ERES PRIVACY POLICY
Version 1.0 | published 01/08/2020 | effective as 01/08/2020
INTRODUCTION
This Privacy Policy is designated to generally describe how personal data is collected, used, processed and protected in connection with the activities and operations of European Real Estate Society (registered at the Dutch Chamber of Commerce, number 41214429; hereinafter: ERES or Data controller) acting as Data controller and in certain cases as Data processor while complying with the applicable legal regulations. This Privacy Policy also gives thorough information for the data subjects on their rights pertaining to the processing of their personal data.
This Privacy Policy applies to the processing of the personal data of our Website Users, Registrants of our conferences, seminars, workshops, summer schools, guests and also those data who aim to engage in a contractual relationship and those who were in a contractual relationship earlier; and any other person whom we may contact while operating our activities; hereinafter: Participants. This Privacy Policy does not apply to employment-related data processing.
Please be advised that ERES may unilaterally amend this Privacy Policy from time to time. Please visit https://www.eres.org/index.php/privacy regularly if you want to keep up to date.
DEFINITIONS[1]
What constitutes “personal data”?
“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
What is data processing?
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Who is the data controller?
“Controller” means the natural or legal person, public authority, agency or another body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Who is the data processor?
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Who is a third party?
“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
Who is a recipient?
“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
What is consent?
“Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
What is a data breach?
“Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
1. BASIC INFORMATION ABOUT THE DATA CONTROLLER
1.1 Data controller/processor
This Privacy Policy regulates the data processing by ERES, and it is, therefore, ERES who generally qualifies as a data controller in respect of your personal data. There are however certain cases where ERES does not act as a data controller but instead acts as a subordinate of another data controller, which case ERES is understood to be a data processor (acting on behalf of another controller while processing the personal data – in such case ERES proceeds in accordance and based on the instructions of the data controller and processes data only to the extent as prescribed by the data controller).
Please also note that ERES operates and provides its services with close cooperation with its local conference and seminar organisers (hereinafter: ERES ORGANISER(S)) therefore the electronic systems of ERES event registrations are designed to share the information indicated on the Personal Data Information Sheet(s) within the corresponding ERES ORGANISERS. Based on this system structure, it may occur that the data processed by ERES are shared with an ERES ORGANISER while being processed or ERES ORGANISER share personal information with ERES.
In all cases, internal policies and procedures regulate the access to the databases to ensure that while we aim to provide the best service possible, all data processing is in compliance with the legal regulations.
List of ERES ORGANISERS and their contact details are available here:
1.2 Contact details
ERES’s contact details for data protection and privacy-related matters are as follows:
Name: European Real Estate Society
Position: Data Protection Officer
Email address: privacy [@] eres.org
Postal address: School of Architecture Design and Built Environment, Nottingham Trent University,
Shakespeare Street, Nottingham, NG1 4FQ (United Kingdom)
Phone number: +44 (0)115 848 2069
1.3 Designation of data protection officer
Please note that ERES examined the need to appoint a data protection officer according to Article 37 of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, GDPR) and drew the conclusion that ERES is not required to do so in light of the mandatory appointment criteria, in particular, ERES’ core activities do not include processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale. However, since ERES has always added considerable weight to the privacy of personal data, ERES appoints a data protection officer and dedicated sufficient committee, resources to ensure that it is able to discharge its obligations under the GDPR.
Availabilities of the data protection officer:
- · Position: Data Protection Officer
- · E-mail: privacy [@] eres.org
- · Telephone number: +44 (0)115 848 2069
1.4 Websites and services using this privacy policy
This Privacy Policy applies to the privacy practices of ERES’s websites as well concerning all websites operated by ERES (“Websites”), which include, without limitation, the following:
b. https://library.eres.org/ERES_network/
c. https://eres.architexturez.net/
as well as any other services and applications that include a link to this Privacy Policy and as such, sets out the basis on which any personal information we collect from you, or that you provide to us whether on the above websites, or otherwise (for example: in connection with the purchase of a service from us, or when we purchase service from you), will be processed by us. Importantly, this Privacy Policy also applies to ERES’s conference and seminar marketing and promotion practices, as described below. Please be advised that details of each individual data processing include at least the following information:
a. identification and contact details of the data controller if any; identification and contact details of data processor(s);
b. the purpose of processing;
c. the legal basis for the processing;
d. where the processing is based on the legitimate interests pursued by ERES or by a third party then detailed description of this legitimate interest;
e. the recipients or categories of recipients of the personal data, if any;
f. where applicable, the fact that the data is being transferred to a third country (including if access is being granted to another controller/processor from a third country) and how suitable safeguards are provided.
2. GENERAL RULES2.1. GENERAL PRINCIPLES
Personal data shall be:
a. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’)
b. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with GDPR, not be considered to be incompatible with the initial purposes (‘purpose limitation’);
c. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
d. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
e. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
f. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
The data controller shall be responsible for and be able to demonstrate compliance with the above principles (‘accountability’).
2.2. LEGAL BASIS OF THE DATA PROCESSING – LAWFULNESS
Processing shall only be lawful if at least one of the following applies:
a. The data subject has given consent to the processing of his or her personal data for one or more specific purposes – i.e. if you signed a consent form or given your consent via electronic means (pressing consent button or link, etc.).
b. Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract – i.e. in case you are or want to be in a contractual relationship with ERES and the processing of your data is necessary for the performance of the contract. Please note that in such case your separate consent is not required, and your data is processed as long and to the extent, as required for the performance of the contract.
c. Processing is necessary for performance of a conference service to which the data subject is participant in an ERES event and/or is an author or co-author of a paper/presentation submission to an ERES event.
d. Processing is necessary for compliance with a legal obligation to which the controller is subject – i.e. in case an EU or national piece of legislation prescribes for ERES to process your data (data of invoices, data of registrant complaints etc.). Please note that in such case also your separate consent is not required, and your data is processed as long and to the extent, as required and prescribed by law.
e. Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
f. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
g. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
IN ORDER TO MEET THE ABOVE REQUIREMENTS AND TO GIVE YOU PROPER INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA AND YOUR RIGHTS AND OBLIGATIONS, WE COLLECTED THE MOST FREQUENT CASES WHEN WE PROCESS PERSONAL DATA. PLEASE NOTE THAT THE LIST OF DATA PROCESSING IN THIS PRIVACY POLICY IS NOT EXHAUSTIVE; BESIDES WHAT IS DETAILED HEREIN THERE COULD BE OTHER SPECIFIC CASES WHEN WE NEED TO PROCESS YOUR PERSONAL DATA. IN ALL CASES YOU WILL BE ADVISED DULY BEFORE YOUR PERSONAL DATA IS COLLECTED FOR OTHER PURPOSES THAN DESCRIBED IN THIS PRIVACY POLICY. PLEASE BE INFORMED THAT IN CASE YOU ARE USING OUR SERVICES VIA OUR WEBSITES THEN THE DETAILS OF THE DATA PROCESSING ARE DESCRIBED ALSO AT THE GIVEN ERES WEBSITE.
Please note that the below description is a general guideline and advisory and specifics of each data process are detailed on the relevant Website.
3.1 WHAT INFORMATION DOES ERES COLLECT ABOUT YOU?
In case you are using our Websites, ERES collects several types of personal, aggregated and anonymous data about you, which may include the following:
Aggregated Data including statistical, demographical or other data which is related to you, but may not be used to directly or indirectly identify you, and which therefore does not fall as personal data.
Contact Data includes postal address (city, ZIP code, state and country), billing address, delivery address, location, university name, e-mail address, phone number, contact preferences.
Eligibility Data includes information about your location, university name, user status, title, study timeframe, title and topic of your research, your university/institute data and website.
Financial Data includes credit card and bank account information, details about your payments and payment defaults, VAT/TAX ID number if applicable.
Identity Data includes your full name, position, university/institute name, affiliations.
Communications Data includes your preferences in receiving communications from ERES and its affiliates and also upon your consent from third parties and your communication preferences.
Profile Data includes your username and password (you may create it when registering to an ERES event(s)), purchases of conference tickets made by you, your academic interests, preferences, feedback and survey responses and other similar interactions, data collected from and via e-mails and other communications, and other personal data derived from such data and decisions made on the basis of Profile Data.
Technical Data includes referral URL, internet protocol (IP) address, connection IP address, WIFI network (SSID), your login data, browser type and version, time zone setting and location, operating system and platform and other technology on the devices you use to access our websites indicated above.
Transaction Data includes details about payments made by you and other details of services you have purchased from ERES.
Usage Data includes information about how you use our websites, mobile applications, services (including data generated during user interactions on ERES and third party websites, such as registrations, likes and comments, and also data collected automatically via normal IT environment operations.
ERES always indicates whether the provision of certain data is mandatory or optional. Where the provision of a data is mandatory, and you fail to provide it, ERES may not be able to provide the requested service, in which case you will be informed accordingly.
3.2 HOW AND WHERE DOES ERES COLLECTS THIS INFORMATION?
3.2.1 Registration on ERES websites and LOCAL ORGANIZER’s websites
When you register to use an ERES website, Participants registration forms, or any survey or online application that may be available at ERES website or LOCAL ORGANIZER’s websites, ERES collects Identity Data about you. For obtaining a certain scholarship or student discounts, further Eligibility Data is required. When you contact us for support in your registration or related to any ERES activities, we may request from you to provide us with copies of your files, photos, documents or other data (although that might not constitute as personal data).
3.2.2 ERES Websites and Applications
We may collect Technical and Usage Data, including information about how you use our websites and mobile applications with or without registration or log-in. We collect information that your browser or device typically sends to our servers whenever you use on or visit an ERES website, or when an ERES mobile application feature takes you online. For example, your browser or device may tell us your IP address (which may also tell us your location) and the type of browser and device you used. When you visit an ERES Website, your browser may also tell us information such as the page that led you to our website (referral URL). To collect this information, ERES may use cookies (please see our cookie information notice below) and similar technologies, and our servers may collect similar information when you are logged in to the website or mobile application. As mentioned below, you may always refuse or opt-out of the use of cookies or similar technologies. If you identified yourself or registered at a Website or mobile application, this information may be associated with you, or if you have not identified yourself or registered at a Website or application, it will be anonymous.
3.2.3 ERES Emails
Emails we send you, based on your prior written (including electronic means) consent if you are an individual, usually include technologies that tell ERES whether you have received or opened the email or clicked a link within the email. If you do not want us to collect this information from ERES emails, you may withdraw your consent at any time and can either opt-out of receiving ERES emails by clicking “unsubscribe” at the end of the message.
3.2.4 Buttons, Tools, and Content from Other Companies
ERES websites and mobile applications may include buttons, tools, or content that link to other companies’ services (for example, a Facebook "Like" button). Using these features is entirely voluntary, should you decide to use them then please note that we collect information about your use of these features. In addition, please note that when you see or interact with these buttons, tools, or content, or view an ERES website containing them, some information from your browser may automatically be sent to the other company (usually at least a javascript code snippet is downloaded from the webserver of the other company, which action –being a standard web request– sends most of the details listed under the Technical Data). Please read that company’s privacy policy for more information.
3.2.5 Third-Party Websites
ERES websites and mobile applications may contain links to third-party websites. ERES will not transfer any of your data while you are using these links or navigate to a third-party website, in such case, it will be these third parties who will advise you on their data processing and collect information from you, which may include such things as Contact Data, these data processing are governed by the privacy practices of these third parties. We encourage you to learn about the privacy practices of those third parties.
We are also working closely with third parties (including, for example, sister organisations, national associations, supporting organisations, sub-contractors in technical, delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, such as Google, Facebook, and LinkedIn based inside or outside the EU) and we may receive Technical Data or information about you from them that we usually combine with other information we have about you.
3.2.6 Public sources
To help keep our databases current and to provide you with the most relevant content and experience, we may combine information from you with information from public sources and our trusted partners, in accordance with applicable law.
3.2.7 ERES Event(s)
ERES offers different educational services: (i) ERES annual conference (ii) ERES industry seminars (iii) ERES educational seminars (iv) ERES workshops/summer schools; hereinafter: ERES Event(s). These educational services may be offered free of charge or in consideration of certain reimbursement as specified in the relevant terms and conditions.
ERES collects and uses the following personal data: first name, last name, full mail address, Phone number, university/institute name, position, Country. Purpose and legal base of data processing: registering to participation, invoicing, issuing /re-issuing certificate / confirming that certificate has been issued, targeted newsletters about new educational services, targeted emails for feedback, statistical purposes – if you enter into the agreement with ERES then performance of contract and if your company enters into the contract then performance of legal obligation by ERES/legitimate interest.
Data retention period: Minimum of 5 years after the last ERES educational service.
The collected personal data is shared with the current ERES local organiser for the purposes of verifying the educational service on request.
3.2.8 Children's data
ERES does not offer any of its products or services to children under the age of 16 and does not allow children under the age of 16 to register on the Websites.
3.3 FOR WHAT PURPOSES AND ON WHAT BASES DOES ERES USE THE INFORMATION IT COLLECTS ABOUT YOU?
3.3.1 In most cases, ERES will use your personal data on the following legal bases:
Consent: when ERES or its LOCAL ORGANISER send you communications via electronic means, such as e-mail, text messages, personal messages (point a) Article 6(1) GDPR).
Legitimate interest: where processing is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests, and we may verify that a favourable balance of interest test has been carried out (point f) Article 6(1) GDPR).
Performance of contract: where ERES needs to perform the contract we are about to enter into or have entered into with you as natural person (point b) Article 6(1) GDPR).
Legal obligation: where ERES needs to comply with a legal obligation, such as tax or other regulatory obligations and requirements (point c) Article 6(1) GDPR).
3.3.2 By way of background information, in general, legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
3.3.3 Performance of contract means processing your data where it is necessary for the performance of a contract to which you as a natural person are a party or to take steps at your request before entering into such a contract.
3.3.4 Legal obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.
3.3.5 The below table includes a general overview of relevant purposes for which ERES processes your data in the context of various activities, and also the relevant legal basis ERES relies on.
|
Purpose/Activity |
Data type |
Legal basis |
|
Verification of eligibility To check your eligibility for certain ERES services and student discounts |
(1) Identity Data (2) Contact Data (3) Eligibility Data |
Performance of contract (natural persons)/ Legal obligation and Legitimate Interest |
|
ERES Event(s) registration To register you as an attendee, presenter or speaker |
(1) Identity Data (2) Contact Data (3) Profile Data |
Performance of contract (natural persons)/ Legal obligation and Legitimate Interest |
|
Provision of services To provide you with the ERES websites for which you have registered, as well as any services or information you have requested |
(1) Identity Data (2) Contact Data (3) Financial Data (4) Transaction Data (5) Communications Data |
Performance of contract (natural persons)/ Legal obligation and Legitimate Interest |
|
Processing orders and managing payments To process and deliver your orders, including: (1) Manage payments, fees and charges (2) Manage subscriptions, including informing you about the expiration of your subscription (3) Collect and recover money owed to us |
(1) Identity Data (2) Contact Data (3) Financial Data (4) Transaction Data |
(1) Performance of contract (natural persons)/ Legal obligation and Legitimate Interest (2) Legitimate interest to recover debt and outstanding fees |
|
Regular notifications and communications To manage our relationship with you which will include notifying you about changes to our terms or Privacy Policy |
(1) Identity Data (2) Contact Data (3) Profile Data |
(1) Performance of contract (natural persons)/ Legal obligation and Legitimate Interest (2) Necessary to comply with a legal obligation, including the requirement to notify you about changes (3) Legitimate interests (to keep our records updated and to monitor how customers use our services) |
|
Electronic direct marketing To contact you and send you via electronic means (such as e-mail) newsletters, information about the services of ERES, local organisers, sister organisations, and other parties, to make suggestions and recommendations to you about services that may be of interest to you |
(1) Identity Data (2) Contact Data (3) Profile Data |
Consent |
|
Transfer of personal data to LOCAL ORGANISERS for direct communications purposes To ensure our LOCAL ORGANISERS may also contact you and send you via electronic means (such as e-mail) newsletters, information about their services, to make suggestions and recommendations to you about services that may be of interest to you |
(1) Identity Data (2) Contact Data (3) Communications Data |
Consent |
4. WHAT ARE COOKIES AND HOW DOES ERES USE THEM?
4.1 A cookie is a small piece of information that will be stored on your hard disk until it expires or you delete it. Like most websites and applications, we use our own cookies and those of third parties, together with similar technologies, to make our websites and applications work, to offer you customized and personalized service, and to learn more about our users and their likely interests. In any case, we always chose the shortest lifetime of the cookie that is possible for the required task. Cookies themselves don't hold personal information. They only have a unique alphanumeric identifier that sits on your browser. And in many cases, we won’t be able to link the information we collect by using a cookie back to you. They can, however, enable us to link that information back to you and your personal information, for example, when you log in, or choose to register for a service, product or newsletter.
4.2 ERES and third-party vendors including but not limited to Google and Facebook use first-party and third-party cookies and related user behaviour tracking technologies to measure desktop software, mobile application and website usage; record different user activities in its software and on its web sites; and display advertisements based on the user’s previously recorded activities. ERES does not disclose any personally identifiable information to these third-party vendors. However, third-party vendors automatically receive IP addresses when activity tracking occurs. ERES may connect user activity data gathered by third-party vendors with information collected by its websites and applications, and such data may, therefore, become Profile or Usage Data.
4.3 You can set your browser so that the browser informs you about cookies or automatically prevents their storage. If you do not store our cookies, you will still be able to visit our website or use our services; however, the use of individual offers or features might be limited. In particular, ERES services that require login will not work without session cookies.
4.4 You can also prevent your data from being used by third-party vendors by installing browser extensions, such as: http://www.aboutads.info/PMC; https://tools.google.com/dlpage/gaoptout/. Or setting your preferences at web sites like: http://www.youronlinechoices.com/uk/your-ad-choices; http://www.networkadvertising.org/choices/; https://www.google.com/settings/u/0/ads/anonymous.
4.5 For more information about the cookies, please visit ERES currently uses on its websites, please see our COOKIE POLICY at https://www.eres.org/cookie-policy.
5. DOES ERES SHARE/DISCLOSE MY PERSONAL DATA?
(A) DISCLOSURE TO DATA PROCESSORS
5.1 ERES as a foundation is subject to authority reviews, the course of which we could be obliged to share your data with the authorities. These obligations are imposed on ERES by laws and regulatory decisions, and we are legally bound to fulfil these requirements.
5.2 ERES also works with universities, institutes, and companies that help us run our foundation. Among these are the LOCAL ORGANISERS and even companies that are not linked to ERES providing services for us. These services vary in subject and term: external consultants, professional advisors such as lawyers or auditors, technical support functions (IT and document storage providers, professionals delivering customer support and sending emails on our behalf). These are called data processors are engaged in all cases based on a written contract with appropriate guarantees to safeguard the security of the data and the rights of the data subjects. In some cases, these companies have access to some of your personal information in order to provide services to you on our behalf. They are not permitted to use your information for their own purposes, and we ensure by data processing contracts (including electronic format) that your data are being processed in accordance with the legal regulations.
5.3 Currently, ERES is using the following data processors:
|
Name |
Full postal address |
Activity |
|
Hostpoint AG |
Neue Jonastrasse 60, 8640 Rapperswil-Jona, Switzerland |
Data hosting |
|
The Rocket Science Group, LLC d/b/a MailChimp |
675 Ponce de Leon Avenue NE, Suite 5000, Atlanta, GA 30308, United States |
Marketing automation, including email campaigns, landing pages, profiling |
|
UAB MailerLite |
J. Basanavičiaus g. 15, Vilnius, Lithuania |
Marketing automation, including email campaigns, landing pages, profiling |
|
Google, Inc. |
1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA |
processing of user traffic and analytics data |
|
Wirtschaftsuniversität Wien |
Welthandelsplatz 1, 1020 Vienna, Austria |
Data hosting |
5.4 Further to the above, as indicated earlier, ERES provides its services in close cooperation with its local organisers; therefore it is frequent that an ERES ORGANISER acts as data processor on behalf of ERES.
(B) DISCLOSURE TO OTHER DATA CONTROLLERS
5.5 In other cases, we provide your data to other entities to use such data under their own name and for their own benefit. Sometimes we may need to do this to comply with a legal obligation and in other cases, we rely on other legal grounds, such as our legitimate interests or your written (including electronic means) consent.
5.6 Accordingly, if you consent to the sharing, as indicated above in the table, ERES may also share your Identity Data, Contact Data and Communications Data with ERES LOCAL ORGANISERS. Please note that we do not share personal information about you with third parties for their own communication purposes unless you agreed to that sharing.
5.7 We may share or publish Aggregate Data that doesn’t specifically identify you, such as statistical information about visitors to our websites or statistical information about how customers use our applications.
5.8 We require all third parties to respect the security of your personal data and to treat it in accordance with the law and the data processing contract if any. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
(C) MAKING YOUR DATA PUBLICLY AVAILABLE BY YOU
5.9 There are several places on ERES’s websites that present your publications or your academic information (including but not limited to ERES library or seminar publications) for others to see and there are some places where what is shared can be seen by the general public. Please be aware when you share your conference publication and personal information. Do not share anything in annual conferences or seminars that you do not want publicly known unless you are sure you agree to share such information with the public. Please note that when your conference or seminar information published on our websites and applications, your email address or name may be included and displayed with your conference or seminar information.
5.10 To remove content you have shared with us through ERES Event(s) and it is published on our websites and/or mobile applications, please contact us. Also, if you have questions or concerns about this, please contact us.
6.1 As indicated above, we share your personal data within the LOCAL ORGANISERS as follows:
a. You provide us with certain personal data when registering at our Websites. In such case, if you consent to the sharing, as indicated above in the table, ERES as data controller may also share your Identity Data, Contact Communications Data with ERES ORGANISERS.
b. ERES ORGANISERS may use our online registration forms or attendee’s data sheets and when using it may fill in certain personal information about you. This is always the decision of the given ERES ORGANISER. In such case, the ERES ORGANISER is the data controller, and ERES is an only data processor of the ERES ORGANISER in order to provide the educational service.
These transfers will involve transferring your data outside the European Economic Area (EEA).
6.2 Also, since many of our external third parties are based outside the European Economic Area (EEA) (such as Google, Inc., The Rocket Science Group, LLC d/b/a MailChimp), so their processing of your personal data will involve a transfer of data outside the EEA.
6.3 Whenever we transfer your personal data outside of EEA, we contractually ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
a. we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
b. where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
c. where we use providers based in the US, we may transfer data to them if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US. For further details, see European Commission: EU-US Privacy Shield.
6.4 Please do contact us if you need further information on the specific mechanism used by us when transferring your personal data outside of EEA.
7. IS MY PERSONAL DATA SECURE, AND WHERE WILL IT BE STORED?
7.1 We understand that the security of your personal information is important. We provide reasonable administrative, technical, and physical security controls to protect your personal information. All information you provide us is stored on secure servers. Where you have chosen (or we have given you) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot warrant or guarantee the security of your data transmitted to us; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. In case your data is provided by registering on our websites than we ensure that this registration is completed on a secured platform where we apply our security measures. In case you would like to have more information on the specific security measures taken in order to save your data than please contact us.
7.2 Also, we have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
7.3 Finally, we have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7.4 Your personal information and data files are stored on ERES’s servers and the servers of companies we hire to provide services to us. As shown in clause 7 above, your personal information may be transferred across national borders because we have servers located worldwide and the companies we hire to help us run our business are located in different countries around the world (for example, Switzerland, Lithuania, the United States). As mentioned in clause 7 above, the data that we collect from you may, therefore, be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order and the provision of support services.
8. HOW LONG WILL ERES HOLD AND USE MY PERSONAL DATA?
8.1 We only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
8.2 To determine the appropriate retention period for personal data, we take into account the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
8.3 More specifically, and without limiting the generality of the foregoing, by law, we have to keep basic information about our Participants (including Contact, Identity, Financial and Transaction Data) for at least 5, in certain cases 8 years after they cease being active registered member for tax, financial auditing, and record-keeping purposes.
8.4 In some applicable circumstances you can ask us to delete your data: see the clause dealing with ‘Right To Erasure’ below for further information.
8.5 In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
9. YOUR RIGHTS REGARDING YOUR PERSONAL DATA
9.1 Your right to access
You have the right to access your personal data, including requesting information on whether ERES processes your data, which data are processed, and you may also request a copy of the data that you or a third person provided to ERES and which data is being processed by ERES.
If you request that ERES confirm whether or not ERES processes your personal data, then you have the right that obliges ERES to confirm that it processes your personal data, or does not process your personal data.
Your right to obtain confirmation whether ERES processes (or does not process) your personal data
a. does not include data that is anonymous;
b. includes the personal data that concern you;
c. does not include personal data that does not concern you; and
d. includes pseudonymous data that can be clearly linked to you.
ERES shall give you access to your personal data if
a. you request ERES to confirm whether or not it processes your personal data, and
b. ERES confirms that it processes your personal data, and
c. you request access to your personal data.
ERES shall provide you with a copy of your personal data if
a. you request ERES to confirm whether or not it processes your personal data, and
b. ERES confirms that it processes your personal data, and
c. you request a copy of your personal data.
If you request further copies of your personal data, then ERES may charge you the fee of EUR 25 based on the administrative costs incurred in relation to the accommodation of such request.
Upon your request ERES will give you access to the following information:
a. the purposes of the processing;
b. the categories of personal data concerned;
c. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d. where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e. the existence of your right to request from ERES rectification or erasure of your personal data or restriction of processing of personal data concerning you or to object to such processing;
f. the right to lodge a complaint with a supervisory authority;
g. where your data are not collected from you, any available information as to their source;
h. the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Please also note that many of our websites and applications allow you to access or edit your personal information by accessing your account information or a similar feature of the website or application you are using. Likewise, you can access files or photos you have stored in our online services by logging in and using the functions they make available.
9.2 Your right to rectification
You have the right to the correction of your personal data without undue delay. This enables you to ask that any incomplete or inaccurate data we hold about you be corrected.
Your right to obtain rectification of your data that are inaccurate
a. does not include data that is anonymous;
b. includes the personal data that concern you;
c. does not include personal data that does not concern you; and
d. includes pseudonymous data that can be clearly linked to you.
ERES shall rectify your personal data if
a. ERES processes your personal data, and
b. the personal data in question are inaccurate, and
c. you request the rectification of your personal data.
ERES shall complete your personal data if
a. ERES processes your personal data, and
b. the personal data in question are incomplete, and
c. you request the completion of your personal data, and if necessary, you provide supplementary information for completion.
ERES may verify any and all data provided to it. ERES shall be taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the rectification of your personal data to recipients of such personal data (if any). However, ERES shall not communicate the rectification of personal data to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.
9.3 Your right to erasure (‘right to be forgotten’)
Subject to certain conditions and in certain cases, you have the right to the erasure of your personal data. This means that you may request that we delete your personal data that we may have processed unlawfully or where the use of your data is no longer needed for a purpose. Please keep in mind that ERES may not be able to meet your request for specific legal reasons that will be notified to you, if applicable.
ERES shall erase your personal data without undue delay if
a. ERES processes your personal data, and
b. you request to obtain the erasure of your personal data, and
c. the personal data are no longer necessary to the purposes for which ERES collected them;
ERES shall erase your personal data without undue delay if
a. ERES processes your personal data based on your consent, and
b. you request to obtain the erasure of your personal data, and
c. you withdraw your consent on which the processing of your data is based, and
d. there is no alternative legal basis for the processing of your data any further.
ERES shall erase your personal data without undue delay if
a. the processing is based on being necessary for the purposes of the legitimate interests of ERES or a third party, and
b. you object to ERES’s processing of your personal data, and
c. the legal ground for the processing of your personal does not override your objection.
ERES shall erase your personal data without undue delay if
a. you request to obtain the erasure of your personal data, and
b. the processing by ERES of such data is unlawful, or
c. if the erasure is required under applicable law, or
d. your data is collected in relation to the offer of an information society service.
ERES shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the erasure of your personal data to recipients of such personal data (if any). However, ERES shall not communicate the erasure of personal data to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.
Please note that there are certain cases when you may not request the erasure of your data. These reasons will be communicated to you if your request for erasure cannot be completed.
9.4 Your right to the restriction of processing
You may also request the restriction of the processing of your personal data. For instance, you may request that we suspend the processing of your personal where our use of the data is unlawful, but you do not want us to delete it.
Your right to request the restriction of the processing of your personal data
a. does not include data that is anonymous;
b. includes the personal data that concern you;
c. does not include personal data that does not concern you; and
d. includes pseudonymous data that can be clearly linked to you.
ERES shall restrict the processing of your personal data for a period to verify the accuracy of such data if you request to obtain the restriction of the processing of your personal data, and you contest the accuracy of such data.
ERES shall restrict the processing of your personal data if you request to obtain the restriction of the processing of such data, the processing of which is unlawful, and you oppose the erasure of such data.
ERES shall restrict the processing of your personal data if
a. you request to obtain the restriction of the processing of such data, and
b. ERES does not need such data for the purposes of its processing, and
c. you require your data for the establishment, exercise or defence against a legal claim.
ERES shall restrict the processing of your personal data if
a. you object to the processing of your personal data that are necessary for the purposes of the legitimate interests that ERES pursues, and
b. you wait to verify that the legitimate ground of ERES’s processing of your personal does not override your objection.
ERES shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate the restriction of processing of your personal data to recipients of such personal data (if any). However, ERES shall not communicate such restriction to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.
If ERES restricts its processing of your personal data, then it may
a. store such personal data,
b. process such personal data on the basis of your consent,
c. process the personal data for establishing, exercise or defend a legal claim, or for protecting the rights of another person.
In case you have obtained restriction of processing as per the above than you shall be informed by ERES before the restriction of processing is lifted.
9.5 Your right to data portability
Where the processing of your data is either based on your consent (e.g. in respect of electronic direct communications), or is necessary for the performance of a contract (e.g. conference attendees registration data and data relating to your conference ticket), and the processing is carried out by automated means, then you may request the provision of your personal data that you have provided to us in a standard format, and you may also request that such data be transferred to another entity.
Without prejudice to your rights above, you have the right to receive the personal data concerning you, which you provided to ERES, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance (where technically feasible) from ERES, where the processing is based on your consent or is necessary for the performance of a contract, and the processing is carried out by automated means.
Your right to data portability
a. does not include data that is anonymous;
b. includes the personal data that concern you;
c. does not include personal data that does not concern you; and
d. includes pseudonymous data that can be clearly linked to you.
9.6 Your right to object
Importantly, when we process your data on the basis of our legitimate interests as indicated in the above table, you may object to such processing and request that any of those activities be stopped. Similarly, you may opt-out of any of our direct communications at any time by contacting us at privacy [@] eres.org or by using the ‘unsubscribe’ function at the end of our messages.
9.7 Your rights in relation to automated decision making and profiling
You have the right to request not to be the subject of automated decision-making including profiling where the decision produces legal effects or equally has a significant effect on you, and can insist on human intervention where appropriate.
There are exceptions to this right, which are, if the decision:
a. Is necessary for concluding or performing a contract
b. Is authorised by law
c. Is based on the data subject’s explicit consent
9.8 Your right to withdraw consent
Also, you have the right to withdraw your consent at any time where we rely on your consent for processing your data (e.g. for certain electronic direct communication purposes). You may do this at any time by contacting us at privacy [@] eres.org or by using the ‘unsubscribe’ function at the end of our messages. Remember that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal and that in some cases, we may need time to process request.
ERES shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to communicate your objection/withdrawal of consent to recipients of such personal data (if any). However, ERES shall not communicate such restriction to recipients if the communication to such recipients is either impossible or involves a disproportionate effort.
9.9 Your right to lodge a complaint
Without prejudice to any other administrative or judicial remedy that you may have (such as the right to claim compensation for damages suffered as a result of ERES’ breach of the GDPR), you have the right to lodge a complaint with the Dutch Data Protection and Freedom of Information Authority, supervisory authority, or another data protection supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR.
The contact details of the Dutch Data Protection Authority (Dutch DPA) are as follows:
Postal Address: Autoriteit Persoonsgegevens, PO Box 93374, 2509 AJ DEN HAAG;
phone: (+31)-(0)70- 888 85 00; fax: (+31)-(0)70-8888501;
e-mail: q.snijders [@] autoriteitpersoonsgegevens.nl;
website: https://autoriteitpersoonsgegevens.nl/
In any case, we would highly appreciate the chance to deal with your concerns before you approach the regulatory authority above, so please contact us in the first instance if you have any problems.
9.10 Restrictions on the above rights
Please be advised that based on GDPR Member States are allowed to restrict by way of a legislative measure, the scope of the rights you may have as per the above. In case such restriction is applicable in your respect, we will advise you accordingly when you contact us on exercising any of your above rights.
9.11 Contact details
If you wish to exercise any of your rights mentioned above, please contact us at the addresses set out in clause 1.2 above.
9.12 No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a fee of EUR 25,- if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
9.13 Verification of your identity
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
10. CHANGES TO THIS PRIVACY POLICY
This Privacy Policy is effective as of the date indicated on the top. Earlier versions may be obtained by contacting us at privacy [@] eres.org. We will inform you in case of any changes to this Privacy Policy in due course.
ERES PRIVACY POLICY | Version 1.0 | published 01/08/2020 | effective as 01/08/2020