Source: https://ecs2018.eu/data_protection_notice.html
Timestamp: 2019-04-20 07:29:11+00:00

Document:
In principle, we will process personal data of our users only to the extent necessary for us to provide a functional website including our contents and services. We usually process our users’ personal data only following the user’s consent, except in cases where prior user consent cannot be obtained for genuine reasons and where processing the data is permitted by law.
Art. 6 (1) (a) of the EU General Data Protection Regulation (GDPR) will apply to cases where we obtain the consent of the data subject prior to processing the personal data.
Art. 6 (1) (b) GDPR constitutes the legal basis for cases where processing of personal data is necessary for the performance of a contract to which the data subject is a party including processing operations required to carry out pre-contractual actions.
Art. 6 (1) (c) GDPR serves as the legal basis for cases where processing of personal data is required so that our company is able to meet a binding legal obligation.
Art. 6 (1) (d) GDPR will apply in the event that personal data processing becomes necessary to protect the vital interests of the data subject or any other natural person.
Art. 6 (1) (f) GDPR serves as the legal basis in the event processing becomes necessary in order to protect the legitimate interests of our company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
The personal data of the data subject will be erased or disabled as soon as the purposes expire for which the data was collected. However, such retention may be subject to European or national legislations such as EU regulations, laws or other regulations to which the controller is bound. Disabling or erasure of data will ensue once the prescribed retention period as per the standards mentioned expires, unless the conclusion of a contract or fulfillment of a contract would require an extended retention of the data.
Each time our website is accessed, our system automatically collects data and information from the computer system of the calling machine. The user’s IP address is collected. The data is also stored in log files on our system. This piece of data is not stored together with other personal data of the User.
Art. 6 (1) (f) GDPR applies for the short-term storage of data and log files.
The short-term storage of the IP address collected by the system is necessary to allow delivery of the website to the user’s computer. The user's IP address will hereby be retained for the duration of the session.
The data is stored in log files to ensure the website’s functionality. The data is also used to optimize the website and to ensure the security of our information technology systems. The data is not assessed for marketing purposes within this context.
These purposes reflect our legitimate interest in the processing of data pursuant to Art. 6 (1) (f) GDPR.
The data will be deleted as soon as the purpose expires for which the data was collected. Accordingly, data collected for reasons of website use is deleted once this particular session is closed.
Data stored in log files will be deleted after no more than seven days. Longer retention is possible. In such a case, the user’s IP address will be deleted or masked, so that it can no longer be associated with the calling client.
The collection of data for website use and the storage of the data in log files are indispensable for the operation of the website. Accordingly, the user cannot raise an objection.
User data collected in this way are pseudonymised using technical precautionary measures. Therefore, assigning the data to the calling user is no longer possible. This piece of information about the user will not be stored together with other personal data of the user.
Art. 6 (1) (f) GDPR forms the legal basis for processing personal data using cookies.
Art. 6 (1) (a) GDPR forms the legal basis for processing personal data using cookies for analysis purposes after the User has granted consent.
The user data collected through these technically necessary cookies are not used to create user profiles.
The use of analysis cookies are intended to improve the quality of our website and its contents. We learn how the website is used through such analysis cookies, and can therefore continuously optimize our offer.
These purposes reflect our legitimate interest in processing personal data in line with Art. 6 (1) (f) GDPR.
The user’s informed consent to processing this data is obtained during the process of registration.
Art. 6 (1) (a) GDPR is the legal basis where the consent of the user is available.
Art. 6 (1) (b) GDPR is the legal basis for processing data if registering serves the fulfilment of a contract to which the user is a party or the implementation of pre-contractual measures.
User registration is required to fulfil a contract with the user or to carry out pre-contractual measures. Registration allows the user to register for the “International Meeting of the European Calcium Society”. You will have to pay a fee when you register for the event.
The data will be deleted as soon as the purpose for which the data was collected has been accomplished. This is the case for data collected during registration once the contract is fulfilled or pre-contractual measures were carried out and the data is no longer needed for the execution of the contract. However, there may be a need to preserve personal data of the party to the contract even after the conclusion of the contract to meet contractual or legal obligations.
As user, you may cancel the registration at any time. You can also change the data stored about you at any time. However, if the data is necessary for fulfilling a contract or to carry out pre-contractual measures, the erasure of data would only be feasible, if contractual or legal obligations are not precluding a premature deletion of the data.
During the registration for our event, we will ask you to provide your payment information in addition to the registration data. Since we do not process your payment ourselves, our partner, Heidelberger Payment GmbH, Vangerowstraße 18, 69115 Heidelberg (hereinafter Heidelpay) will process the payment and will collect, process and store your data to process the electronic payment. Data processing is carried out at our request.
For the purpose of processing electronic payments, Heidelpay will receive the following information directly from you in connection with your order: title, gender, first name, surname, company, address, zip code, city, country, customer number, email, method of payment. If you choose to pay by credit card, the following additional information provided by you will be sent directly to Heidelpay: credit card number, credit card holder, credit card validity (month and year), credit card CVC. If you choose to pay via online bank transfer, you may need to provide some of the following information depending on the system, which will be sent directly to Heidelpay: account holder, bank name, account number or IBAN, bank code number or BIC. If you choose to pay in advance, the following information will also be sent from you to Heidelpay which will make it easier to clearly allocate your payment: IBAN, BIC, account holder.
Art. 6 (1) (a) GDPR in conjunction with the user’s consent forms the legal basis for processing your payment data. Since the collection of this data also serves the purpose of fulfilling a contract to which you are a party, Art. 6 (1) (b) GDPR will apply in addition with regards to the processing of your data.
Data processing is required for processing the electronic payment transaction. During registration for the event a certain fee has to be paid. We would not be able to process your payment required for being able to attend the event without the services of Heidelpay.
You may request a confirmation from the data controller whether personal data concerning you is processed by us.
about automated decision-making including profiling as per Article 22 (1) and (4) GDPR and, at least in these cases, convincing information about the logic involved, and the consequences as well as the desired impact of such processing vis-à-vis the data subject.
You have the right to be informed about whether your personal information is shared with a third country or an international organization. In this context, you can demand information on appropriate safeguards in connection with the transfer pursuant to Art. 46 GDPR.
You have the right to rectification and/or completion against the controller, provided the personal data processed concerning you is incorrect or incomplete. The data controller must make the correction without delay.
if you have objected to processing pursuant to Art. 21 (1) GDPR and are still waiting for the verification, whether the controller’s legitimate grounds may outweigh yours.
If processing of personal data concerning you is subject to restrictions, this data may only be used with your consent – except for retention - or to assert, exercise or defend legal claims or to protect the rights of other natural or legal persons or for reasons of important public interest of the Union or a Member State.
If processing was restricted by reason of above mentioned requirements, the controller will inform you before a restriction is lifted.
Personal data concerning you is no longer necessary for the purposes for which they were collected or otherwise processed.
You revoke your consent, which formed the legal base for processing in accordance with Art. 6 (1) (a) or Art. 9 (2) (a) GDPR and no other legal basis supports processing.
You raise objection to the processing in accordance with Art. 21 (1) GDPR and there are no overriding reasons that would justify processing, or you raise objection to the processing in accordance with Art. 21 (2).
Erasure of personal data concerning you is required to meet a legal obligation of a Union law or a law of the Member States to which the controller is subject.
The personal data concerning you was collected in connection with offers of the information society services pursuant to Article 8 (1) of the GDPR.
If the controller has made personal data concerning you public, and the data controller is bound to erase the data as per Art. 17 (1) GDPR, the controller will take the appropriate measures, including technical means, while taking into account available technology and implementation costs and inform the data processors tasked with processing the personal data that you as the data subject have requested the erasure of any links to such personal data or of copies or duplicates of such personal data.
Once you made use of your right to rectification, erasure or restriction of processing, the controller will be under the obligation to notify all recipients with whom your personal data was shared about the correction or erasure of the data or restriction on processing, unless: this proves to be impossible or involves disproportionate efforts.
processing is handled by automated means.
In exercising this right, you are also entitled to require that your personal data is directly send from the data controller to another controller, provided this is technically feasible. Freedoms and rights of other persons may not be affected.
The right to data portability will not apply to the processing of personal data necessary for carrying out a task in the public interest or in the exercise of official authority delegated to the controller.
You have the right to object at any time to the processing of your personal data, which was collected pursuant to Art. 6 (1) (e) or (f) GDPR for reasons that arise from particular situations; this is also true for profiling subject to these provisions.
The controller will cease to process the personal data concerning you, unless the controller is able to establish compelling legitimate grounds for continuing processing that outweigh your interests, rights and freedoms, or unless the processing serves the purpose of asserting, exercising or defending legal claims.
If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for marketing use; this is also true for profiling that is associated with direct marketing.
Your personal data will no longer be processed for these purposes following your objection to processing for direct marketing use. In relation to the use of information society services, you have the option to use automated procedures consistent with technical specifications to exercise your right to object - regardless of Directive 2002/58/EC.
You have the right to revoke your consent regarding data protection laws at any time. Your consent withdrawal will not affect the legality of processing that was carried out based on consent prior to the consent withdrawal.
However, these decisions must not be based on special categories of personal data laid out in Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) GDPR applies and reasonable measures have been taken to protect the rights and freedoms and your legitimate interests.
With regard to the cases referred to in (1) and (3), the controller will implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express one’s point of view and to contest the decision.
Regardless of any other administrative or legal remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your place of residence, employment or the place of the alleged breach, if you believe that the processing of the personal data concerning you violates the GDPR.
The supervisory authority where the complaint was issued will inform the complainant about the status and the results of the complaint, including the option of a legal remedy pursuant to Article 78 GDPR.

References: Art. 6

Art. 6

Art. 6

Art. 6

Art. 6

Art. 6
 Art. 6

Art. 6

Art. 6
 Art. 6

Art. 6

Art. 6

Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 6
 Art. 9
 Art. 21
 Art. 21
 Art. 17
 Art. 6
 Art. 9
 Art. 9