Data Protection Notice

Last updated: 21 September 2023

This data protection notice will be reviewed from time to time to take into account changes in the law and the experience of the notice in practice.

If you have any queries in relation to this data protection notice, or if you have any concerns as to how your data is processed, please contact [insert name of data protection officer or relevant contact] at [insert relevant contact details].

Who are we?

Founded in November 2018, the European Association of Data Protection Professionals (EADPP) was the first independent pan-European non-profit organization dedicated to individuals worldwide who are interested in the GDPR. By connecting professionals and fostering collaboration the EADPP strives to advance data privacy best practices across Europe and beyond.

EADPP is the "Data Controller" within the meaning of GDPR and we are responsible for deciding how we collect, store, use and process personal information about you.

Our registered address is
European Association of Data Protection Professionals
Thomas R. Malthusstraat 1
1066 JR Amsterdam
The Netherlands

For requests related to your rights or for any questions about this privacy notice and the processing of your personal information, please contact us at: dpo@eadpp.eu

About this statement

EADPP have created this data protection notice as the controller of personal data for visitors to this website, for prospects, clients and former clients. This notice aims to demonstrate our firm commitment to privacy and to inform people dealing with us about the information we collect and process in connection with such interaction.

This notice sets out an explanation of what personal data about you we process, why we process your personal data, with whom your personal data is shared and a description of your rights with respect to your personal data.

Personal data we process

We need to keep and process certain personal data about you to manage our business, for management purposes, to comply with our legal obligations and, where necessary, to protect our legitimate business interests. We will collect and process personal data from you during your visit on this website, during our contractual relationship and following the termination of our contractual relationship.

Personal data is normally obtained directly from you.

Use your personal data

The information we hold and process will be used for management and administrative purposes. We keep it and use it to enable us to run our business, manage our contractual relationship with you effectively, lawfully and appropriately and protect your rights and interests. This includes using your information to enable us to manage contracts, comply with legal obligations, pursue our legitimate interests and protect ourselves in the event of legal proceedings against the company.

The uses we make of each category of your personal data, together with the lawful basis we rely on for those uses are set out in more details below.

Where there is a need to process your data for a purpose other than those set out in the appendix or otherwise outlined to you, we will inform you of this.

Sharing personal data

We handle your personal data with care and refrain from disclosing it to external parties unless we are legally obliged to do so.

More detailed information on how we share your personal data is set out below.

Personal data transfers

The website datacentre is located in Ireland,

The transfer of personal data is explained in more detail below.

Retention of ersonal data

Our data retention criteria are based on the statutory retention periods necessary to fulfill our legal obligations. After the end of those periods, your personal data will be securely deleted, if it is no longer necessary for the fulfilment of a contract, the initiation of a contract, or in relation to any legal proceedings. We may keep anonymized data for statistical and research purposes.

Provision of personal data

In some cases, you may decline to provide us with your personal data. If we believe that we require relevant personal data to effectively and properly manage our contractual relationship or legal obligations, we may not be able to continue our relationship with you.

Profiling

We do not carry out automated decision making or any type of automated profiling.

Your rights explained

Under the GDPR, you have rights in relation to your personal data that we hold, please note that these rights are not absolute and may have some restrictions:

Access: the right to receive a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
Rectification: the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information, you may request that we update the information such that it is complete.
Objection: the right to object to our use of your personal data or the way in which we process it for certain purposes.
Restriction of Processing: the right to in certain circumstances, to request that we no longer process your personal data for particular purposes. (This just means you can ask us to stop using it for the reasons we have been using it.) This may mean that we have to delete your account.
Erasure: the right, in certain circumstances, to request that we erase your personal data
Data Portability: the right, in certain circumstances, to transfer your personal data to another organisation where it is technically possible.
Review Automated Decisions: the right to object to automated decision making and/or profiling.
Withdraw your consent: In case of data processing based on your consent, you have a right to withdraw your consent on the Portal.
Lodge a complaint: If you are not satisfied with EADPP’s replies to your data requests, you have a right to lodge a complaint with the competent supervisory authority. The Dutch DPA (Autoriteit Persoonsgegevens), is the independent regulator in the Netherlands https://autoriteitpersoonsgegevens.nl/een-tip-of-klacht-indienen-bij-de-ap

Please note that your ability to exercise these rights may be subject to certain conditions.

Details of Processing Activities

Visitor to the website

Profiling: No

Data shared: No

Transfer outside the EEA: No

Processing of special categories of data: No

Processing of children data: No

Processing of criminal data: No

Encryption of data in transit: Yes

Encryption of data at rest: Yes

Lawful basis:

Legitimate interest

Personal data processed

Your IP address,
The page viewed
The time the page was viewed
The browser you used to view the page.
We do not cross reference the log with the enquiry, but we reserve the right to do so should we be concerned about the security of our operations.
The web server logs are normally kept for 6 months or less.
The personal data is stored in Ireland.

When you open a link to a 3rd party website from our website, we passively collect the following personal data to gauge the engagement with external links we post:

your country (we do not store the IP address),
the time,
the link visited
your browser type.(Chrome / Firefox..)

Retention period

Log files are kept for a maximum of 6 months.

Security measures in place

The transfer of the website content between your browser and our server is secured through TLS 1.2 encryption. You can verify by clicking the padlock on your browser.

We use encryption at rest.

Our servers are located in ISO 27001 accredited datacentres in Ireland.

Sharing of personal data

The information may be used by our staff.for security investigations
The logs may be accessed by our web infrastructure provider Bizoneo. Bizoneo is based in Ireland and will only access the logs on EADPP request or for maintenance purposes.

When you make an enquiry on our website

Profiling: No

Data shared: No

Transfer outside the EEA: No

Processing of special categories of data: No

Processing of children data: No

Processing of criminal data: No

Encryption of data in transit: Yes

Encryption of data at rest: Yes

Lawful basis:

Legitimate interest

Personal data processed

We collect

your name, email address
comments supplied in the form.
the time of the enquiry
your country

Retention period

We will retain your details and query for the length of time required to handle you query.

Security measures in place

The transfer of the website content between your browser and our server is secured through TLS 1.2 encryption. You can verify by clicking the padlock on your browser.

We use encryption at rest.

Our servers are located in ISO 27001 accredited datacentres in Ireland.

Sharing of personal data

The information with only be used by relevant members of the EADPP Board to deal with your query.

Members' website

Profiling: No

Data shared: No

Transfer outside the EEA: No

Processing of special categories of data: No

Processing of children data: No

Processing of criminal data: No

Encryption of data in transit: Yes

Encryption of data at rest: Yes

Lawful basis:

Contractual requirements

Legitimate interest

Personal data processed

When you sign in, we collect:

the time you log in
the IP address used to connect to the member area.

When you change your details or password, we collect:

the time of the change
the IP address used when changing the details.

Retention period

We will retain the data for the contract duration.
Detailed access records (with IP address and time) are kept for 12 months for security purposes.
Summary of access by month is kept thereafter for stats purposes.

Security measures in place

The transfer of the website content between your browser and our server is secured through TLS 1.2 encryption. You can verify by clicking the padlock on your browser.

We use encryption at rest.

Our servers are located in ISO 27001 acredited data-centres in Ireland.

Sharing of personal data

The information is only used by relevant EADPP Board members.

When you become a member

Profiling: No

Data shared: Yes

Transfer outside the EEA: Yes

Processing of special categories of data: No

Processing of children data: No

Processing of criminal data: No

Encryption of data in transit: Yes

Encryption of data at rest: Yes

Lawful basis:

Legal requirements

Contractual requirements

As a data controller:

Data required by law to provide a paid service
- Invoice address
- Service purchased
- We keep these for a period specified by law
- Please note that invoice will have the main contact name to ease dispatching in your organisation. It can be removed and then the invoice doesn't contain personal data.
If you pay by credit or debit card card:
- Your card details are processed secuerly by Stripe , We do not have access to your card details. Our treasurer has access to the card holder's name, the last 4 digits of the card number and the card expiry date (this is allowed by the PCI/DSS standard).
- You can also choose to pay by bank transfer or Paypal.

Security measures in place

The transfer of the website content between your browser and our server is secured through TLS 1.2 encryption. You can verify by clicking the padlock on your browser.

We use encryption at rest.

Our servers are located in ISO 27001 accredited data-centres in Ireland.

Sharing of data

We will transfer the information to our appointed accountants so they can perform our mandatory accounts return.
If required, we will transfer some of the personal data to the Dutch Revenue Commissioners and legal advisors.
If you pay by credit or debit card:
- We use the services of Stripe that may send data outside the EEA;
- To avoid data to be sent outside the EEA due to credit card processing, you can pay by bank transfer.
- Some data will be shared with our bank

EADPP Events

Profiling: No

Data shared: Yes

Transfer outside the EEA: Yes

Processing of special categories of data: No

Processing of children data: No

Processing of criminal data: No

Encryption of data in transit: Yes

Encryption of data at rest: Yes

Lawful basis:

Contractual requirements

Legitimate interest

Personal data processed

We collect

your name, email address so we can invite you to the webinar;
the time of the booking, so we can measure the returns of our marketing campaigns;
the event you booked;
your time zone so we can send you a confirmation personalised to your local time;
when you join the event, we record your attendance to measure the returns of our event;
Optionally, to assist our marketing, we may ask the company you work for and you how you heard about us.

Retention period

One year for free events.
Up to 7 years for paid events to comply with accounting legislation .

Security measures in place

The transfer of the website content between your browser and our server is secured through TLS 1.2 encryption. You can verify by clicking the padlock on your browser.

We use encryption at rest.

Our servers are located in ISO 27001 acredited data-centres in Ireland.

Sharing of personal data

We normally do not share your registration data.

When we send you the link, you may need to confirm your name with Zoom. Zoom, our call platform may collect some data to improve the call including your IP address. To check which data processors Zoom uses contact Zoom directly.