparent Processing

NMA maintains a Register of Systems to ensure processing is lawful, fair, and transparent. The register is reviewed annually. Individuals have the right to access their personal data promptly.

​

4. Lawful Purposes

All data processed by NMA must have a lawful basis: consent, contract, legal obligation, vital interests, public task, or legitimate interests. The appropriate basis is noted in the Register of Systems. Consent-based processing requires opt-in evidence and mechanisms for consent withdrawal.

​

5. Data Minimisation

Personal data processed by NMA is adequate, relevant, and limited to what is necessary for its purposes.

 

6. Accuracy

NMA takes reasonable steps to ensure personal data accuracy and updates where necessary.

 

7. Archiving and Removal

NMA implements an archiving policy for personal data, reviewed annually, determining retention periods and reasons for retention.