PRIVACY · 26 SEPTEMBER 2026

Your data.

This notice covers the public website, membership applications, accounts, experiences and posts shared between members.

Who is responsible

Andrea Centurione, based in Italy, is the data controller for MBA Society.

Contact us about privacy at info@mba-society.com. You can make a request whether or not you have an account or have been admitted.

What we collect, and why

Account and application. First name, last name, email and account identifier; your application also includes your date of birth, business school, MBA status, graduation year, city and country, optional referral details and membership status. We use these to provide your account, save your draft and assess your application. Your date of birth is kept with your private application and is not shown to members. Fields marked optional, including LinkedIn and referral details, can be left blank. New membership requests do not ask for written answers or a CV. Answers and CVs supplied under the earlier application process remain subject to the access and retention rules below.
Member profiles. After admission, your photo, full name, business school, MBA status and year, city, introduction and interests. We use these to help members get to know the people they may meet. You review and save this information before it becomes visible to other admitted members. Photos are resized and their embedded metadata is removed.
Experiences. Private proposal drafts, plans you publish, dates, destination, meeting point, costs, any previously shared contact details, requests to join and participation decisions. We save your proposal draft to your account so you can resume it across devices, then publish the plan when you choose. We use participation details to let hosts organise their groups.
Social profiles. You may share optional links to Instagram or another social profile alongside LinkedIn. Only authorised membership reviewers can access these links in your application; they are not added to your member profile. Reviewers may consult the profiles you share to understand your background. We do not connect to your accounts, request your passwords or import your contacts or posts. Instagram and other additional social links are removed when closed applications are minimised after 90 days.
Professional details. Your optional role and company help authorised reviewers understand your background. These application fields are not published on your member profile and are removed when closed applications are minimised after 90 days.
Referrals. The name and email of the person an applicant says referred them, supplied by the applicant. These optional details give reviewers context; they are not treated as a verified endorsement. Please provide them only with that person’s permission. Invitations you choose to share contain your name and account email. We do not access your address book or send invitations automatically.
Event chats. Messages, author name, sending time, read position, mute preferences and reports. We use these to let confirmed groups coordinate, show unread messages and review reported content. Notifications appear inside the app; chat messages are not emailed.
Discover and Careers. Events you recommend, their dates and official links, and career posts describing a role you offer or seek, location and the contact details you choose to publish. We use these to share your posts with admitted members and let them contact you or arrange to attend an event together.
Ask the Society. Requests, replies, optional location, author account, name, anonymity choice, resolution status and reports. We use these to let admitted members ask for help, answer and flag content for review. We do not send board posts or replies by email.
Personal notifications. Unread replies to your requests, participation requests for experiences you host, decisions on your own participation requests and unread event chats. We store which updates you have read so these indicators remain consistent across devices. Notifications are shown inside your account. We also email you when your membership is approved, when a host confirms your participation, and around 24 hours before an experience you host or have joined. Members accepted less than 24 hours before an event receive the confirmation without an additional immediate reminder. Chat messages and board replies are not emailed; browser push notifications are not enabled.
Privacy requests and administrator actions. Account-linked requests, their type, dates, status and response, plus a limited record of administrative decisions. We use these to fulfil your requests, manage retention and protect access. Administrator access requires a second authentication factor.
Support and security. Messages you send us, records of privacy requests and technical information such as IP addresses, browser details and security logs processed by our service providers.

We collect information you provide or create through the service. Our reviewers may consult a LinkedIn profile you choose to share. We do not ask for health information, political or religious beliefs, or other sensitive details. Please leave these and confidential information about other people out of profile information, posts and event descriptions.

Required fields are needed to assess an application or arrange the experience you request. You can browse the public pages without applying. Applying does not guarantee admission. Membership decisions are made by people; the site does not score applications or make admission decisions automatically.

Our reasons for using your data

We use account, application and experience information to take the steps you request towards membership and to provide the membership service (GDPR Article 6(1)(b)).

Our legitimate interests are to assess relevant optional information you share, keep the service secure, prevent misuse and resolve disputes (Article 6(1)(f)). We consider these interests against your rights. We handle statutory data requests and other applicable legal obligations under Article 6(1)(c).

The application checkbox records that you have read this notice. It is not permission for marketing. We do not use application answers or CVs for advertising.

Who sees your information

Drafts: Available through your account. Application drafts are not shown in the review area before you submit. Experience drafts are not visible to other members before you publish.
Applications and CVs: Available to authorised membership reviewers. They are not shared with other applicants, members or experience hosts.
Referrals: Referral details are visible to the applicant and authorised membership reviewers, not to other members. The referrer is not given access to the application or its decision. WhatsApp processes information you choose to share through its service under its own privacy terms.
Member profiles: Only admitted members can view your saved profile and photo, including through an experience. Visitors and applicants awaiting admission cannot access them. Date of birth, application answers, CVs, referral details, account email and phone number are not part of your profile. You can edit your profile from your account. Please keep contact details and confidential information out of your introduction.
Experience proposals: Admitted members see the plan, destination, dates, costs and organiser. Confirmed guests can choose whether their photo and name appear in the guest list for each experience. Private guests remain in the attendance count, but their identity is shown in the list only to themselves and the host. Existing participation starts private; members can change their own visibility while pending or confirmed. The organiser remains visible. This choice does not anonymise messages sent in the group chat or hide the member profile elsewhere. The exact meeting point and host contact are available only to the host and accepted participants.
Discover and Careers posts: Admitted members see your post, name and business school. Contact details you include in a Careers post are visible to all admitted members. We do not publish your membership application answers or CV alongside your post. External event organisers receive information directly from you if you follow their links or book with them; their terms and privacy notices apply.
Ask the Society: Requests and replies are visible only to admitted members. Named posts and replies show the author’s name and, where available, their saved member photo with a link to their profile. On an anonymous request, the author’s name, account reference and profile are hidden from other members, including in the author’s replies in that thread. Other members’ replies show their names and saved member photos, where available. The author’s identity remains stored internally; authorised Society administrators can identify authors when reviewing reports. Reports and reporter identities are not shown to other members. Anonymity does not conceal information you choose to include in your text or optional location. There is no member directory or direct messaging attached to the board.
Personal notifications: Only you can view your notifications and reading state. Ask notifications refer to your request without including a reply author’s identity. Chat mute preferences also apply to the notification panel. Updates to requests you have received as a host remain private to you.
Event chats: The host and currently accepted participants can read the group’s history, including messages sent before they joined. Leaving an experience removes your access but does not erase messages already shared. Reported messages and reasons are available to the authorised Society reviewer; reports are not shown to the group. Read positions are used for your unread indicator, not shown as personal read receipts.
Requests to join: You and the host can see your request. The host can view your member profile, optional note and request status. Contact details supplied through earlier request forms remain restricted to you and the host. Pending, declined and withdrawn requests are not shown to other members. Once accepted, you appear in the guest list only according to your visibility choice described above. Your note stays with the host.

Authorised operators and service providers may access information where needed to maintain the service, provide support or meet legal obligations. We may disclose relevant information where the law requires it.

Use another member’s contact details only to arrange the experience. Do not add them to mailing lists or share their details without permission. Information someone has already received outside the site cannot be recalled by changing a participation status.

Service providers and international processing

OpenAI Sites hosts the website, with Cloudflare providing network security, application data and file storage. Supabase provides account authentication. Resend delivers account confirmation, password reset, membership admission, participation confirmation and event reminder emails. Supabase also schedules checks for due service emails. Our team does not receive your password in the membership review area. Open and click tracking are disabled for these emails.

These providers may process information outside your country, including outside the European Economic Area. Applicable transfers require a lawful arrangement, such as an adequacy decision or contractual safeguards. Contact us for information about the providers, processing locations and safeguards relevant to your data.

How long we keep it

Unsent application drafts and attached CVs: until you submit, clear the draft or close your account. We review drafts that have been inactive for 90 days for removal.
Unpublished experience drafts: until you publish, discard the draft or close your account. We review drafts that have been inactive for 90 days for removal. Discarding a draft does not cancel a published experience.
Applications: while we assess them and resolve any question about the decision. We review unresolved applications after six months; we do not keep them indefinitely as a waiting list. After the process is closed, we remove date of birth, answers, referral details and CVs within 90 days unless they are needed for a specific unresolved request or dispute.
Member records: the profile, admission status and preferences needed to provide membership while your account is active. Following account closure, we remove these within 30 days, subject to a specific legal obligation or unresolved dispute.
Event chats: available to the confirmed group after the event, for up to 90 days after it ends. We remove messages and read/mute preferences with the experience record. Relevant reports may be retained while a specific issue remains unresolved. You can request removal of your personal data through the contact below.
Experience records: through the end of the experience and for up to 90 days afterwards to handle arrangements and related questions, unless a specific issue remains unresolved.
Discover and Careers posts: you can remove your posts from My posts. Past external events leave the Explore feed after the event date; career posts leave the main feed after 90 days. They remain in My posts until removed. We review posts that have been off the main feed for 90 days for removal, and remove remaining posts within 30 days of account closure, subject to a specific legal obligation or dispute. Removing an event recommendation does not remove separate experiences members have already proposed from it.
Ask the Society: requests remain available until removed by their author or hidden by the Society team. Marking a request as resolved keeps its discussion accessible to members. Removing a request deletes its replies and reports from the active board records. Individually removed replies and moderated content are hidden from members; we review retained text and related reports for deletion within 90 days, unless needed for a specific unresolved issue. We review requests inactive for 12 months and remove remaining personal board data within 30 days of account closure, subject to a specific legal obligation or dispute.
Notification reading state: while your account is active, to keep read updates from reappearing. We remove it within 30 days of account closure. Notification text is generated from the current records you can access; content removed from your access is not retained as a separate notification copy.
Service email delivery: we keep the email category, related membership or event, sending status, attempts and provider reference for up to 90 days. A queued email temporarily contains the recipient address and message so interrupted attempts can be retried safely; this copy is removed after sending, cancellation or a permanent failure. The provider handles delivery records under its own retention arrangements. Emails contain a link to the account or experience, not application answers, CVs, other participants’ contact details or the private meeting point.
Administrative audit records: limited decision and security-operation records, reviewed for removal within two years, unless a specific unresolved issue requires them.
Privacy correspondence: the minimum record needed to show how a request was handled, for up to two years after closure. We do not retain a duplicate of the full application for this purpose.

Removal is managed by our team using a request queue and retention review tools; these periods do not describe an automatic deletion service. Account closure includes application records, uploaded files and the authentication account. We retain only minimal request-handling evidence, with account identifiers removed after closure. Any justified exception is limited to the relevant information and reviewed when the issue ends. Provider security logs and backups follow their own applicable retention schedules. Deleted information is not used again to operate your membership.

Clearing a draft removes unsent answers and its attached CV from the active account. It does not withdraw a submitted application or close your account.

Your choices and rights

You can ask for access, a copy, correction, deletion or restriction of your personal data, and for portability where applicable. You can object to processing based on legitimate interests for reasons relating to your situation. These rights may be subject to legal conditions.

You can also withdraw your application or request account deletion directly from the data-request page while signed in. You do not have to email us to start account deletion. We normally complete closure within 30 days. When processing begins, account access is suspended, hosted experiences are cancelled and participation is withdrawn. We confirm completion through a verified contact channel. We may need limited information to verify that a request is yours. We respond within one month; if a legally permitted extension is necessary, we explain it within that month.

Make a data request ↗

You may complain to a supervisory authority in the country where you live or work, or where a suspected infringement occurred. In Italy, this is the Garante per la protezione dei dati personali. You do not have to contact us first.

Cookies and browser storage

Cookies are small pieces of information stored by your browser. We use essential cookies to keep you signed in, complete email verification and password recovery, and protect the site from automated abuse. These functions support the service you request and do not require cookie consent. Blocking them may prevent access or sign-in.

The entries below describe our configured account cookies and browser storage, and the Cloudflare security cookie identified on this domain. Cookie names beginning with sb- include our Supabase project reference; larger cookies may be split into numbered parts such as .0 and .1.

Our account cookies use HTTPS-only transmission and are unavailable to page scripts. These safeguards protect session information; they do not change the purposes or lifetimes described above.

Access to the private preview also passes through OpenAI’s sign-in service. Its own authentication and security processing is described in OpenAI’s privacy policy. This is separate from your MBA Society membership account.

We have not added advertising pixels or analytics trackers to this site. Fonts, images and the home-page video are served with the site. Links to other sites are governed by those sites’ privacy notices when you follow them. If we introduce optional tracking that requires consent, we will ask before activating it and provide a way to refuse or withdraw consent.

You can inspect, block or delete cookies and local storage in your browser’s privacy or site-data settings. Sign out first when using a shared device. Deleting cookies may sign you out or interrupt an email-verification flow; it does not close your account or delete submitted applications, account drafts or member records. Use Your data requests to request their removal.

Updates

We update this notice when our use of data changes. The date above identifies the current version. Material changes will be brought to your attention when they affect your account or application.

Notice reference: privacy-2026-09-26-v17