Source: https://www.cong-o.de/index2.php?option=com_content&task=view&id=264&pop=1&page=0&Itemid=287
Timestamp: 2019-02-17 10:53:21
Document Index: 410329135

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 22', 'Art. 46']

CongO - Congress Organisation and more... - Privacy statement
The information in this statement applies to the processing of personal data on our website and is intended to inform you of the purposes of the processing, the recipients, legal bases, storage time limits, and your rights. On principle, we process the personal data of our users only where this is necessary to maintain a functioning website and to provide our contents and services. Personal data are all data relating to you personally, such as your name, your address and your email address. “Data processing” means in particular the collecting, storing, use and transfer of your data.
Where we obtain the consent of the data subject for the processing of personal data, the legal basis is Art. 6 (1) a) of the EU General Data Protection Regulation (GDPR).
In processing personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) b) serves as the legal basis. This also applies when processing is necessary to take steps prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) c) of the GDPR serves as the legal basis.
Where processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Art. 6 (1) d) GDPR.
If processing is necessary to pursue the legitimate interests of our company or a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the basis of processing is Art. 6 (1) f) GDPR.
Personal data of the data subject are deleted or access to these data is blocked as soon as the reason for storage no longer applies. Storage may be made after the grounds for storage no longer apply if this is prescribed by law. Blocking or deletion of the data will also occur when a storage time limit prescribed by the above-mentioned norms expires unless there is a need to continue to store the data for conclusion or performance of a contract.
You will find further information on the legal bases of processing and the duration of storage regarding specific personal data in the respective sub-sections.
You will find information on your rights in Section III.
Controller in the meaning of the General Data Protection Regulation and the national data protection legislation of the Member States and other data protection provisions is:
Tel.: +49 89 23757464
Email: info[at]cong-o.de
If your personal data are processed, you are the data subject in the meaning of the GDPR and you have the following rights against us:
You may request information as to whether personal data relating to you are being processed by us. If such processing is taking place, you may request the following information from us:
(3) the recipient or categories of recipients to whom the personal data relating to you have been disclosed or will be disclosed;
(4) the intended duration of storage of the personal data relating to you or, if specific information on this cannot be provided, the criteria for determining the duration of storage;
(5) the existence of a right to rectification or deletion of the personal data relating to you, a right to restrict processing by the controller and the right to object to this processing;
(7) all available information on the source of the data if the personal data were not collected from the person concerned;
(8) the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, substantive information on the logic involved and the extent of and intended effects of such processing on the person concerned.
You have the right to request information as to whether the personal data relating to you will be transmitted to a third country or an international organisation. In this connection, you may request information on suitable guarantees in connection with the transfer pursuant to Art. 46 GDPR.
You have the right to rectification or completion if the personal data concerning you are inaccurate or incomplete. The rectification must be made without delay.
You may demand restriction of processing of your personal data where one of the following applies:
(1) you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data;
(3) we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
(4) you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether our legitimate grounds override your grounds.
If processing has been restricted under the above-named conditions, you will be informed by the controller before the restriction of processing is lifted.
a) You have the right to obtain from us erasure of personal data concerning you without undue delay with the consequence that we shall have the obligation to erase these data without undue delay when one of the following grounds applies:
(4) the personal data concerning you were unlawfully processed;
(5) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
Where we have made the personal data public and are obliged pursuant to Article 17 (1) GDPR to erase the personal data, we shall take reasonable steps including technical measures, taking account of available technology and the cost of implementation, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
(2) for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
(4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
If you have asserted the right to rectification, erasure or restriction of processing against us, we shall be obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by us about those recipients.
You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, where:
(1) the processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR; and
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible. The rights and freedoms of others may not be adversely affected.
The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
We shall then no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.
8. Right to revoke the declaration of consent under privacy law
You have the right to revoke your declaration of consent under privacy law at any time. The lawfulness of the processing on the basis of your consent until revocation is not affected by the revocation.
9. Automated individual decision making, including profiling
However, these decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), we implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
Regardless of any other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you reside, have your place of work or where the alleged infringement occurred, if in your opinion the processing of the personal data concerning you infringes the GDPR.
The supervisory authority with which you lodge the complaint will inform you of the status and the results of the complaint, including the possibility of seeking judicial remedy pursuant to Article 78 GDPR.
IV. Visiting the website and logfiles
Each time our internet page is visited, our system automatically collects the following data and information from the computer system of the accessing computer:
(2) the user’s operating system and the version used
(3) the URL accessed by the user
(6) websites from which the user accesses our internet page
These data are stored in our system’s logfiles.
The legal basis for collecting and storing the data is Article 6(1) f) GDPR.
The temporary storage of the IP address is necessary for displaying the website to you. For this, your IP address has to be stored for the duration of the visit. The remaining data are collected for technical reasons in order to ensure stability and security.
This also forms the basis of our legitimate interest in processing under Article 6(1) f) GDPR.
The data are deleted as soon as they are no longer required for the purpose for which they were collected. Data collected for the purpose of making the website available are deleted when each visit ends.
In the case of data stored in logfiles, this occurs at the latest within seven days. A longer storage period may occur. In this case, users’ IP addresses are deleted or altered so that it is no longer possible to identify the accessing client.
Collecting the data for making the website available and storing the data in logfiles is necessary for the operation of the internet page. Hence, the option of objecting is not available to the user.
V. Registering for an event on the website
Our website provides you with the option of registering for participation in events by providing personal data. These data are entered in an entry field, transmitted to us and stored. The following data are always collected in the framework of the registration process:
(4) street and house number
(9) participation in the event and in satellite events where applicable
On registration a temporary customer account is created for you and the following data are also stored:
(3) internal system information on the process
In addition, the following data concerning you are also stored if you provide them voluntarily:
(1) billing address if different
(6) fax number
(7) area of medical specialisation
(8) VAT ID
b) personalised entry ticket
Entry tickets are personalised. Personalisation occurs by embedding the following data of the applicant in an encrypted QR code on the ticket:
The data contained in this QR code can be read with a special app. At the event, third parties may request you to allow the QR code to be scanned. If you do not wish third parties to collect these data from you, you should not accede to this request. The data can only be read if you hold your ticket directly in front of a scanning device. Disclosure of your data to third parties is not a condition of participating in the event.
Responsibility for data collection and processing lies with the respective third party. That third party’s data protection provisions and privacy statement apply.
c) Payment processing
We work together with the company PaySquare to process payment transactions. To process the transaction, you will be directed to PaySquare’s website and will then be requested to enter your payment data including personal data. Data collection and processing is done by PaySquare. Please take note of PaySquare’s information on data processing and privacy statement.
In the frame of the registration process you will be asked to consent to the processing of these data.
The legal basis for the data processing where you have given consent is Article 6(1)a) GDPR. If registration is necessary for the performance of a contract to which you are a party or to take steps prior to entering into the contract, processing is also based on Article 6(1)b) GDPR.
It is only possible to register for events via our website by providing the above-named data which is always required. The data provided in the context of your registration are therefore necessary for performance of a contract with you or to take steps prior to entering into a contract. Registration is also necessary for the provision of certain contents and services on our website in the form of the management of billing and delivery addresses. We may also use the collected data to contact the registered user about the event that he/she has booked.
The data are stored for three years from the end of the year in which the registration was made.
The data are necessary for performance of a contract or to take steps prior to entering into a contract. Hence, early deletion of the data is only possible if not barred by contractual or legal obligations.
We transmit some personal data we have received in the context of registration to service providers who work with us in processing the contracts we have entered into with you. These providers are our tax advisors, the printer that produces the entry tickets and in some cases companies and individuals that are responsible for the on-site running of the event.
VI. Subscribing to the newsletter during the registration process
In the frame of the registration process for an event, you can also subscribe to our newsletter. In this case, we store the email address you previously entered when registering so that we can send you the newsletter. This information will be stored separately from the rest of the data collected during the registration process. At the same time as the request is sent, the following data are also stored:
In the frame of the registration process your consent to the processing of the data will be requested and reference will be made to this privacy statement.
The legal basis for the data processing is Article 6(1)a GDPR.
We collect and store your email address in order to send you the newsletter.
The collected data are stored as long as you subscribe to the newsletter.
You can revoke your consent at any time with future effect. This can also be done by cancelling your subscription.
Our website uses cookies that are technically necessary. Cookies are text files that are stored on your computer. We use cookies to make our website more user-friendly. Some elements of our internet page require that the accessing browser can be identified also after accessing a new page.
The legal basis for processing personal data by using cookies is Article 6(1)f) GDPR.
The purpose of using technically necessary cookies is to make it easier for you to use our website. Some functions of our internet page cannot be provided without the use of cookies. They need to be able to recognise the browser even after a new page has been accessed.
The user data created by technical cookies will not be used to create legal profiles.
Cookies that are technically necessary are usually deleted when the browser is closed and the session ends. You can also delete cookies that have already been stored at any time.
Cookies are saved on your device which transmits them to us. Hence, by changing the settings in your browser, you can deactivate or restrict the transmission of cookies. If cookies for our website are deactivated it may no longer be possible for you to make full use of all the website’s functions.
You can use the contact form on our website to contact us. When the contact form is used, the data entered in it are transmitted to us and saved by us. These data include at a minimum the following:
They also include the following data if you provide them, which are not required to use the contact form:
(1) street and house number
(2) postal code
(5) mobile phone number
(6) land line number
When a request is sent, the following additional data are also collected and stored:
(3) URL of the accessed site
(4) information on the browser type and version used
(5) user’s operating system and version used
We use the collected data to answer and process your requests. You are not required to provide us with your personal data. However, in that case, we will not be able to answer your request.
If you send us your data in the context of taking steps prior to entering into a contract, for example, when you request us to send an offer or you have a query regarding our products, the legal basis is Article 6(1)b) GDPR. In all other cases, the legal basis is Article 6(1)f) GDPR.
We process the personal data from the entry field only to deal with your contact request. If a contact request is made by email, this also provides us with the necessary legitimate interest in processing the data.
Other personal data processed when the contact form is sent serve to prevent misuse of the contact form and to ensure the security of our IT systems.
Your data are deleted when the circumstances show that your request or the relevant matter has been finally dealt with.
Personal data collected in addition when the request is sent are deleted after seven days.
Collection of the data is necessary to deal with the request sent via the contact form. Hence, the user does not have the option of objection.
IX. Subscribing to the newsletter without using the registration process
On our website you can subscribe to a newsletter. To do this, you must enter your email address in the form provided for this on the website.
Your email address will be transmitted to us and stored by us. When you send your request, the following data will also be collected and stored:
(3) information on the browser type and version used
(4) user’s operating system and version used
When you complete the form to subscribe to the newsletter, a record is created. In this record, changes you subsequently make to your subscription request are stored. The above data are stored again every time you make a change.
A record is also created of the messages we send you. We store information on which newsletters were sent to you and whether any have been returned.
When you make your subscription request we seek your consent to the processing of these data and refer to this privacy statement.
The legal basis for processing the data is Article 6(1)a) GDPR.
We collect and store the email address so that we can send you the newsletter.
The collected data will be stored as long as your subscription to the newsletter runs.
You may revoke your consent with future effect at any time. You can also do this by cancelling your subscription.