GDPR data processing notice for participants of conferences hosted by Candela Foundation


GDPR data processing notice for participants of conferences hosted by Candela Foundation


Controller 
The controller of the personal data is the Candela Foundation with its seat in Poland in Warsaw (03-822),Grochowska 357/513. The controller can be reached:

  1. by post: Candela Foundation, ul. Grochowska 357/513, 03-822 Warsaw
  2. by e-mail: hello@candela.org.pl
  3. by telephone: + 48 531 968 850


Objectives and legal basis 
Personal data will be processed for your registration and participation in the conference organized by Candela Foundation. The legal basis for the processing of your personal data is:

  • Article 6(1)(a) of the GDPR[1]– consent for processing of personal data.
  • Article 6(1)(b) of the GDPR[1] – performance of a concluded contract – for the term of the contract
  • Article 6(1)(c) of the GDPR[1] – executing actions resulting from generally applicable laws, in particular in connection with the fulfilment of obligations arising from taxation and accounting regulations and regulations governing the conduct of formal investigations by authorised entities.
  • Article 6(1)(f) of the GDPR[1] – archiving (evidential), involving the preservation of information in case of the need to prove facts or demonstrate the fulfilment of the Foundation's obligations

You may withdraw your consent to the processing of your personal data at any time, inter alia, by sending an e-mail to hello@candela.org.pl or events@candela.org.pl. At the same time, we would like to remind you that your withdrawal of consent does not affect the lawfulness of the processing carried out based on your consent prior to its withdrawal.

Processing period 
Your data will be processed for the period necessary to achieve the purpose indicated above, after which time it will be deleted. Your personal data will be processed for the duration of the conference and thereafter for the period required by tax and accounting regulations. After this time, your data will be deleted.

Data recipients 
Your personal data will be accessed by authorised employees or collaborators of the Candela Foundation who need to process your data in connection with the connection with the conference. Recipients of your data may also be entities to which the controller subcontracts certain activities that involve the processing of personal data, such as the supply of an accounting service, an email host, operators of the registration system. In order to ensure adequate protection of personal data, a personal data processing entrustment agreement has been signed with these recipients. 

Recipients of personal data will also be recipients of works containing data of the data subject (advertising, promotional, marketing materials, related to the activities of the controller, and in particular users of its websites), as well as advertising, marketing agencies or printing houses. Recipients of the data may be co-organisers of the conference as well as members of the Scientific Committees, Steering Committees, Organising Committees. The list of co-organisers, committees and their members is published each time on the conference website.

The data may also be made available to entities authorised by law.

Transfers of data outside the European Economic Area (EEA) 
Registration for the event is carried out using technology provided by Google. Your data will be processed by our provider of the Google Workspace service for not-for-profit organisations Google (with whom we have an entrustment agreement) at its data processing centres .[2].

Rights of data subjects
We guarantee the exercise of all your rights under the terms of the GDPR, i.e. the right to:

  • to access your data and to receive a copy of your data;
  • to rectify (amend) your personal data;
  • to restrict the processing of your personal data;
  • to delete your personal data (subject to Article 17(3) of the GDPR);
  • lodge a complaint with the President of the Data Protection Authority if you consider that the processing of your personal data is in breach of data protection laws

Information on the data provision requirement The provision of data marked as "required" is obligatory. If you do not provide the data, you will not be able to participate in the conference. It is not necessary to provide the other data specified in the form in order to participate in the conference. Furthermore, we would like to inform you that photos will be taken during the conference and published on the website and social media of the Candela Foundation. 

References 
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (EU Journal of Laws L 119 of 04.05.2016, p. 1 with amendments), hereinafter referred to as “GDPR.” 
​[2] https://www.google.com/about/datacenters/inside/locations/index.html