The entity identified above processes the personal data of those registering for this congress, acting as its technical secretariat and as the party with whom the registration is entered into. This policy supplements the general terms and conditions.
What data we process
- Identification and contact data: first name and surname, email address and telephone number.
- Professional data: the entity, institution or organisation you belong to and, where applicable, your role or attendee category.
- Billing data: name or company name for tax purposes, tax identification number and billing address, where you request an invoice in your own name or in the name of an entity.
- Registration data: ticket type, attendee category, additional activities and services purchased, and any access or discount codes used.
- Additional form data: the supplementary information requested in the registration form, such as the reference of the scientific contribution submitted, membership of professional or scientific societies, or participation in specific programme activities.
- Payment transaction data: method chosen, amount, status and transaction reference. We do not process or store your card details: they are entered directly into the payment provider's secure environment and are never accessible to the organisation.
- Companion data: the names of those for whom you purchase welcome reception or conference dinner tickets.
- Record of communications: evidence of the confirmation messages and documentation sent to your email address, for proof of delivery.
- Technical browsing data: strictly what is needed for the form and the payment to work, detailed in the cookie policy linked at the foot of this page.
Purposes and legal bases
- Managing your registration: completing it, confirming it and giving you access to the congress and the activities purchased. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Processing payment and issuing documentation: proforma invoice, receipt and invoice, applying the corresponding VAT. Legal basis: performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c) GDPR).
- Issuing badges and managing access to the congress sessions and activities. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Please note that the badge issued to you will show your name and your affiliation, and will be visible to other attendees during the congress.
- Sending you the communications required about your registration and about the running of the congress: confirmations, payment documentation, changes of programme or venue, and logistical information. These are not marketing communications and you cannot unsubscribe from them while your registration is active. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Handling cancellations, refunds and attendee substitutions on the terms set out in the general terms and conditions. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
- Complying with tax, accounting and commercial obligations arising from the registration. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
- Ensuring the security of the platform and preventing payment fraud. Legal basis: legitimate interests (Art. 6(1)(f) GDPR), as recognised in recitals 47 and 49 GDPR.
- Sending you information about future editions, only if you expressly and separately tick the corresponding box on the form. Legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw it at any time without affecting your registration or the lawfulness of processing carried out beforehand.
- Documenting and promoting the congress through photographs and recordings taken during the event, on the terms of the following section. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) for general event imagery, and consent (Art. 6(1)(a) GDPR) for images in which you appear identifiably as the main subject.
Photography and video during the congress
Photographs are taken during the congress and video recordings may be made, for the purpose of documenting the event and promoting its scientific activity. Three situations are distinguished:
- General imagery. Wide shots of the rooms, sessions and programme activities in which no individual is the main subject of the image. These are processed on the basis of the organisation's legitimate interest in documenting and promoting the congress. In balancing that interest against your rights, account has been taken of the fact that this is a professional event, attended voluntarily, and that the images are not used for any purpose beyond promoting the congress itself.
- Identifiable individual images. Portraits, close-ups and photographs in which you are the main subject. These are captured and published only with your consent, which you may withdraw at any time.
- Programme contributions. If you take part as a speaker, chair or presenter, your public intervention in a session is documented as part of the scientific content of the congress.
Images may be published on the congress website, in the edition's proceedings and on the institutional channels of the organisation and the Organizing Committee. They are not disclosed to third parties for advertising purposes, are not used for profiling, and are not subjected to facial recognition systems.
How to object. You may object to appearing in the imagery, or request the removal of a specific photograph already published, by writing to the contact address given at the top of this page. Informational signage will be displayed during the congress in the areas where images are captured, and you may also tell the organisation's staff directly at any time.
Third-party data you provide to us
If you purchase tickets for companions or request an attendee substitution, you will be providing us with another person's data. In doing so you confirm that you have their authorisation and that you have informed them of the content of this policy. That data is processed solely to issue their badge and manage their access to the activities purchased, and is kept for the same periods as the rest of the registration data.
Who else has access to your data
The following act as processors, under a contract compliant with Article 28 GDPR and without being able to use the data for their own purposes — the technology providers essential to delivering the service:
- The registration platform provider, which gives technical support to the registration form and the attendee portal.
- The payment service provider, which processes the card payment.
- The transactional email provider, which delivers confirmations and documentation.
- The database and file hosting provider.
In addition, your identification and registration data may be disclosed to:
- The Congress Organizing Committee, which accesses identification and registration data in order to prepare attendance lists, organise the sessions and manage the scientific programme.
- The institution hosting the congress, which accesses the data needed for access control to its premises and for the organisation of the services contracted there.
- Public authorities and competent bodies, where a legal obligation so requires, in particular in tax matters.
We do not disclose your data to sponsors or exhibitors, whether for advertising or any other purpose. If, during the congress, you choose to give your details to a sponsor voluntarily — for example by handing over your card or allowing your badge to be scanned at their stand — that sponsor becomes the controller of those data, under its own terms and privacy policy, which fall outside this one.
We do not process accommodation data. Hotel bookings are made directly with the establishments, which are independent controllers of the data you provide to them.
International transfers
The providers listed process data within the European Economic Area or, where any operation takes place outside it, under a European Commission adequacy decision or Standard Contractual Clauses together with the supplementary measures required. You may request information about these safeguards at the contact address given above.
How long we keep your data
- Registration data: for the duration of the congress and until any incident, complaint or refund request arising from it has been resolved.
- Tax and accounting documentation: four years from the end of the corresponding filing period, under Article 66 of the Spanish General Tax Act, and six years from the last entry, under Article 30 of the Spanish Commercial Code. The longer applicable period prevails.
- Data processed on the basis of your consent: until you withdraw it.
- Photographs and recordings: for as long as the corresponding edition of the congress continues to be promoted, and in any case until you exercise your right to object or withdraw your consent. They may subsequently be kept in the congress's historical archive, without active publication.
- Attendee portal access links: single-use, expiring automatically a short time after being issued.
- Record of communications sent: for as long as needed to evidence delivery and handle complaints.
Once those periods have elapsed, the data is deleted or duly blocked under Article 32 of Spanish Organic Act 3/2018, remaining available solely to judges, courts and competent authorities until any potential liabilities are time-barred.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where consent is the legal basis, by writing to the contact address given at the top of this page and proving your identity. We will reply within one month, extendable on the terms of Article 12(3) GDPR.
Please note that the right to erasure is not absolute: data incorporated into tax and accounting records must be kept for the legal periods indicated, even if you request its deletion.
If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es), without prejudice to contacting us first.
Automated decision-making
No automated decisions producing legal or similarly significant effects are taken, and no profiling is carried out with your data.
Updates
This policy will be reviewed whenever the processing described or the applicable law changes. The version in force is the one published on this page.