Information in accordance with article 13 GDPR
In order to deliver a wide range of services related to our Members as well as our event and congress participants and examination participants (e.g. EBIR exam), we process certain categories of your personal data which we receive from you. For the purpose of transparency and in accordance with Article 13 of the General Data Protection Regulation (GDPR), we therefore want to inform you about the data processing as follows:
The controller of the data processing is CIRSE Society (in the following referred to as “CIRSE”), Neutorgasse 9, 1010 Vienna, ZVR: 112548646.
Legal basis for data use
For all CIRSE activities CIRSE strictly adheres to Austrian and European data protection legislation in particular the EU GDPR (Datenschutz-Grundverordnung DSGVO) and the Austrian Data Protection Act (Datenschutzgesetz DSG) as well as the Federal Act enacting the Telecommunications Act (TKG 2003).
The lawfulness of the data processing is based on
- your valid consent concerning the publication of your first name, last name, city, country of residence and the fact that you have passed the EBIR-exam on CIRSE’s generally accessible website for the duration of one year (Art 6 para 1 lit a GDPR),
- your valid consent concerning the records of your voice, video, photos, ID Document, Screenshots, webcam photos and webcam video streams of your computer in order to monitor the EBIR online examinations for 12 weeks (Art 6 para 1 lit a GDPR
- the necessity to fulfil a contract and to conduct societal activities (Art 2 CIRSE Articles of Association, Article 6 para 1 lit b GDPR),
- our legitimate interests (Art 6 para 1 lit f GDPR), namely regarding the use of your data for the purposes of promoting our products and services, in particular by the sending of newsletters, congress information as well as related promotional information by e-mail or postal means.
For any request and further information regarding the processing of your personal data please contact us at [email protected].
What personal data we process
The following data will be used:
- Names (First and Last Names)
- CIRSE ID
- Date of birth
- Contact information (email, telephone number)
- Associated medical institution (name, postal address)
- Medical fields practiced
- Information on your Membership history
- Information on your payment history
- Your EBIR status
- Previous congress participations
- Previous funding for congress attendance
- National HCP registration numbers (only if applicable)
- Copies of any documents you send us to support your Membership or process your registration
- City and country of residence
If you are a participant of the EBIR exam, the following data will be used additionally:
- Records of your voice, video and photos
- ID Document
- Screenshots, webcam photos and webcam video streams of your computer
What we use your data for:
- Communication with you
- Sending newsletters and information about our activities
- Administration of your CIRSE account and, if applicable, your CIRSE Membership
- Internal statistical use and optimisation of our activities
- Publication of your EBIR status on our website upon your valid consent
- Records of your voice, video, photos, ID document, screenshots, webcam photos and webcam video streams of your computer in order to monitor the EBIR online examinations upon your valid consent
How your data is stored and handled
This data is stored on the servers of our IT partner CTI Meeting Technology, Nussdorferstrasse 20/22, 1090, Vienna, Austria for as long as you remain active with CIRSE (Membership or participation in events and congresses) and will be deleted after 7 years of inactivity or upon your justified request in accordance with Art 17 GDPR (see section 6 of this information sheet for further details).
Where the procession of your data is based on your consent, we process this data as long as the consent is valid and not withdrawn. In the event of a withdrawal, we will refrain from using your data based on the consent from the time we receive the withdrawal.
Our IT partner is contractually obligated to adhere to all standards of data protection according to EU GDPR. Furthermore, your data will be handled exclusively by CIRSE Staff and not be disclosed to any third parties with the possible exception IT companies providing administration software or any authorities.
Please note, however, that if you have submitted the same data in the context of a different service or contract with CIRSE (e.g. grant application, event participation) additional data usage terms and condition may apply.
Please also note that if you are a CIRSE Member, it may be necessary for CIRSE to share some of your personal data with the European Society of Radiology (ESR), Neutorgasse 9, 1010 Vienna, Austria, in order to determine the correct Institutional Membership Fee. In this case, the following data will be shared with ESR:
- First name(s)
- Last names(s)
- City and Country of Residence
This data will not be processed by ESR beyond the above-defined purpose and will not be shared with any third parties.
Please also note that if you sign up for a print subscription of CVIR, it will be necessary for CIRSE to share some of your personal data with Springer Verlag GmbH, Tiergartenstraße 17, 69121 Heidelberg, Germany, in order for you to receive CVIR and to enable them to provide you with their services as requested by you. In this case, the following data will be shared with Springer Verlag GmbH:
- First name(s)
- Last names(s)
- Email address
- Postal Address
- City and Country of Residence
This data will not be processed by Springer beyond the above-defined purpose and will not be shared with any third parties. The processing of the above-mentioned data (First Name, Last Name, City and Country of Residence) is based on Article 6 (1) point b GDPR.
Please note that if you participate in the CIRSE 2020 Summit and visit a booth or learning centre in the virtual exhibition, your following personal data will be passed on to the exhibitor of the booth/learning centre you visited: First Name, Last Name, Country, Institute and Email address. This data will be passed on to allow exhibitors to contact you in relation to your visit at the booth or learning centre at the CIRSE 2020 Summit.
This data will not be processed by the exhibitor beyond the above-defined purpose and will not be shared with any third parties. Further processing of attendee data, conducted by the exhibitor, especially aiming to transmit general promotion or any other material, requires a separate dedicated agreement between the exhibitor and the attendee. Exhibitors are responsible for processing personal data complying with terms of data protection law. Exhibitors have to indemnify and hold CIRSE harmless for any claims or expenses of attendees resulting from illegal processing of personal data. List of exhibitors.
The processing of the above-mentioned data (First Name, Last Name, Country, Institute and Email address) is based on Article 6 (1) point f GDPR. Both legitimate interests of CIRSE (economic and scientific interests) as well as the legitimate interests of the exhibitors (economic interests) within the meaning of Article 6 (1) point f GDPR are pursued therewith, as well as general public interests (enabling the realization of the event and continuing education of HCPs).
If you are a participant of the EBIR exam, the data is stored on the servers of our processor Procwise Exam B.V, Rokin 75, 1012KL NL-Amsterdam and its sub-processors based in the United States of America until it has been confirmed that the exam has been conducted properly, and will be deleted after 12 weeks or upon your justified request in accordance with Art 17 GDPR (see section 6 of this information sheet for further details).
If the above-mentioned recipients of your personal data are located outside the EEA and it has not been established by a decision of the EU Commission that the country concerned has an adequate level of data protection, we will ensure that the transfer takes place on the basis of standard contractual clauses (currently 2010/87/EC and/or 2004/915/EC) or otherwise in accordance with Articles 46, 47 or 49 GDPR.
Information and Access
You are entitled to obtain information by CIRSE as to which personal data are being processed and to get access to that personal data upon your request. We will provide you with one copy of the personal data undergoing processing free of charge, unless the disclosure may adversely affect the rights and freedoms of others.
Should you have consented to a specific use of your data by CIRSE, you can withdraw that consent at any time, by changing your account settings or contacting us under [email protected].
Rectification and Erasure
You are entitled to request rectification of inaccurate personal data or completion of incomplete personal data concerning you without undue delay.
You are entitled to request erasure of personal data without undue delay, if
(i) Personal data are no longer necessary in relation to the purposes for which they were collected,
(ii) You object to the processing
(iii) Personal data have been unlawfully processed
(iv) Personal data have to be erased for compliance with a legal obligation applicable to CIRSE
However, CIRSE is not obliged to execute such erasure if processing is necessary
(i) for exercising the right of freedom of expression and information,
(ii) for compliance with a legal obligation to which CIRSE is subject,
(iii) for the establishment, exercise or defence of legal claims.
Restriction of Processing
You are entitled to request the restriction of processing of personal data in the following circumstances and for the following periods of time:
(i) you contest the accuracy of the personal data concerning you; restriction of processing may be affected for a period enabling the us verify the accuracy of the relevant personal data,
(ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
(iii) we do no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims,
(iv) you have objected to processing, for the period until the verification whether our legitimate grounds override those of you.
You are entitled to data portability, namely to receive your personal data which you have provided to CIRSE and which is processed
(i) based on the concluded contract
(ii) and by automated means
in a structured, commonly used and machine-readable format.
You are entitled to request that the personal data is transmitted directly to another controller by us, where technically feasible. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interests according to Art 6 para 1 point f GDPR. If you object to processing of your personal data we shall cease to process this data unless our legitimate interests to processing your personal data prevail. If you have agreed to your personal data being processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you. In this case, we will cease the processing or your personal data for marketing purposes immediately.
Right to file complaint
You have the right to file a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, if you believe that your rights to data protection are being infringed.
Last updated September 2nd 2020