National MS Society – Grant Management System Privacy Note
Date of publication: May 2025
This privacy note explains how the National MS Society ("NMSS, " "we," "us") collects,
uses, stores, and protects your personal data when you use our online Grant
Management System, powered by Optimy. Your privacy is very important to us, and we
are committed to protecting your personal information.
1. About us (data controller)
NMSS is the data controller responsible for the personal data collected through this
Grant Management System.
2. Purpose of data collection
We collect your personal data for the following purposes:
To process and evaluate your grant application.
To manage awarded grants, including financial disbursements and project
monitoring.
To communicate with you regarding your application or awarded grant.
To comply with legal and regulatory obligations applicable to NMSS.
For internal statistical analysis and reporting to improve our grantmaking
processes.
For any other purposes you may authorize from time to time.
3. Types of personal data collected
Through the Optimy Grant Management System, we may collect the following types of
personal data:
Identity and contact data: Name, title, organization, email address, phone
number, postal address.
Professional data: CVs, professional background, expertise, role, organization
details.
Project data: Project descriptions, objectives, methodologies, timelines, team
members.
Financial data: Bank account details (for disbursements), budget proposals,
financial reports.
Other data: Any other information you choose to provide in your application or
during the grant management process.
4. Legal basis for processing
We process your personal data primarily on the basis of:
Necessity for pre-contractual steps/contract performance: To process your
application and, if successful, to manage the grant agreement.
Legitimate interests: For internal operational purposes, statistical analysis, and
improving our grantmaking, provided your rights are not overridden.
Compliance with legal obligations: To meet our or any relevant legal and
regulatory requirements.
Consent: Where required, we will obtain your explicit consent for additional
specific processing activities.
5. Data storage location and security
Our Grant Management System is powered by Optimy, a software provider based in
Europe. Your personal data entered into the system is securely hosted on Amazon Web
Services (AWS) servers located in Europe. Optimy and AWS adhere to industry-
standard security measures and certifications (e.g., ISO 27001, SOC 2) designed to
protect your data from unauthorized access, use, disclosure, alteration, or destruction.
We also maintain strict internal access controls.
6. Data retention
We will retain your personal data for as long as necessary to fulfill the purposes for
which it was collected, including for the duration of the grant project, and for a period
thereafter as required by law or our internal record-keeping policies. Once the data is no
longer required, it will be securely deleted or anonymized.
7. Data sharing and recipients
Your personal data may be accessed by:
Internal NMSS staff: Members of our grants, finance, and leadership teams
involved in the application review and grant management process.
Grant reviewers: External experts or scientific taskforce members involved in the
evaluation of applications, bound by confidentiality agreements.
Optimy (data processor): As our software provider, Optimy processes data on our
behalf and acts strictly under our instructions.
Auditors and regulators: Where legally required or for auditing purposes. We will
not sell or rent your personal data to third parties.
8. International data transfers
As Optimy's servers are located in Europe, your personal data will be transferred to and
stored in Europe. This transfer is safeguarded by General Data Protection Regulation
standards (GDPR). We ensure that appropriate safeguards are in place to protect your
data in accordance with applicable data protection laws.
9. Your data protection rights
You have certain rights concerning your personal data, subject to applicable laws.
These may include the right to:
Access your personal data.
Request correction of inaccurate data.
Request deletion of your data (under certain circumstances).
Object to processing.
Request restriction of processing.
Request data portability.
Withdraw consent (where processing is based on consent).
To exercise any of these rights, please contact us using the details below.
10. Updates to this privacy note
We may update this privacy note from time to time to reflect changes in our practices or
legal requirements. We will notify you of any significant changes by posting the updated
note on our website or within the Grant Management System.
11. Contact us
If you have any questions about this privacy note or our data practices, please contact
us at: grant@nationalmssociety.ae.