Privacy Policy
Apriil Congress AS processes personal information and has adopted this Privacy Policy,
which explains how we treat personal information to ensure fair and transparent
processing. This Privacy Policy explains how the personal information which you registeron the registration site is processed. We are only processing personal information which isrelevant and necessary for our cooperation with you, or to fulfil our contractual or legal
obligations.
We process data in accordance with the European General Data Protection Regulation(Regulation (EU) 2016/679 of the European Parliament) (the “GDPR”) and the applicableacts on processing of personal data in the country where the Congress is taken place.
The registration site is hosted by an external data processor. Pursuant to the GDPR, Apriil
Congress AS has entered into a Data Processor Agreement with the external dataprocessors hosting the registration site.
Data Controller
Apriil Congress AS is the data controller of the personal information which you register on
the registration site, and the personal information which we collect or receive as part of ourservices. Below is our contact information:
Apriil Congress AS – Enterprise number in Norway: 925 584 525MVA
e-mail: sindre.hauge@apriil.noKong Christian Frederiks plass 35006 Bergen, NorwayRegistration process on the web site
We only ask you to provide information necessary for the registration process, including
any additional services/facilities booked by you in connection with yourregistration/participation, or to meet our contractual or legal obligations linked to yourregistration/participation.
The data processing activities for the registration process will generally include thefollowing categories of personal data; name, email address, mobile phone, company nameand department, company address, reference no.
As part of the registration process information on your name, contact information,company name and department, your booked services/facilities and the total billing
amount will be processed to the Organiser. Further, we may process your information tothird-party sources for the fulfilment of the services/facilities booked by you on theregistration site or contracted with the Host (i.e. information will be processed to relevant
third-party sources such as hotels, venues, restaurants, limo/coach services, guides orother relevant land services). Processing to third-party sources will only take place when it

is relevant and necessary for the fulfilment of the services/facilities booked by you or theHost.
The information registered on the registration site will be processed either by email orthrough websites to the Host and relevant third-party sources. When processing personal
information, we will take appropriate measures to comply with the GDPR and theapplicable acts on processing of personal data in the country where the Congress is takenplace. The information is not transmitted to countries outside the EU/EEA.
Special categories of personal data
According to the GDPR a consent is required when processing special categories of
personal data. Special categories of personal data include inter alia data revealing racial orethnic origin, political opinions, religious or philosophical beliefs, or trade union
membership, data concerning health, data concerning a natural person’s sex life or sexual
orientation and any personal data relating to a child under the age of 13. We will only
process such special categories of personal data based on your consent in writing or
facilitated via the registration process (cf. GDPR article 6). Special categories of personal
data will only be processed to third-party sources in case it is necessary for the fulfilmentof the services/facilities booked by you or the Congress Host (ie. special requirements on
food, health and religion may be processed to hotels/venues/restaurants). As part of theregistration process, we require your consent in writing or via the personal registration
process, if you register such special categories of personal data on the registration site in
the box “special requirements “.
Payment
In case you make an online payment by credit card on the registration site, your payment
will be processed through a SSL secured window. All communication is encrypted andgoes through Stripe (payment gateway). When the payment has been made, a receipt will
be sent to the e-mail address submitted by you. Apriil Congress AS does not store any
credit card details on our servers. In case you pay by invoice, the invoice will be sent to theemail address submitted by you.
Registering information on the registration site regarding other participants
In case you register personal data on the registration site regarding other participants, youagree that you have notified any other person whose personal data that you provide to usof this privacy policy and, where necessary, obtained their consent so that we can lawfully
process their personal data in accordance with this policy. Please see the section” special
categories of personal data” for information on when a consent is required.
Processing of personal information as part of our contracted services
In special cases we may receive personal information regarding participants directly fromthe Host or other clients/partners linked to the meeting. When handling such personal
information, we rely on the authority of the Host or our clients/partners to act on behalf ofthe participants. Further, we base our processing on the fact that the Host or ourclients/partners have obtained a lawful basis for the processing of personal information to
Apriil Congress AS. Furthermore, we base our processing on the fact that the Host or our2

clients/partners have provided all relevant information to the participants upon collection of
the personal information cf. the GDPR and the applicable acts on processing of personal
data in the country where the Congress is taken place.
Legal basis and erasure
Our legal basis for processing the personal information received or registered on theregistration site is based on the performance of a contract with you, the Host orclients/partners linked to the meeting, compliance with our legal obligations, our legitimate
interests or in special cases your consent, (cf. GDPR article 6).
The personal data registered on the registration site will be deleted within 6 months,
unless a legal basis to store it for a longer period is applicable. However, accounting
records are kept for 5 years from the end of the financial year to which the material relates(cf. the applicable accounting laws).
Security
All IT-services, internet sites and cloud solutions which we may use have security
measures in place to protect from loss, disclosure, unauthorized access, destruction,
alteration or other misuse of personal information.
We are currently using SSL, firewalls, and password protection to secure our data.
Personal information is treated on a “need to know” basis. When processing personal
information, we take appropriate measures to comply with the GDPR and the applicableacts on processing of personal data in the country where the Congress is taken place.
Your rights
You have several rights under in relation to the information processed about you. If you
want to use your rights, please contact us at sindre.hauge@apriil.no.
The right to insight on personal information (Right of Access)You are entitled to gain insight on the personal information which we are processing aboutyou.
The right to rectification
You may free of charge request rectification of inaccurate personal data about you.
Further, you may request that we cease to process personal information about you (unless
we are statutorily required to process the information).
The right to erasure (right to be forgotten)
In special cases, you have the right to obtain erasure of information about yourself before
our ordinary general erasure will take place.

3

The right to restriction of processing
In certain cases, you may have the right to restrict the processing of your personal
information. If you are entitled to restriction of processing, we will only be able to process
such personal information – with the exception of storage - with your consent or for thepurpose of determining, enforcing or defending legal requirements or protecting a person
or important social interests.
The right to object
In certain cases, you may object to our otherwise legitimate processing of your personal
information.
Right to transmit information (right to data portability)
You may, in certain cases, have the right to receive your personal information in a
structured, commonly used and machine-readable format, and to transmit those data to
another data controller.
Complaint to the Data Protection Agency
You are entitled to file a complaint with the Data Protection Agency in the country where
the Congress is taken place, if you are dissatisfied with the way we process your personal
information. You’ll find the Data Protection Agency’s contact information atwww.datatilsynet.no
Other websites
This Privacy Policy only applies to this registration site administrated by Apriil Congress
AS. If you select a link to an external website, please refer to the privacy policy of thatspecific website.
Revision of our Privacy Policy
We reserve the right to up-date and make changes to this Privacy Policy from time to time.
The current Privacy Policy will be available on our registration site.
This Privacy Policy is last updated on January 5, 2023.

4