Privacy notice

Skill Mapping processes personal data in line with the UN Personal Data Protection and Privacy Principles (adopted by the UN High-Level Committee on Management, 11 October 2018) and the UNICEF Policy on Personal Data Protection (POLICY/DFAM/2020/001). In short, we process your data only:

• fairly and on a legitimate basis;
• for the specific purposes listed below, and not in incompatible ways;
• to the extent that is necessary and proportionate;
• for no longer than needed;
• keeping it accurate and up to date;
• confidentially and securely;
• transparently, so you know what happens to it and can act on it;
• sharing it only with parties that protect it appropriately;
• under clear accountability.

This notice is provided without prejudice to the privileges and immunities of the United Nations, including the 1946 Convention on the Privileges and Immunities of the United Nations.

The data controller is UNICEF, which decides why and how your data is processed in Skill Mapping. Questions and requests about your data go to privacydemo@unicef.org.

Our hosting and infrastructure providers act as processors. They process data only on our documented instructions and have committed to data protection standards equivalent to ours. See section 7.

We do not collect personal data about you from other sources, such as HR systems, other UN agencies or public information. An administrator may create your account with your name and work email so that you can sign in.

We do not ask for particularly sensitive personal data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, staff association membership, health, genetic or biometric data, or sex life or sexual orientation. Please do not include it in your bio, requests or messages.

The purposes are set before we collect data. We will not use your data for anything incompatible with them, for example performance evaluation, without telling you first and, where required, asking for your consent. Using Skill Mapping is voluntary.

No automated decisions. Search ranking and skill-name suggestions only help colleagues find each other. No decision with legal or significant effects on you is made solely by automated means.

• Signed-in colleagues see listed profiles: name, job title, office, country, languages, bio, skills and availability. Your email is never shown in the directory.
• A support request is visible only to the requester and the colleague it was sent to.
• Administrators can see accounts, requests, feedback and the security log to run and protect the service. Their actions are logged.
• Hidden profiles do not appear in search and cannot receive new requests.

The directory is only useful when profiles are accurate. Please keep your job title, office, skills and availability up to date, and set your status to Unavailable when you are away. You can edit your profile at any time from My dashboard.

Your data may therefore be stored or processed outside the country where you work. We transfer data only where there is a legitimate basis and only to providers that give appropriate protection, under written agreements that limit them to our instructions and require security, confidentiality and deletion when the service ends. We do not sell your data or share it with any other third party.

• Account, profile and skills: until you delete your account, or after 24 months without signing in.
• Completed or closed support requests and their feedback: 24 months after they close.
• App feedback: 24 months.
• Security and audit log: 365 days.
• Expired sessions are removed automatically.

These periods are set by what each purpose needs, after which the data is no longer useful. An automated job permanently deletes records once their period ends.

You can ask to:

• Access your data: find out whether we hold data about you and get a copy.
• Correct data that is wrong or out of date.
• Delete your data.
• Object to or restrict how your data is processed.
• Withdraw consent at any time, for example to being listed or to analytics.
• Object to automated decision-making (Skill Mapping does not use it; see section 4).

Do it yourself in Skill Mapping

Go to My dashboard → Privacy.

Make a request

For anything you cannot do yourself, contact privacydemo@unicef.org, in writing or by speaking to the administrator. When we handle your request:

• We confirm your identity before showing or changing any data, usually by replying to your work email.
• We may ask for more detail if we cannot find the record with reasonable effort.
• We reply within a reasonable time, normally within 30 days.
• We give the data in a practical format: on screen, digitally or in print.
• We may keep some data where there is an overriding reason, such as a legal obligation, an open investigation or audit, or organisational accountability. Records already transferred to official archives are not deleted.
• If we refuse a request we tell you why, unless the request is manifestly abusive, fraudulent or obstructive.

If you are not satisfied

You can ask for our response to be reviewed by the organisation's data protection focal point or Data Protection/Privacy Specialist. They will tell you about any further review mechanism available.

Strictly necessary cookies are needed for the service to work and cannot be turned off. They are not used to track you.

Analytics stay off until you choose "Allow analytics". Vercel Web Analytics sets no cookies, records only anonymous page views and does not track you across sites. Choose "Cookie settings" in the footer at any time to change or withdraw your choice. It takes effect immediately.

Data is encrypted in transit (HTTPS with HSTS) and at rest. Passwords are hashed, sessions use secure HTTP-only cookies, access is role-based on a need-to-know basis, and access to, changes to and deletion of personal data by administrators are logged. Skill Mapping was built with data protection by design and by default: profiles collect only what the directory needs, most fields are optional, and your email is never shown to colleagues.

If a personal data breach happens, we report it through the organisation's breach procedure, take steps to contain it, and tell you if it is likely to put your rights at risk.

When we make a material change to this notice, we update the version above and ask you to review it the next time you sign in.