PRIVACY STATEMENT OF STICHTING NEDERLANDS CONTACTLENS CONGRES
Version August 2018
Stichting Nederlands Contactlens Congres (Dutch Contact Lens Congress Foundation, hereafter “NCC”) processes personal data (hereafter “Personal Data”) of participants (hereafter “Participant(s)”) in the Dutch Contact Lens Congress, a biannual event organised by NCC (hereafter “Event(s)”).
These Participants can be divided into:
- Persons visiting the Event (“Visitors”);
- Businesses (and their contact persons) exhibiting at the Event in order to present their product portfolios (“Exhibitors”);
- Persons speaking at the Event (“Speakers”).
Note: in general Exhibitors are also registered as Visitors of the Event by a registration as Visitor via the website of NCC. In this is the case, for them applies the information provided under Visitor and the information provided under Exhibitor.
The purpose of this Privacy Statement is to inform Participants about the processing of their Personal Data. NCC is the party responsible for compliance with the privacy legislation relating to these processing operations (referred to as the controller in this privacy legislation). NCC’s contact details can be found at the end of this privacy statement.
- For what purposes does NCC process the Personal Data, and on what legal basis?
Organisation of the Event
NCC needs to process a Visitor’s Personal Data for the purpose of organising the Event, which includes processing the Visitor’s registration for the Event, handling the Visitor’s payment, providing additional services to the Visitor and maintaining contact with the Visitor in the context of the Event.
If the Visitor opts to pay by credit card, iDeal or Billink, the payment is processed by pay.nl. Further information can be found in the privacy statement of pay.nl, which can be found on https://www.pay.nl/privacybeleid. Subsequently pay.nl provides NCC with the following Personal Data: payment date, payment method, the amount paid and the associated Visitor name.
The legal basis for this is the necessity of such processing operations for the performance of the agreement between the Visitor and NCC. Alternatively, the processing of Personal Data may serve the legitimate interest of NCC in offering customer-focused services around the Event and ensure adequate customer relationship management.
NCC processes education numbers (KP/KABIZ) of the Visitor for the purpose of issuing the Visitor with an education certificate. In this way, NCC offers the Visitor the opportunity to gain education credits for the Event in question.
Visitors are asked to grant their express consent for the processing of their Personal Data in relation to this purpose, which concerns the legal basis for the processing.
Evaluation of the Event
NCC uses the Visitor’s contact details in order to send out a post-Event survey, to be completed by the Visitor, for the purpose of evaluating the Event. The legal basis for this processing operation lies in NCC’s legitimate interest in evaluating and improving its services in relation to the organised Event.
Announcement of the next Event
The Visitors of an Event will be informed by NCC about the subsequent Event. The legal basis for this lies in NCC’s legitimate interest in an adequate customer relationship management. The Visitor may object to this at any time, after which NCC will quit the processing of Personal Data of the Visitor for this purpose.
Effective from 2019, NCC may start sending out newsletters in order to inform Visitors about the latest developments in the contact lens sector. Visitors will first be asked to grant their express consent for this, which concerns the legal basis for this processing of Personal Data.
NCC processes the Exhibitors’ Personal Data for the purpose of communication with Exhibitors in respect of the Event, for invoicing the Exhibitor and for the collection of payments.
The legal basis for these processing operations lies in the necessity of these operations for the performance of an agreement with the Exhibitor. Alternatively, the processing of Personal Data may serve the legitimate interest of NCC in offering customer-focused services around the Event.
NCC processes the Speakers’ Personal Data for the purpose of announcing the programme of the Event, through channels such as its website, for providing relevant information to the Speaker about the Event and for arranging payment of the fees to the Speakers.
The legal basis for these processing operations lies in the necessity of these operations for the performance of an agreement with the Speaker. Alternatively, the processing of Personal Data may serve the legitimate interest of NCC in promoting the Event and offering customer-focused services around the Event.
Note: The Personal Data which NCC requests from the Visitors, Exhibitors and Speakers prior to concluding an agreement are necessary in order to conclude the relevant agreement, unless NCC has indicated otherwise.
- To whom is the Personal Data provided?
NCC provides the Participant’s Personal Data only to third parties and persons within its organisation who need the Personal Data for the achievement of the purposes referred to in section 2. Third parties receiving the Personal Data include:
– the IT services provider (Square Concepts);
– the party supporting NCC for communication purposes (Mailchimp);
– the caterer of the Event (NH Conference Centre Koningshof);
– the party supporting NCC in keeping the accounting records (Brabers).
The third parties to which NCC provides the Participant’s Personal Data are located in the Netherlands, except for Mailchimp, which is located in the United States.
In order to achieve the purposes set out above, it may also be necessary for NCC to transfer the Participant’s Personal Data to countries outside the European Economic Area. On such occasions, NCC will ensure at all times that the Participant’s privacy rights remain guaranteed. For example, NCC may provide Personal Data to parties based in the United States, insofar as such parties have been certified under the EU-US Privacy Shield Framework (which is the case for Mailchimp) or other appropriate safeguards have been provided regarding the privacy of the Participant.
- For how long is the Personal Data retained?
The following retention periods apply with regard to the Personal Data. Participants wishing to receive further information about the retention periods applied by NCC can send an e-mail to email@example.com.
The point of departure is that the Personal Data of the Visitor/Exhibitor is retained each time for a period up to and including the next Event. If the Visitor/Exhibitor does not take part in the next Event, the Visitor/Exhibitor will be asked after that Event to grant his/her express consent for the retention of the Personal Data until two months after the following Event. If this consent is refused, the Personal Data will be removed within two months. The Visitor/Exhibitor also has the right to withdraw his/her consent for the longer storage of the Personal Data. In that case, too, the Personal Data will be removed.
The Personal Data of a Speaker at an Event, will be removed within 2 months after the next Event.
ALL PARTICIPANTS: FISCAL RETENTION PERIOD
With respect to the fiscal retention obligation, certain financial data (such as the data included in the invoice) regarding the Participant will be stored 7 years.
- What are the Participant’s rights?
Under the privacy legislation, the Participant has a number of rights in relation to the processing of Personal Data by NCC. The privacy legislation attaches conditions to exercising these rights, which are applied by NCC. Therefore, it is possible that NCC will not honour a Participant’s request to exercise a right in a particular case.
The Participant has the following rights:
- the right to access his/her Personal Data;
- the right to correction or removal of his/her Personal Data; Via ‘Mijn NCC’ (‘My NCC’), the Visitor/Exhibitor can easily alter the data stated there.
- the right to restriction of the processing of Personal Data relating to him/her; Briefly put, this concerns a temporary lock on the Personal Data until an objection or problem has been resolved.
- the right to object against the processing based on a legitimate interest in order to end this processing; If the Participant objects against a particular Personal Data processing operation based on a legitimate interest, NCC will cease that Personal Data processing operation, unless NCC has compelling legitimate grounds for the Personal Data processing which outweigh the Participant’s interests. However, if the Visitor objects to the processing of his/her Personal Data in the context of the announcement of subsequent Events, this processing will be ceased as soon as possible.
- the right to data portability; and Briefly put, this concerns the Participant’s rights to retrieve particular Personal Data and (optionally) transfer this data to a third party.
- the right to withdraw consent granted for a Personal Data processing operation; If NCC applies the legal basis of consent for a particular Personal Data processing operation (see above), the Participant will have the right at all times to withdraw this consent. In that case, NCC will cease that Personal Data processing operation.
Participants wishing to exercise any of these rights can contact NCC. They can do so by sending an e-mail to firstname.lastname@example.org
Participants also have the right to lodge a complaint with the Personal Data Protection Authority (Autoriteit Persoonsgegevens) (https://autoriteitpersoonsgegevens.nl/).
- What procedure is followed in the event of an amendment of this Privacy Statement?
This Privacy Statement may be amended from time to time if new developments give cause for doing so. Participants can always view the most recent Privacy Statement on this page. If the Privacy Statement is amended, NCC will communicate this on its website.