Data Processing

Data controller

The controller of your personal data is MEDCONGRESS GROUP sp. z o.o., entered in the Register of Entrepreneurs of the National Court Register under number KRS 0001237036, NIP 5253087146, REGON 544567895 (the "Controller" or "Organizer").

KRS

0001237036

NIP

5253087146

REGON

544567895

Registered office

ul. Chmielna 2/31, 00-020 Warsaw, Poland

Contact details for data protection matters

General & GDPR matters

info@iccsh2027.org

Registration

registration@iccsh2027.org

Abstracts

abstracts@iccsh2027.org

Sponsorship

sponsors@iccsh2027.org

Postal address

ul. Chmielna 2/31, 00-020 Warsaw, Poland

Data Protection Officer (DPO)

The Controller has not appointed a Data Protection Officer. Appointing a DPO is not mandatory under Article 37 GDPR (the Controller is not a public authority, and its core activities do not consist of large-scale monitoring of data subjects or large-scale processing of special categories of data). For all data-protection matters, please contact info@iccsh2027.org.

General legal framework

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Categories of recipients (processors)

The Controller uses the following IT service providers acting as processors under data processing agreements concluded in accordance with Article 28 GDPR. Most process data within the European Economic Area (EEA); Resend (transactional e-mail) is established in the United States, Stripe (online payments) may transfer data to Stripe, LLC in the United States, Cloudflare Turnstile (anti-bot verification on the sign-up form) may process limited technical data on Cloudflare's global network, and Zoho documents that its support personnel may access mailbox data from outside the EEA — see "Transfers" for the safeguards that apply to each.

• Vercel Inc. — Frontend hosting (website) · EEA (EU region)
• Railway Corp. — Backend hosting and PostgreSQL database · EEA (EU region)
• Zoho Corporation B.V. — Human-staffed mailbox correspondence (info@, registration@, abstracts@, sponsors@, admin@) · EEA (EU data centre); support access may originate outside the EEA, including India
• Resend (Plus Five Five, Inc.) — Transactional / system e-mail (HTTP API) · United States — EU–US Data Privacy Framework certified, Standard Contractual Clauses (Art. 46 GDPR)
• Cloudflare, Inc. — File storage — abstract attachments (Cloudflare R2) · EU region · any access from outside the EEA safeguarded by SCC (Art. 46 GDPR) / EU–US Data Privacy Framework
• Cloudflare, Inc. — Anti-bot verification on the account sign-up form (Cloudflare Turnstile) · processes IP address and technical signals on Cloudflare's global network · transfers safeguarded by SCC (Art. 46 GDPR) / EU–US Data Privacy Framework
• Stripe Payments Europe, Limited; Stripe Technology Europe, Limited; Stripe Technology Company, Limited — Online payments — executing payments on the Controller's instructions; for its own purposes Stripe acts as an independent controller (see the Payments section) · Dublin, Ireland; possible transfer to Stripe, LLC (United States) under the EU–US DPF and SCC
• Jakub Pożarycki, sole trader operating under the business name "Jakub Pożarycki", with registered office at ul. Bukszpanowa 2, Bezrzecze, Poland, NIP 8513262181, REGON 389487615 — Technical support / application maintenance · EEA (Poland/EU)

Recipients may also include providers of accounting, legal and advisory services, and authorized public bodies — solely on the basis of applicable law. With respect to payments, the recipients are: Stripe (Stripe Payments Europe, Limited, Stripe Technology Europe, Limited, Stripe Technology Company, Limited — Ireland) — as a processor when executing payments and as an independent controller for its own purposes; the Controller's bank (Nest Bank S.A.) for transfers and refunds and — if you choose Przelewy24 — PayPro SA; both as independent controllers — see the Payments section.

Transfers outside the EEA

The Controller uses infrastructure and IT service providers, some of which are established or have personnel outside the EEA. Depending on how a given service is configured, Data may be transferred to a third country or may be subject to remote access from outside the EEA — most notably Resend (United States, transactional e-mail), Stripe (United States — Stripe, LLC, online payments) and Zoho's documented support access, which may originate from India. Transfers are carried out on the basis of the appropriate mechanism under Chapter V GDPR — in particular an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses together with a transfer impact assessment and supplementary measures where required. The Controller will inform data subjects of any further transfer not already described here.

Automated decision-making and profiling

Your personal data are not subject to solely automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

Article 13 GDPR

Categories of data

E-mail address, hashed password (passwordHash — stored solely as a salted, one-way hash; never in plain text or in reversibly encrypted form), preferred interface language, e-mail confirmation status.

Purposes of processing

• creating and operating a user account on iccsh2027.org,
• authentication (login) and securing access to the account,
• confirming the e-mail address (account-confirmation message),
• enabling features requiring an account (congress registration, abstract submission).

Legal basis

Article 6(1)(b) GDPR — processing necessary for the performance of a contract for the provision of an electronic service (account operation), or to take steps at your request prior to entering into a contract.

Recipients

Vercel (frontend hosting), Railway (backend hosting + PostgreSQL), Resend (e-mail confirmation, United States), Cloudflare, Inc. (anti-bot verification on the sign-up form — Turnstile), and the application-maintenance developer. See "Common information".

Retention period

Until the account is deleted by the user or the Controller, and thereafter for 1 year from deletion (to handle complaints and demonstrate correct execution of the deletion request). An account left inactive for 24 months receives an advance notice and, absent renewed activity, is deleted automatically 30 days later — never while a registration, abstract or claim linked to the account is still open.

Voluntariness

Providing an e-mail address and setting a password is voluntary but necessary to create and operate an account — without this data, creating an account is not possible.

Your rights

Access, rectification, erasure, restriction of processing, data portability, and complaint to the President of PUODO (ul. Stawki 2, 00-193 Warsaw). Objection under Article 21 GDPR does not apply — this processing rests solely on Article 6(1)(b) GDPR, not on a legitimate-interest basis.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 13 GDPR

Categories of data

Title/salutation, first name, last name, e-mail, phone, country, institution/affiliation, specialization, participant type, additional comments, fee category, add-ons, whether an invoice is required, and — where requested — invoicing details (company name, street, city, postal code, country, Tax ID). Dietary requirements are optional and processed only under the separate consent described below. If you add an accompanying person, we also process your declarations concerning that person (the fact and date of making them, the document version) as evidence of accountability (Art. 6(1)(c) in conjunction with Art. 5(2) GDPR); the accompanying person's own data are described in the "Accompanying person" clause.

Purposes of processing

• performance of the ICCSH 2027 participation contract (registration, badge, access control),
• organization of catering and accompanying events (dietary requirements, where you have given the separate consent described below),
• settlement of the registration fee and add-ons,
• issuing a VAT invoice and fulfilling accounting and tax obligations,
• organizational communication with the participant.

Legal basis

• Article 6(1)(b) GDPR — performance of the participation contract (title, name, e-mail, phone, country, participant type, fee category, add-ons, comments);
• specialization and institution/affiliation — Article 6(1)(b) GDPR: data necessary for a professional service directed at healthcare professionals (correct assignment to the scientific programme, fee-category eligibility, session organization);
• Article 6(1)(c) GDPR — legal obligation regarding issuance and retention of invoices and tax documentation (VAT Act, Accounting Act, Tax Ordinance) — for invoicing data;
• Article 6(1)(f) GDPR — the Controller's legitimate interest in establishing, pursuing or defending claims — for data retention after the congress;
• dietary requirements (optional) — Article 9(2)(a) GDPR: your separate, explicit, revocable consent, given solely to arrange catering — this field is not required to register and is not covered by the bases above.

Recipients

Vercel, Railway (hosting + PostgreSQL), Resend (transactional e-mail, United States), the maintenance developer, the accounting-services provider, the catering provider for the Congress — as a processor (Art. 28 GDPR), as regards the first name and last name of participants attending on site and, where you provided them, your dietary requirements (named meal list), and, for payments, Stripe (a processor when executing payments and an independent controller for its own purposes), the Controller's bank for bank transfers and PayPro SA where Przelewy24 is used (see Payments). See "Common information".

Retention period

Participation data (registration, add-ons, contact, specialization, institution, comments)

3 years from the end of the congress — establishment/defence of claims (Art. 6(1)(f) GDPR), limitation periods.

Dietary requirements (Art. 9(2)(a) consent)

1 month (30 days) after the congress — kept separately from, and for a shorter period than, the rest of the participation record, restricted to catering use.

Invoicing data and accounting documents

5 years from the end of the calendar year in which the tax obligation arose — legal obligation (Art. 6(1)(c) GDPR), tax and accounting law.

Voluntariness

Providing data marked as required is voluntary but necessary to conclude and perform the participation contract; invoicing data is necessary if you request an invoice, and the Tax ID (NIP) is a requirement of tax law. Data not marked as required (e.g. additional comments) is entirely voluntary.

Your rights

Access, rectification, erasure, restriction, data portability, objection (for data processed under Art. 6(1)(f) GDPR, on grounds relating to your particular situation), and complaint to the President of PUODO.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 14 GDPR

Source of the data (Art. 14(2)(f) GDPR)

The Controller obtained your personal data from a Congress participant, who registered you as their accompanying person and provided your data in the registration form. The participant declared that they are providing your data with your knowledge and that they have given or will give you this information, and — where they selected a menu option other than standard for you — that you have given the explicit consent described below.

Categories of data (Art. 14(1)(d) GDPR)

First name and last name, the type of add-on (gala dinner and opening ceremony, or full access without a certificate of attendance), and the menu option selected from a closed list: standard, vegetarian, vegetarian gluten-free, gluten-free. A menu option other than standard may indirectly reveal information about your health or your religious or philosophical beliefs; the Controller therefore treats it as special-category data (Article 9(1) GDPR).

Purposes of processing

• issuing a badge and admitting you to the events covered by the add-on (the opening ceremony and the Gala Dinner and, with full access, also the scientific sessions),
• organizing catering in line with the selected menu option,
• the establishment, exercise or defence of claims related to the contract concluded by the participant.

Legal basis

• first name and last name, type of add-on and the standard menu option — Article 6(1)(f) GDPR: the legitimate interest of the Controller and of the participant in performing the contract concluded with the participant, which includes a service provided for your benefit (badge, admission, catering); you are not a party to that contract;
• a menu option other than standard — Article 9(2)(a) GDPR: your explicit consent, given solely to arrange catering and communicated to the Controller through the participant. You may withdraw your consent at any time by writing to info@iccsh2027.org; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. After withdrawal, the Controller deletes the menu option and prepares a standard meal for you.

Recipients

Vercel, Railway (hosting + PostgreSQL), Resend (transactional e-mail, United States), Zoho Corporation B.V. (the registration@ mailbox, which receives the organizational notice of the registration), the maintenance developer, the catering provider for the Congress — as a processor (Art. 28 GDPR), as regards the first name, last name and menu option (named meal list). See "Common information".

Retention period

First name and last name, type of add-on

3 years from the end of the congress — establishment/defence of claims (Art. 6(1)(f) GDPR), as for the participant's participation data

Menu option

Until the dietary-data deletion deadline after the congress set out for congress registration, or until earlier withdrawal of consent

Time and manner of providing information (Art. 14(3) GDPR)

The Controller does not obtain your e-mail address and does not contact you directly. It provides this information through the participant — who undertook in the registration form to pass it on to you without undue delay and no later than 14 days after registration, and who receives its short version in the registration-confirmation e-mail — by keeping it permanently available on this page, and in addition on site when the badge is collected; in any event within a reasonable period, no later than one month from obtaining the data (Art. 14(3)(a) GDPR).

Your rights

The right to object (Article 21 GDPR) — to processing based on legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation; upon objection the Controller will cease processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. Because the badge is issued in your name, an objection may prevent you from attending as an accompanying person.

The right to withdraw consent to the processing of a menu option other than standard — at any time (Article 7(3) GDPR).

You also have the right to access, rectification, erasure, restriction of processing, data portability as regards the menu option processed on the basis of consent, and to lodge a complaint with the President of PUODO (ul. Stawki 2, 00-193 Warsaw).

If you do not wish your data to be further processed, or wish to change the menu option or withdraw consent, please contact us at registration@iccsh2027.org or info@iccsh2027.org.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 14 GDPR

Source of the data (Art. 14(2)(f) GDPR)

Your personal data were entered into the registration system by the Organizing Committee on the basis of data provided by you or by the institution or partner that invited you (e.g. a Congress sponsor, the scientific committee, a patron institution).

Categories of data (Art. 14(1)(d) GDPR)

Title/salutation, first name, last name and e-mail address and, where provided, telephone number, country, institution/affiliation and specialization; mode of participation (on site or online), add-ons granted free of charge (workshop with its track, Gala Dinner), language of correspondence, the category of the complimentary registration (speaker, committee member, sponsor guest, honorary guest, media, staff, other), an internal note, and a record of who entered the registration and when. The Organiser creates an account on the Website for you, linked to your e-mail address; only you set its password, when activating the registration. The Organiser does not enter dietary requirements for you and does not give any consent on your behalf — you may provide them yourself when activating the registration; from then on the rules for congress registration apply to those data.

Purposes of processing

• registering your free-of-charge participation in the Congress as a guest of the Organiser, issuing a badge and access control,
• organization of catering and accompanying events covered by the registration,
• organizational communication, including sending the registration activation link,
• documenting registrations granted free of charge (category, person who entered them) for the Organiser's internal control,
• the establishment, exercise or defence of claims.

Legal basis

• until the registration is activated — Article 6(1)(f) GDPR: the Controller's legitimate interest in inviting and hosting Congress guests and in documenting registrations granted free of charge;
• after the registration is activated and the terms are accepted — Article 6(1)(b) GDPR: performance of the participation contract, on the terms described for congress registration; dietary requirements — only on the basis of your explicit consent given at activation (Article 9(2)(a) GDPR);
• Article 6(1)(f) GDPR — the establishment, exercise or defence of claims — with respect to data retention after the congress.

Recipients

Vercel, Railway (hosting + PostgreSQL), Resend (transactional e-mail — the message with the activation link, United States), the maintenance developer, the catering provider for the Congress — as a processor (Art. 28 GDPR), as regards the first name and last name of guests attending on site and, where you provide them, your dietary requirements (named meal list). See "Common information".

Retention period

Registration data (identification and contact data, mode of participation, add-ons, category of the complimentary registration, note, record of the person who entered it)

3 years from the end of the congress — establishment/defence of claims (Art. 6(1)(f) GDPR), as for participation data

Dietary requirements (if you provide them at activation)

1 month (30 days) after the congress, as for congress registration, or until earlier withdrawal of consent

Activation link

Until used, for no longer than 30 days from sending

Time and manner of providing information (Art. 14(3) GDPR)

The Controller provides you with the short version of this information in the e-mail with the activation link, sent when the registration is entered — that is, at the latest at the time of the first communication with you (Art. 14(3)(b) GDPR). If that e-mail is not sent when the registration is entered, the Controller provides this information to you by other means, within a reasonable period, no later than one month from obtaining the data (Art. 14(3)(a) GDPR). The full text is permanently available on this page.

Voluntariness

Participating in the Congress as a guest of the Organiser and activating the registration are voluntary; you may withdraw from participation at any time.

Fee waiver

If you registered yourself and the Organiser waived your registration fee, the rules for congress registration apply to your data. In addition, the Organiser records the category and note of the waiver and the person who granted it — under Art. 6(1)(f) GDPR (documenting registrations granted free of charge), for the retention period of participation data.

Your rights

The right to object (Article 21 GDPR) — to processing based on legitimate interest (Art. 6(1)(f) GDPR), on grounds relating to your particular situation; upon objection the Controller will cease processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. Because the badge is issued in your name, an objection may prevent you from attending the Congress as a guest of the Organiser.

The right to withdraw consent to the processing of dietary requirements — at any time (Article 7(3) GDPR).

You also have the right to access, rectification, erasure, restriction of processing, data portability as regards data processed on the basis of the contract or consent, and to lodge a complaint with the President of PUODO (ul. Stawki 2, 00-193 Warsaw).

If you do not wish to take part in the Congress or want your data removed, please write to registration@iccsh2027.org.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 13 GDPR

Categories of data

Identification and contact data of the submitting person (academic title, first name, last name, affiliation, e-mail, phone), plus the submission itself in IMRaD structure: abstract title, abstract body (up to 300 words), the Introduction (up to 800 words), Material and Methods, Results and Discussion sections (up to 1000 words each) and, optionally, Limitations (up to 400 words) and References (up to 8000 characters), theme, keywords (up to 3), comments, session type, presentation language, presenting-author indicator, and attachments (up to 5 files per abstract in PDF, PNG, JPEG, or TIFF format, up to 5 MB per file, with an optional caption).

Purposes of processing

• receipt and substantive evaluation (review) of the abstract by the scientific committee,
• contact with the submitting person about the status of the submission,
• publication of the accepted abstract in the book of abstracts and congress materials,
• scientific archiving.

Legal basis

Article 6(1)(b) GDPR — processing necessary to carry out submission, evaluation and publication (a contractual relationship between the submitter and the Organizer). For scientific archiving and publication of the author's name alongside the abstract, Article 6(1)(f) GDPR also applies (legitimate interest — integrity and permanence of conference output).

Recipients

Scientific-committee reviewers (acting under the Controller's authorization and bound by confidentiality), Cloudflare, Inc. (attachment storage via Cloudflare R2), Vercel and Railway (hosting + database), Resend (transactional e-mail, United States), the maintenance developer. After publication — congress participants and, where the book is public, the general public.

Retention period

Published abstracts remain publicly available indefinitely in the book of abstracts, in line with the purpose of publication. The underlying source files and attachments are kept only for 1 month (30 days) after the end of the Congress — a shorter, limited archive window distinct from the perpetual publication itself. Where the abstract is not accepted, the submitter's and co-authors' contact data is kept only for 1 month (30 days) after the end of the Congress.

Voluntariness

Providing the data is voluntary but necessary to submit, evaluate and publish the abstract — without it the submission cannot be processed.

Your rights

Access, rectification, erasure, restriction, data portability, objection (to processing under Art. 6(1)(f) GDPR), and complaint to the President of PUODO. Some rights (e.g. erasure) may be limited for already-published abstracts, owing to the integrity of the scientific output.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none — the abstract is evaluated by reviewers (humans).

Article 14 GDPR

Source of the data (Art. 14(2)(f) GDPR)

The Controller obtained your personal data from the person submitting the abstract, who indicated you as a co-author and provided your data in the abstract submission form. That person declared they hold your consent/authorization to provide your data to the Controller for the abstract submission process.

Categories of data (Art. 14(1)(d) GDPR)

Academic title, first name, last name, affiliation, e-mail address (where the submitter provided one — required only for the presenting/corresponding author, see below), and role information (including whether you are the presenting author).

Purposes of processing

• including you as a co-author in the evaluation (review) of the abstract,
• contacting you where necessary on matters related to the submission,
• indicating you as a co-author in the publication (book of abstracts and congress materials).

Legal basis

Article 6(1)(f) GDPR — the legitimate interest of the Controller and the submitting person in the proper conduct of the scientific process (correct attribution of all co-authors and integrity of the scientific output).

Recipients

Scientific-committee reviewers, Cloudflare R2 (attachment), Vercel, Railway, Resend (transactional e-mail, United States), the maintenance developer. After publication — congress participants and recipients of the publicly available book of abstracts. See "Common information".

Retention period

Published abstracts, including co-author data, remain publicly available indefinitely in the book of abstracts, in line with the purpose of publication. The underlying source files and attachments are kept only for 1 month (30 days) after the end of the Congress. Where the abstract is not accepted, contact data is kept only for 1 month (30 days) after the end of the Congress.

Time of first information (Art. 14(3) GDPR)

This information will be provided to you at the latest in the first e-mail addressed to you after the submission (if contact proves necessary), or at the time of publication, and in any event within a reasonable period, no later than one month from obtaining the data (Art. 14(3)(a) GDPR).

Your rights — with particular emphasis on the right to object (Art. 21 GDPR)

The right to object (Article 21 GDPR) — because we process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you may object at any time, on grounds relating to your particular situation; upon objection the Controller will cease processing unless it demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

You also have the right to access, rectification, erasure, restriction of processing, and to lodge a complaint with the President of PUODO (ul. Stawki 2, 00-193 Warsaw). Data portability does not apply — this processing rests solely on legitimate interest (Article 6(1)(f) GDPR), not on consent or a contract.

If you do not wish your data to be further processed or to be indicated as a co-author, please contact us at abstracts@iccsh2027.org or info@iccsh2027.org.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 13 GDPR

Categories of data

First and/or last name, e-mail address, and the content of the message (and any other data you voluntarily include).

Purpose of processing

Responding to the enquiry submitted via the contact form and conducting correspondence on the matter (including the contact-inquiry-autoreply message).

Legal basis

Article 6(1)(f) GDPR — the Controller's legitimate interest in handling and responding to enquiries addressed to it. Please do not include health information or other special-category data in your message. If you nevertheless do, we process it only to the extent necessary to handle the matter, on the basis of Article 9(2)(a) GDPR — your explicit consent, expressed by voluntarily providing the data — and, as regards the establishment, exercise or defence of legal claims, Article 9(2)(f) GDPR; you may withdraw consent at any time.

Recipients

Vercel, Railway (hosting + database), Resend (transactional e-mail, United States), the maintenance developer. See "Common information".

Retention period

1 year from the last contact on the matter, and in the event of claims — until they become time-barred.

Voluntariness

Providing the data is voluntary but necessary to respond — without an e-mail address we cannot reply.

Your rights

Access, rectification, erasure, restriction, objection (Art. 21 GDPR — on grounds relating to your particular situation, to processing under Art. 6(1)(f) GDPR), and complaint to the President of PUODO. Data portability does not apply — this processing rests solely on legitimate interest, not on consent or a contract.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 13 GDPR

Categories of data

First and last name of the contact person, e-mail address, telephone number, name of the represented company/organization, position/role, and the content of the enquiry.

Purpose of processing

Conducting business discussions on sponsorship/exhibition cooperation, preparing and presenting an offer, and taking steps towards concluding a contract (including the sponsorship-received message).

Legal basis

• Article 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract (pre-contractual steps);
• Article 6(1)(f) GDPR — the Controller's legitimate interest in conducting business discussions, marketing its own congress services to business partners, and the possible establishment, pursuit or defence of claims.

Recipients

Vercel, Railway (hosting + database), Resend (transactional e-mail, United States), the maintenance developer. See "Common information".

Retention period

For the duration of the discussions, and after their conclusion for 3 years (general limitation period for claims arising from business activity). If a contract is concluded — for its performance and the period arising from tax and accounting obligations.

Voluntariness

Providing the data is voluntary but necessary to undertake discussions and present an offer.

Your rights

Access, rectification, erasure, restriction, data portability (for data processed under Art. 6(1)(b) GDPR), objection (Art. 21 GDPR — to processing under Art. 6(1)(f) GDPR), and complaint to the President of PUODO.

Transfers outside the EEA: see "Transfers outside the EEA" in Common information. Automated decision-making/profiling: none.

Article 13 GDPR — attendees, exhibitors and guests present at the Congress venue.

Data processed

Image and voice fixed in photographs and audio/video recordings made at the Congress venue, together with the date, place and name of the session concerned.

Purposes

• documenting the course of the Congress and reporting to partners and public bodies;
• promoting the Congress and its future editions in the Organizer’s own channels;
• establishing, pursuing or defending claims.

Legal basis

Article 6(1)(f) GDPR — the Organizer’s legitimate interest in documenting and promoting a scientific event. General coverage of the room, the audience and the exhibition area is made on this basis; no separate consent is taken for it. For close-up and portrait shots see “Separate consent” below.

On-site notice

A notice about image capture is displayed at the entrances to the venue and to each session room, and is repeated in the registration materials. Photographers and camera operators working for the Organizer are identifiable by press accreditation.

No-photography zones

Photography and recording are prohibited in signposted no-photography zones — at minimum the wellbeing/rest area, the first-aid point and any space identified by contributors to patient sessions. Exhibitors and sponsors may photograph only within their own stand, never in session rooms, and are separate controllers of anything they record.

Separate consent

Using a shot in which you are recognisable as the main subject of the frame (portrait, close-up, image-led promotional material) requires your separate, voluntary consent, taken on the same image-consent form used for speakers and abstract submitters. That consent is never a condition of participation and may be withdrawn at any time with effect for the future by writing to info@iccsh2027.org.

Recipients

The photography and video contractor engaged by the Organizer, Vercel and Railway (hosting), Cloudflare R2 (file storage), the maintenance developer. Published material is visible to anyone who visits the Organizer’s channels. See “Common information”.

Retention period

for as long as the Organizer carries on congress activity, for archival and documentation purposes, with a review of the continued need every 5 years; shots in which a person is recognisable as the main subject of the frame are kept no longer than until that person withdraws their consent, and general shots no longer than until an objection is upheld. Material published in the Organizer’s channels remains available until the publication is withdrawn.

Your rights

Access, rectification, erasure, restriction and — because the basis is Article 6(1)(f) GDPR — the right to object under Article 21 GDPR, which you may exercise on site by telling Congress staff or the photographer. Where a shot rests on your separate consent, you may withdraw that consent at any time. You also have the right to complain to the President of PUODO.

Transfers outside the EEA: see “Transfers outside the EEA” in Common information. Automated decision-making/profiling: none. Facial recognition and biometric identification: not used.

Processing model

Online payments (registration fee, add-ons) are handled by Stripe; you may also pay by traditional bank transfer to the Controller's account. The Controller does not store your payment card data — you enter payment data directly on Stripe's payment page, and Stripe is responsible for its security under the PCI DSS standard.

What the Controller receives

From Stripe, the Controller receives the transaction status and identifier and basic transaction data (amount, currency, payment method, the details entered on the payment page and, for a card, its type, country of issue and the last four digits of its number). For a traditional bank transfer, the Controller receives from its bank the statement data: the payer's name, account number, transfer title, amount and date. This data is used to confirm the payment, link it to your submission (payment-confirmed message) and make any refund; the legal bases are Article 6(1)(b) GDPR (performance of the participation contract) and Article 6(1)(c) GDPR (settlement and tax obligations).

Stripe and other recipients of payment data

Stripe processes your data as a processor when it executes a payment on the Controller's instructions, and as an independent controller for providing regulated payment services, fraud prevention, anti-money-laundering obligations and developing its services. PayPro SA processes data only if you choose Przelewy24:

Stripe Payments Europe, Limited; Stripe Technology Europe, Limited; Stripe Technology Company, Limited

Dublin, Ireland; possible transfer to Stripe, LLC (United States) under the EU–US DPF and SCC — Privacy policy

PayPro SA (Przelewy24)

ul. Pastelowa 8, Poznań, KRS 0000347935 — only where Przelewy24 is used — GDPR information obligation

For traditional bank transfers and refunds the Controller's bank, Nest Bank S.A., is also a recipient, as an independent controller. Stripe (for its own purposes), PayPro and the bank process data in their own name and on their own responsibility — see their privacy policies.

Retention period (on the Controller's side)

The transaction data described above are retained with settlement and invoicing documentation for 5 years from the end of the calendar year in which the tax obligation arose (Art. 6(1)(c) GDPR).

Your rights vis-à-vis the Controller

Access, rectification, erasure (subject to tax and accounting obligations), restriction, data portability, and complaint to the President of PUODO. Rights concerning data processed by Stripe for its own purposes, by PayPro or by the bank are exercised directly against those entities.

Transfers outside the EEA: Stripe may transfer data to Stripe, LLC (United States) under the EU–US Data Privacy Framework and SCC; otherwise see 'Transfers outside the EEA' in Common information. Automated decision-making/profiling on the Controller's side: none.

Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data infringes the GDPR.

Sources and legal basis

• Regulation (EU) 2016/679 (GDPR), in particular Articles 6, 13, 14, 21 and 22, and Chapter V;
• Guidelines of the Article 29 Working Party / European Data Protection Board on transparency under Regulation 2016/679 (WP260 rev.01);
• Decisions and guidelines of the President of the Personal Data Protection Office (uodo.gov.pl);
• the Act of 11 March 2004 on VAT, the Act of 29 September 1994 on Accounting, and the Act of 29 August 1997 — Tax Ordinance (retention periods for settlement documents).

Privacy Policy