Privacy
This notice explains how personal data is handled on globalriskalliance.com and in messages to GRA addresses. The controller is The Global Risks Alliance, a nonprofit corporation registered in Nevada, United States, operating as a business league for the financial services industry (GRA), at 4500 Forbes Blvd., Suite 200, Lanham, MD 20706, United States. GRA uses an enquiry to answer it and keep a record of it. It does not sell personal data, does not share it for cross-context behavioural advertising, does not use enquiries for marketing, and does not forward enquiries to The Global Centre for Risk and Innovation (GCRI) or The Global Risks Forum (GRF), each of which has its own notice and controller.
- Institution
- The Global Risks Alliance (GRA)
- Service level
- R0: information and enquiries
Risk register
Privacy · Member portfolio · Quarter 3
Register
| Concentration in coastal property | Insurance | High | Above | Chief risk officer |
| Liquidity under redemption stress | Liquidity | Medium | Within | Treasury |
| Model error, cat pricing | Model | Medium | Above | Independent validation |
| Third-party cloud outage | Operational | Medium | Within | Operations |
Heat map
GRA · Risk registerRisk register, in outline: domain structure with placeholder names and illustrative values, not a record.
What GRA collects, why, and on what basis.
| Data | Purpose | Legal basis where the GDPR or UK GDPR applies |
|---|---|---|
| Name, email, institution, any other contact details and your message (Nevada covered information) | Answering your enquiry and keeping a record of it | Legitimate interests in responding and record-keeping; contract steps where you ask for them |
| Technical data such as IP address, browser and pages requested, in server logs | Operating and securing the site | Legitimate interests in security |
| Strictly necessary cookie data | Delivering pages and remembering a cookie choice | Legitimate interests; consent for any optional cookie |
| Records needed by law | Meeting legal obligations | Legal obligation |
Do not send confidential, competitively sensitive or sensitive personal data in a first message. GRA does not knowingly collect data from children under 13; the site is not directed to them, and such data is deleted if found.
Jurisdictions in the Mekong Basin.
The jurisdictions that hold authority over this question: countries, their first-level divisions and capitals, shown for the Mekong Basin as an example geography for this subject.
Who receives data, where, and for how long.
- 01
Processors
Hosting, email and IT providers process data on GRA's instructions under contract, for no purpose of their own. Data is otherwise disclosed only where the law requires or to protect rights and safety.
- 02
No forwarding
Enquiries are not forwarded between institutions. A message to the Consortium Secretariat or a regional desk is handled under the notice on therisk.global.
- 03
International transfers
Data is processed in the United States. Where the GDPR or UK GDPR applies, transfers use safeguards the law recognises, such as standard contractual clauses.
- 04
Retention
Data is kept for as long as needed for the purpose and as required by law, then deleted or anonymised.
- 05
Security
GRA maintains reasonable administrative, technical and physical security measures and gives breach notifications as applicable law requires. No system is free of risk.
Nevada, other US states, and the GDPR.
NRS 603A
GRA does not sell covered information. Nevada consumers may still send an opt-out request, or ask to review or correct covered information, at privacy@globalriskalliance.com. Third parties do not collect information about your online activities over time and across sites through this site.
Where a law applies
Where another US state privacy law applies to GRA, GRA honours the rights it provides, such as access, correction, deletion and opt-out.
GDPR rights
Access, rectification, erasure, restriction, objection and portability, and the right to complain to a data protection authority.
GRA may verify your identity before acting on a request and will explain any legal reason it cannot act. The acknowledgement gives a reference and names the next step.
Do Not Track, Global Privacy Control and updates.
- Do Not Track: there is no common standard for it. The site does not track you across other sites, so the signal changes nothing about how it operates
- Global Privacy Control: the site is designed to treat it as a valid request to opt out of any sale, sharing or targeted advertising, and as a refusal of optional cookies for that browser
- Changes: updates are published here as dated versions with a new effective date, which takes effect on publication after counsel review
Contact privacy@globalriskalliance.com, or write to The Global Risks Alliance, 4500 Forbes Blvd., Suite 200, Lanham, MD 20706, United States. See also cookies and terms of use. This notice is reviewed by counsel before publication. Until then it states intended practice and does not create rights or obligations beyond those the law already provides.
Questions and answers.
Does the California Consumer Privacy Act apply?
Does GRA share my enquiry with GCRI or GRF?
How do I report a possible data incident?
Around GRA.
Start with an enquiry.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.