WHAT INFORMATION DOES GAVI COLLECT?
Normal website usage
In general, you can browse the Gavi website without telling us who you are or revealing any personal information. The only information we gather during general browsing is from standard server logs. These include your Internet Protocol (IP) address, domain name, browser type and operating system, and information such as the website that referred you to us, the files you download, the web pages you visit, and the dates and times of those visits.
Collection of personally identifiable information
If you register for a newsletter, log on to certain Gavi sites, provide feedback or apply for a job, you will be asked to provide personal information such as your name, postal address and e-mail address. This information is collected only with your knowledge and permission, and is kept in various Gavi databases and mailing lists
Gavi sites with specific requirements to collect personal information may publish a privacy notice specific for that site. In these cases, the site-specific notices will be complementary to this general Gavi privacy notice and will give additional details for that particular site.
For certain Gavi sites, registering or supplying personal information sets a cookie (see below). By doing this, Gavi will remember your details the next time you visit, so you do not have to re-enter the information. This helps us to provide you with a better service.
WHAT DOES GAVI DO WITH THE INFORMATION IT COLLECTS?
Normal website usage
The information gathered during general browsing of the Gavi sites is used to analyse trends and usage of the sites and to improve their usefulness. It is not connected with any personal information.
Personally identifiable information
Gavi may use the personal information you provide to:
- contact you – either in response to a query or suggestion, or to send newsletters, documents, publications, etc. to you;
- manage and process your job application in line with our recruitment obligations – for example, processing data to obtain references, or to carry out criminal and background checks;
- “remember” your online profile and preferences; and
- conduct statistical analysis to improve our site, optimise your experience and monitor usage of the Gavi website. This data cannot be used to identify individuals. All information collected for this purpose is aggregated.
WHAT IF I DO NOT WANT TO PROVIDE PERSONAL INFORMATION?
Providing personal information on the Gavi sites is optional. If you choose not to provide personal information, you can still browse and use the sites, but you will not be able to carry out certain actions such as subscribe to a newsletter or apply for a job.
REQUESTS CONCERNING YOUR PERSONAL DATA
When you share your personal data with us through Gavi's sites, you are entitled to make requests concerning your data. This can be done bycontacting us via email at dataprotection@gavi.org. Please review the list below, and include the type of request in the Subject line of your email.
- Access request: Individuals can make a request for access to their personal data. This allows them to review and verify the accuracy and lawfulness of the information held by Gavi.
- Rectification request: Individuals can request rectification of any inaccuracies in their personal data. This ensures completeness and correctness, maintaining the accuracy of the information.
- Erasure request: Individuals can request the deletion of their personal data. This request will be processed without undue delay.
COOKIES
Cookies are small pieces of information sent by the website to your browser. They are stored on your device to allow that website to recognise you when you visit it again. Gavi uses cookies for its own internal purposes, to track how users navigate through our website. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer.
The “Help” or “Internet Settings” functions within your browser should tell you how. Please be aware that opting to refuse or restrict cookies may impact the functionality of our website. You can find more information about cookies at http://www.allaboutcookies.org/.
Necessary cookies
These cookies are essential for our website to function and cannot be rejected via our website’s cookie notice. If you block or delete these cookies using other means, such as via your website browser or a browser add-on, our website may not work correctly for you.
Examples of essential cookies:
| Cookie name | Expiration | Type | Purpose |
|---|
| JSESSIONID | Session | Third party | Used by our website monitoring tool to maintain user session state. |
| cookie-agreed | 100 days | First party | Used by the EU Cookie Compliance module to store user cookie preferences. |
| cookie-agreed-version | 100 days | First party | Used by the EU Cookie Compliance module to store user cookie preferences. |
| cookie-agreed-categories | 100 days | First party | Used by the EU Cookie Compliance module to store user cookie preferences. |
Performance cookies:
In general, performance cookies collect anonymous information about how visitors use our website, for instance which pages visitors go to most often. This helps us to analyse data about webpage traffic and improve our sites in order to tailor to visitor needs. We only use this information for statistical analysis purposes; these cookies cannot be used to identify individuals. All information collected by these cookies is aggregated.
Examples of analytics cookies:
Google Analytics
Google Analytics is a statistical reporting tool used widely across the web. The following cookies may be set by Google Analytics:
| Cookie name | Expiration | Type | Purpose |
|---|
| _ga | 2 years | First party | Used by Google Analytics 4 and Google Universal Analytics to distinguish users. |
| _ga_<container-id> | 2 years | First party | Used by Google Analytics 4 to persist session state. |
| _gid | 24 hours | First party | Used by Google Universal Analytics to distinguish users. |
| _gat | 1 minute | First party | Used by Google Universal Analytics to throttle request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named _dc_gtm_<property- id>. |
| AMP_TOKEN | 30 seconds to 1 year | First party | Used by Google Universal Analytics. |
We implement some additional features which combine data via Google Analytics (first-party) and Google Ads (third-party) cookies. These features are called “Remarketing with Google Analytics” and “Google Analytics Demographics and Interest Reporting”.
This works by retrieving basic demographic and content interest data via Google Ads (third-party) cookies, for users who have consented to Ads personalisation with Google. Via a service called Google Signals, we link this to individual-user behaviour tracked via the Google Analytics (first-party) cookie. The resultant user profiling is made available, in aggregate, within Google Analytics reports. These are estimations of user attributes based on Google Ad behaviour and are not personally identifiable data. To further protect user privacy, we cannot report demographic and interest data at the individual level: there is a threshold of at least seven users before summary information may be shown in any Google Analytics report.
We may also use this connection between Google Analytics and Google Ads identifiers in order to serve more relevant ads to users who have visited the website, i.e. for remarketing purposes.
To opt out of these additional features, users may reject cookies via our website cookie notice, and therefore prevent Google Analytics cookies from being set.
Alternatively, users may also manage their own cookie settings in their browser; manage their advertising preferences within their Google account; or use the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) to prevent themselves from being tracked in this way.
More information about Google Analytics Advertising Features can be found here: https://support.google.com/analytics/answer/2700409?hl=en-GB
Hotjar
Hotjar is an anonymous session recording and heatmap tool used widely across the web. The following cookies may be set by Hotjar (list not exhaustive):
| Cookie name | Expiration | Type | Purpose |
|---|
| _hjSessionUser_{site_id} | 1 year | First party | Persists the Hotjar User ID which is unique to that site. |
| _hjFirstSeen | Session | First party | Identifies a new user’s first session. |
| _hjSession_{site_id} | 30 minutes | First party | Ensures subsequent requests in the session window are attributed to the same session. |
| _hjAbsoluteSessionInProgress | 30 minutes | First party | Used to detect the first pageview session of a user. |
| _hjIncludedInPageviewSample | 30 minutes | First party | Set to determine if a user is included in the data sampling defined by your site's pageview limit. |
| _hjIncludedInSessionSample | 30 minutes | First party | Set to determine if a user is included in the data sampling defined by your site's daily session limit. |
Targeting cookies
These cookies help us to collect anonymous data about how users interact with our website and connect this to digital marketing and advertising campaigns on other platforms. This information helps us to evaluate marketing and advertising performance and make improvements.
These cookies can be optionally accepted via our website’s cookie notice. They will not be set on your device until you consent to them.
All information these cookies collect is aggregated and anonymous: we do not collect or send any personally identifiable information via these cookies.
Examples of targeting cookies:
Meta (formerly Facebook)
Meta is a technology company. We use the Meta/Facebook tracking pixel on our website. This allows us to evaluate the performance of our posts or ads. The following cookies may be set by Meta/Facebook (list not exhaustive):
| Cookie name | Expiration | Type | Purpose |
|---|
| _fbp | 90 days | First party | Randomly generated, unique identifier for Facebook pixel. |
| datr | 13 months | Third party | Used by Facebook. |
| sb | 1 year | Third party | Used by Facebook. |
| dpr | 1 week | Third party | Used by Facebook. |
| wd | 1 week | Third party | Used by Facebook. |
| usida | Session | Third party | Used by Facebook. |
LinkedIn
LinkedIn is a professional network. We use the LinkedIn tracking pixel on our website. This allows us to evaluate the performance of our posts or ads. The following cookies may be set by LinkedIn (list not exhaustive):
| Cookie name | Expiration | Type | Purpose |
|---|
| bscookie | 1 year | Third party | Used by LinkedIn. |
| bcookie | 1 year | Third party | Used by LinkedIn. |
| li_gc | 6 months | Third party | Used by LinkedIn. |
| AnalyticsSyncHistory | 1 month | Third party | Used by LinkedIn. |
| UserMatchHistory | 1 month | Third party | Used by LinkedIn. |
| lidc | 1 day | Third party | Used by LinkedIn. |
| lang | Session | Third party | Used by LinkedIn. |
Cookies from embedded (third-party) services
We use various third-party services or software embedded on our website.
If you visit a page on our website that contains such content, such as YouTube and Vimeo videos, Google Maps, content posted on Facebook and Twitter, the ShareThis social sharing module, or reCAPTCHA for forms, cookies may be set on your device from these services.
We do not control the setting of these cookies, and so you may not be able to reject them via our cookie notice. We therefore suggest that you check the third-party website for more information about their cookies and how to manage them, or use a browser add-on to help you block them if desired.
Examples of cookies from embedded services (list not exhaustive):
| Cookie name | Expiration | Type | Purpose |
|---|
| _GRECAPTCHA | 6 months | Third party | Used by the Google reCAPTCHA service, which helps us to filter out spam traffic from web forms. |
| VISITOR_INFO1_LIVE | 6 months | Third party | Used by YouTube embedded videos. |
| YSC | Session | Third party | Used by YouTube embedded videos. |
| __stidv | 1 month | Third party | Used by ShareThis social sharing module. |
| __stid | 1 month | Third party | Used by ShareThis social sharing module. |
SECURITY AND RETENTION
We do not sell any personally identifiable information volunteered on the Gavi sites to any third party. We will not use the data shared by users of the Gavi sites in ways other than as set forth in this privacy notice, or any site-specific notices, or in ways to which you have not explicitly consented.
Gavi maintains appropriate precautions and technical measures to protect against any loss, misuse, unauthorised access, disclosure, alteration or destruction of your personal information, in line with internationally recognised standards.
All our staff who have access to, and are associated with, the processing of personal data are obliged to respect the confidentiality of official business matters, including personal data.
The Gavi sites contain links to sites external to the Gavi sites. Gavi is not responsible for the privacy practices or the content of such sites.
Gavi maintains internal procedures to manage the retention of its data. We do not retain your personal data for longer than is necessary to fulfil the purposes for its collection. As such, retention periods may vary depending on the different reasons for the collection of data, and the type of data concerned.
NOTIFICATION OF CHANGES
Changes to this privacy notice will be posted on this webpage on the Gavi.org website.
PRIVILEGES AND IMMUNITIES
Nothing in or related to this privacy notice shall be deemed a waiver, express or implied, of any of the privileges and immunities of Gavi.
For any questions or queries regarding this privacy notice, please email dataprotection@gavi.org.
