Introduction and Definitions
1. Introduction
We process personal data for the operation of our website pancreaticcancereurope.eu (hereinafter referred to as “Website”). We keep such data in confidence and process them in accordance with the applicable laws – in particular, the General Data Protection Regulation (GDPR). In this Privacy Policy, we wish to inform you about which personal data we collect from you, for which purposes and on which legal basis they are used and to whom we disclose them, if appropriate. Furthermore, we will explain which rights you have to protect and enforce your rights for data protection.
2. Definition of Terms
Our Privacy Policy contains technical terms which are defined in the GDPR. For your better understanding, we will explain these terms in a more simplified way:
2.1 Personal data
“Personal data” means any information relating to an identified or identifiable natural person (Article 4(1) of the GDPR). Data of an identified person might be, for instance, their name or email address. Data, however, might also be personal if the identity is not directly recognisable but could be determined by combining own or external information in order to identify that person. A person is identifiable, if information is available about, e.g. their address or bank details, their date of birth or user name, their IP address and/or location data. This means that here any information is relevant which allows for any type of conclusion to be drawn on a person.
2.2 Processing
Article 4(2) of the GDPR provides that “processing” means any operation which is performed on personal data. That means, in particular, the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
Controller and Data Protection Officer
3. Controller
The following company is responsible for data processing and thus the controller:
Company: Pancreatic Cancer Europe (“we”)
Legal representative: ASBL Pancreatic Cancer Europe
Address: PCE Secretariat Rue Montoyer, 40 1000 Brussels Belgium
Email: actionpancreaticcancer@outlook.com
Scope of processing
4. Scope of processing: Website
We will process the personal data listed in detail under Article 5-7 below, when you use the Website with the URL pancreaticcancereurope.eu. In this process, we will only process data from you that you actively enter on our Website (e.g. by completing forms) or that you provide automatically when using our offer.
Your data will exclusively be processed by us and these data will, as a matter of principle, not be sold, leased or provided to any third parties. Insofar as we use external service providers for the processing of your personal data, that will be done in the context of a cooperation with a so-called data processor, where we act as principal and are authorised to give instructions to our contractors. For the operation of our Website, we use external service providers for hosting, and for the maintenance, update and further development. Insofar as other external service providers will be used for individual processing activities that are listed in Article 5-7, they will be specified there.
We do, in general, not transfer any data to any third countries and this is not planned for the future either. Any exemptions from this principle will be explained in the types of processing activities listed below.
The processing activities in detail
5. Provision of the Website and Log Files
5.1 Description of processing
Whenever anybody visits our Website, we automatically collect information that their browser transfers to our server. These data will also be stored in the so-called log files of our system. This concerns the following data:
- Your IP address will be shortened and exclusively the last three places will be stored in the log files.
5.2 Purpose
The processing is done to allow for the Website to be called and to ensure its stability and security. In addition, the processing serves for statistical analyses and the improvement of our online offer.
5.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point (f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 5.2.
5.4 Storage duration
The data will be erased once they are no longer required to achieve the purpose of their collection. If data are collected to provide the Website, they will be erased once the respective session has been terminated. The log files will be erased after 7 days.
6. Contact form and contact by email
6.1 Description of processing
We provide you with a contact form on our Website which you can use to contact us. In this form, you will be asked to enter your email address, your name and a message. When clicking the “Send” button, the data will be transferred to us by using SSL encryption (see Art. 13). The contact form can only be transferred if you accept our Privacy Policy by clicking the check box provided. You may also contact us by using the email address specified on our Website. In this case, we will process the personal data of the user that were transferred with the email.
6.2 Purpose
The contact form provided on our Website should offer you a convenient option to contact us. The data transferred with and in the contact form or your email will exclusively be used for the purpose of handling and answering your request.
6.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 6.2. Insofar as the contact by email is aimed at concluding or performing a contract, the data will be processed to perform a contract (Article 6(1) point b) of the GDPR).
6.4 Storage duration
We will erase the data, as soon as such are no longer required to achieve the purpose of their collection. That is usually the case when the relevant communication with you has been terminated. The communication is deemed terminated as soon as the circumstances reveal that the relevant issue has been conclusively resolved. Insofar as any statutory retention period conflicts with the erasure, the data will be erased immediately after the expiry of the statutory retention period.
7. Cookies
7.1 Description of processing
Our Website uses cookies. Cookies are small text files which are stored in the user’s end device when they visit a website. Cookies contain information which allow for the recognition of a device or enable certain functions of a website. We mostly only use so-called “session cookies”. These will automatically be erased when you end your internet session and close the browser. Other cookies will remain on your device for a longer period of time. We use the cookies set out below on our Website:
_ga (Provider: pancreaticcancereurope.eu)
Function: Registers unique ID that is used to generate statistical data about how the visitor uses the site.
Storage time: 2 years
_gat (Provider: pancreaticcancereurope.eu)
Function: Used by Google Analytics to limit the request rate.
Storage time: This cookie expires at the end of the browser session.
_gid (Provider: pancreaticcancereurope.eu)
Function: Registers unique ID that is used to generate statistical data about how the visitor uses the site.
Storage time: This cookie expires at the end of the browser session.
collect (Provider: google-analytics.com)
Function: Marketing cookie to follow users on websites.
Storage time: This cookie expires at the end of the browser session.
7.2 Purpose
We use cookies to make our Website more user-friendly and to offer the functions described in Article 7.1.
7.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 7.2.
7.4 Storage duration
Cookies will automatically be deleted at the end of a session and upon expiry of the storage duration specified. Since cookies are stored on your device, you as user have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transfer of cookies. Cookies already stored can be deleted at any time. This can also occur automatically. If you deactivate cookies for our Website, you may be unable to use individual functions of our Website or such might be used in a restricted way only.
8. Newsletter
8.1 Description of processing
We send a newsletter in irregular intervals. In the newsletter, we will inform you about Pancreatic Cancer Europe – a European multi-stakeholder platform. You will only receive our newsletter if you actively register for our distribution list. You may subscribe to our newsletter by completing and sending a newsletter subscription form on our.
If you decide to subscribe to our newsletter, you only need to provide us with your email address. All other data (such as e.g. your first name and name) can be given voluntarily and will only be used to personalise the email.
In order to perform and verify newsletter registrations, we use the so-called double opt-in process. A registration involves several steps. First, you subscribe to our newsletter on our Website. Then, you will receive an email from us to the email address you specified. In this email, we ask you to confirm that you have actually subscribed to the newsletter and wish to receive it. You confirm your subscription by clicking on a confirmation link in the email. We will only include you in our newsletter distribution list after your successful confirmation and only then will you receive emails in the future. We will store date, time and your IP address in the double opt-in process, both during registration and upon confirmation.
8.2 Purpose
The processing will be done to offer the newsletter function and to be able to send newsletter emails to subscribers. The collection and storage of date, time and IP address during the registration for the newsletter serves to document that the consent was granted and to protect against the abusive registration of email addresses.
8.3 Legal Basis
The processing for our subscriber newsletter will be done on the basis on your consent pursuant to Article 6(1) point a) of the GDPR. You may see the declaration of consent, at any time, on our Website at seu2.cleverreach.com/f/105630-147452/. Your consent is given voluntary. Collecting and storing of date, time and IP address during the registration for our newsletter is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 8.2.
8.4 Storage duration and withdrawal of consent
If you fail to confirm your registration to our newsletter within 24 hours after receipt of the relevant subscription email, your data will automatically be deleted. We will process your personal data for the period in which you subscribe to our newsletter. You may terminate the receipt of the newsletter, at any time, by withdrawing your consent. A simple statement will suffice (by e-mail to actionpancreaticcancer@outlook.com or by mail to PCE secretariat, Rue Guimard 10, 1040 Brussels). You may also unsubscribe to the newsletter by clicking on the unsubscribe link which is provided in each newsletter email or by seu2.cleverreach.com/f/105630-147452/. When you have withdrawn your consent, we will no longer send you any newsletters and your personal data will be removed from our active distribution list. We will take over your email address, in a restricted manner, to our so-called black list, in order to enforce your withdrawal. That enables us to ensure that you will not receive any newsletter from us in the future and that your email address will not be abused by any third parties.
8.5 Recipient and transfer to third countries
We use the services of the newsletter provider Clever Reach to manage our newsletter distribution and for the sending of emails. That is done in a manner that the above company acts as processor. Clever Reach is a service offered by CleverReach GmbH & Co. KG, Mühlenstrasse 43, 26180 Rastede, Germany.
9. Social Networks
Our Website uses none of the so-called social media plug-ins. The logos of the social networks Facebook and Twitter displayed on our Website are linked only with the relevant profiles of our company. When you click on one of the logos, you will reach the external websites of those social networks.
10. Google Maps
10.1 Description of processing
Our Website uses “Google Maps,“ a service for displaying maps provided by the company Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google“). We use Google Maps for embedding a map that displays our business address in our Website. The map will be loaded directly from a Google server. In order to do this, your browser will send a request to a Google server. Your IP address might also be transferred to Google together with the address of our Website. Google Maps will, however, not store any cookies on your device. If you are logged in to Google when you visit our Website, Google Maps will associate this information to your Google user account. Google will store your data as user profiles and will use them for marketing purposes, for market research and/or the customised configuration of the Google websites. You have a right to object against the creation of user profiles; please directly contact Google to exercise such right. For more information on data privacy at Google, please refer to http://www.google.com/intl/de-DE/policies/privacy/.
10.2 Purpose
The processing is done to be able to display an interactive map on our Website.
10.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 10.2.
10.4 Recipients and transfer to third countries
Google processes your personal data also in the U.S. and has agreed to comply with the EU-US Privacy Shield. For more information on the EU-US Privacy Shield, please refer to https://www.privacyshield.gov/EU-US-Framework.
11. Google Analytics
11.1 Description of processing
Our Website uses “Google Analytics”, a web analysis service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as “Google”). Google Analytics uses cookies (see Art. 7), which allow for an analysis of your use of our offer. We use Google Analytics in the version offered as “Universal Analytics” which allows for this analysis across devices by allocating the data to a pseudonymised user ID. The information created by the cookie are generally transferred to a Google server in the U.S. and stored there. But, we use Google Analytics exclusively with IP anonymisation. This means that your IP address will be shortened by Google within the European Union member states or other states which are part of the European Economic Area before it is transmitted. Only in exceptional cases will the full IP address be transmitted to a Google server in the U.S. and shortened there. The IP address transferred by your browser in the context of Google Analytics will not be combined with any other data from Google. The statistics created by Google Analytics record, in particular, how may users visit our Website, from which country or place they access the Website, which sub-pages they visit and through which links or search terms visitors come to our Website. For the terms of use for Google Analytics please visit www.google.com/analytics/terms/gb.html. An overview of the data privacy at Google Analytics can be retrieved from http://www.google.com/intl/en/analytics/learn/privacy.html. You can see Google’s data privacy policy at http://www.google.de/intl/en/policies/privacy.
11.2 Purpose
The processing is done to be able to evaluate the use of our Website. The information gained in the process serve to improve our online presentation and to design it according to demand.
11.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 11.2.
11.4 Storage period and right to object
For information on the storage period and an explanation of your control and setting options for cookies, please refer to Art. 7. You may object to the data processing by Google Analytics, at any time, by downloading and installing the browser add-on offered by Google at https://tools.google.com/dlpage/gaoptout?hl=en. Alternatively, you have the option to click on the following link. This will place an opt-out cookie on your device which prevents the future collection of your data when visiting this Website.
We will automatically delete any analysis data processed and stored by Google Analytics after 14 months.
11.5 Recipients and transfer to third countries
Google Analytics is active for us as service provider in the capacity of a processor. Google processes your personal data also in the U.S. and has agreed to comply with the EU-US Privacy Shield. For more information on the EU-US Privacy Shield, please refer to https://www.privacyshield.gov/EU-US-Framework.
12. Google reCAPTCHA
12.1 Description of processing
Our Website uses “reCAPTCHA”, a service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, California 94043, USA (hereinafter referred to as “Google“). reCAPTCHA allows us to verify in forms whether the entry was made by a human or by an automated software – in particular, so-called bots. This enables us to protect our Website against spam and abuse. In this process, your IP address, the time you visited our Website, the mouse movements you made and other data required for the reCAPTCHA services might be transferred to Google. For more information on data privacy at Google, please refer to http://policies.google.com/privacy.
12.2 Purpose
The processing is done to protect forms on our Website against abuse and spam.
12.3 Legal basis
The processing is necessary for the purposes of the legitimate interests pursued by the controller (Article 6(1) point f) of the GDPR). Our legitimate interest is the purpose mentioned in Article 12.2.
12.4 Recipients and transfer to third countries
Google processes your personal data also in the U.S. and has agreed to comply with the EU-US Privacy Shield. For more information on the EU-US Privacy Shield, please refer to https://www.privacyshield.gov/EU-US-Framework.
Security measures
13. Security measures
We integrated a SSL or TLS certificate in our Website to protect your personal data against unauthorised access. SSL means “Secure Sockets Layer” and TLS means “Transport Layer Security” and encrypts the communication of data between a website and the user’s computer. You recognise active SSL and TLS encryption by the small lock logo displayed on the left side of your browser’s address line.
Your rights
14. Rights of data subjects
You, as data subject, have the following rights in view of the data processing performed by our company as described above:
14.1 Right of access (Article 15 of the GDPR)
You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed by us. Where that is the case, you have a right of access to the personal data under the conditions set out in Article 15 of the GDPR and the other information specified in detail in Article 15 of the GDPR.
14.2 Right to rectification (Article 16 of the GDPR)
You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning your person and, if necessary, the right to have incomplete personal data completed.
14.3 Right to erasure (Article 17 of the GDPR)
You also have the right to obtain from us the erasure of personal data concerning you without undue delay, insofar as one of the grounds listed in Article 17 of the GDPR applies, e.g. if the data is no longer required in relation to the intended purpose.
14.4 Right to restriction of processing (Article 18 of the GDPR)
You have the right to obtain from us restriction of processing where one of the conditions listed in Article 18 of the GDPR applies, e.g. if the accuracy of the personal data is contested by you, the data processing will be restricted for a period enabling us to verify the accuracy of the personal data.
14.5 Right to data portability (Article 20 of the GDPR)
You have the right to receive the personal data concerning you under the preconditions set out in Article 20 of the GDPR in a structured, commonly used and machine-readable format.
14.6 Right to withdrawal of consent (Article 7(3) of the GDPR)
You shall have the right to withdraw your consent, at any time, for processing which is based on your consent. The withdrawal of your consent will apply from the time it is made. In other words, it will apply for the future. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
14.7 Right to lodge a complaint (Article 77 of the GDPR)
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a supervising authority. You may exercise this right with a supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement.
14.8 Prohibition of automated decision-making / profiling (Article 22 of the GDPR)
Decisions which produce legal effects concerning you or similarly significantly affect you must not be subject to a decision based solely on automated processing – including profiling. We hereby inform you that we use no automated decision-making, including profiling, in view of your personal data.
14.9 Right to object (Article 21 of the GDPR)
When we process personal data concerning you on the basis of Article 6(1) point f) of the GDPR (for the purposes of the legitimate interests), you have the right to object under the grounds set out in Article 21 of the GDPR. This, however, shall apply only on grounds relating to your particular situation. After your objection, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms. We also do not need to stop the processing, if it serves for the establishment, exercise or defence of legal claims. In each case – even regardless of a special situation – you have the right to object against the processing of your personal data for direct marketing, at any time.
Version: July 2018