EBCSS Privacy Notice
Last updated: 18 August 2026
This privacy notice explains how personal information is collected and used in connection with the EBCSS website, EBCSS events and related services. It also explains your data-protection rights.
1. Who we are
The University of Edinburgh, acting through or trading as EBCSS, is responsible for deciding how and why the personal information described in this notice is used. In data-protection law, this organisation is known as the controller.
You can contact us by email at ebcss@igc.ed.ac.uk.
The EBCSS registration page currently describes Eventbrite as the University’s booking agent.
2. What this notice covers
This notice applies when you visit www.ebcss.org, contact EBCSS, join the EBCSS community, register for or attend an EBCSS event, submit an abstract, apply to participate as a speaker, faculty member, exhibitor, sponsor or patient advocate, use an official EBCSS event app or digital service, receive communications from us, or make a data-protection request or complaint.
Some EBCSS services are provided through third-party websites, including Eventbrite and HotelMap. These organisations may process your information as independent controllers under their own privacy notices. You should read the privacy notice presented by the relevant service before providing personal information.
3. Personal information we collect
The personal information we collect depends on how you interact with EBCSS.
When you visit our website, we may collect your IP address, browser and device type, operating system, language, pages viewed, referring page, time of access, links selected and similar usage information. We may also collect your cookie preferences and information required to operate, protect and diagnose problems with the website.
When you contact us or join the EBCSS community, we may collect your name, email address, telephone number, organisation, job title, profession, clinical specialty, areas of interest, correspondence and communication preferences.
When you register for an event, we may collect your name, title, contact details, organisation, role, delegate category, ticket information, booking status, attendance details, check-in information, billing address, invoice information, payment status and limited transaction information. We may also collect your selections for conference dinners, sessions, event apps or other services.
Payment-card information is collected directly by the relevant registration and payment provider. EBCSS does not receive or store your full payment-card number or security code.
You may choose to give us information about accessibility, dietary requirements or other support you need. This information may reveal details about your health, disability, religion or beliefs. Information of this kind may be treated as special category information under data-protection law, and we apply additional protections to it.
If you submit an abstract or participate as a speaker, faculty member or contributor, we may collect your biography, photograph, qualifications, employment information, professional contact details, abstract, presentation, authorship information, declarations of interests and correspondence. We may also process information connected with speaker agreements, travel, accommodation and event logistics.
If you apply to participate as a patient advocate or through another application process, we may collect your application answers, experience, interests, reasons for applying and support requirements. If relevant, you may choose to provide health information or information about your lived experience.
Photographs and audio or video recordings may be taken during EBCSS events. We may also collect questions, survey responses, feedback and information you choose to display through an event app, delegate directory, badge or networking feature.
We will explain the available privacy and visibility controls when you use an event app, directory or networking service.
4. How we obtain your information
We obtain personal information directly from you, through the EBCSS website and its technologies, and through services used to administer EBCSS activities.
We may receive information from Eventbrite or another registration, payment, abstract-submission or event-app provider. We may also receive information from a person or organisation making a corporate or group booking on your behalf.
Information may be provided by an employer, sponsor, exhibitor, co-author or nominating organisation. We may use publicly available professional information where this is appropriate for organising an event or communicating with a speaker or contributor.
Event venues, contractors or emergency services may provide information where this is necessary to manage an incident, protect health or safety, or meet a legal obligation.
If another person provides your information to us, we ask them to ensure they are entitled to do so and to make this privacy notice available to you.
5. Why we use personal information
Operating and protecting the website
We use website, device and security information to operate, secure and improve the EBCSS website. Our lawful basis is our legitimate interest in providing a secure, reliable and useful website.
Where cookies or similar technologies are subject to the Privacy and Electronic Communications Regulations, we obtain consent or comply with the requirements of an applicable exception.
Answering enquiries
We use contact details and correspondence to answer questions and manage requests. We do this because it is in our legitimate interests to respond to enquiries or because it is necessary to take steps requested by you before entering into a contract.
Processing event registrations
We use registration, booking and transaction information to process bookings, take payment, issue tickets and administer attendance. This processing is normally necessary to perform our contract with you.
Where another person or organisation makes a group booking, we may also rely on our legitimate interest in administering that booking.
Sending essential event information
We use contact and booking information to send confirmations and important information about the event, including timetable, venue, safety or service updates. This is necessary to perform our contract with you and supports our legitimate interest in running the event safely and effectively.
These essential service messages are not marketing communications.
Financial and governance records
We retain appropriate booking, invoice and transaction information to meet accounting, tax, audit and governance requirements. We do this to comply with our legal obligations and to support our legitimate interest in maintaining accurate business records.
Accessibility, dietary and support requirements
We use information about accessibility, dietary requirements and other requested support to provide an appropriate and accessible event experience.
Our lawful basis is performance of our contract with you or our legitimate interest in making the event accessible.
Abstracts, speakers and contributors
We use professional, submission, agreement and logistical information to assess abstracts, produce the scientific programme, administer speakers and faculty, and manage sponsors and exhibitors.
We do this where it is necessary to perform a contract, to take steps before entering into a contract, or because it supports our legitimate interest in producing and administering the EBCSS programme.
Patient-advocate and other applications
We use application information to assess applicants, select participants and administer the relevant programme. This supports our legitimate interest in operating a fair and effective selection process.
Where an application contains health or lived-experience information, we also require a special category condition.
Event apps and networking services
We may use registration, profile and interaction information to provide an event app, delegate directory or networking service. This may be necessary to perform our contract with you or may support our legitimate interest in providing useful event services.
Optional profile visibility, directory listings or networking functions may be based on your consent. We will provide appropriate controls where these features are available.
Photography and recording
We may take photographs or recordings to document and promote EBCSS. We may rely on our legitimate interest in recording and promoting the event, provided that appropriate notices, safeguards and ways to object are available.
We will normally obtain consent for a featured interview, testimonial or recording focused on a particular individual.
Marketing
We use contact details, interests and preferences to send EBCSS news and information about future events where you have consented or where electronic-marketing law allows us to rely on an applicable soft opt-in.
Every marketing message will include an easy way to unsubscribe.
Sponsors and exhibitors
We will not provide your contact details to a sponsor or exhibitor for its own marketing unless you have made a clear and specific choice allowing us to do so.
Where you give this permission, our lawful basis is consent. You may withdraw that consent at any time.
Surveys and event improvement
We may use attendance information, feedback and survey responses to evaluate EBCSS and improve future events. This supports our legitimate interest in reviewing and improving our activities.
If a survey requests optional special category information, we will obtain consent or identify another appropriate legal condition.
Complaints and legal claims
We use relevant records and correspondence to investigate complaints and establish, exercise or defend legal claims. We do this to comply with legal obligations and support our legitimate interest in resolving disputes and protecting legal rights.
Health and safety
We may use relevant contact, incident or health information to protect an individual’s health or safety in an emergency. Our lawful basis may include protection of vital interests or compliance with a legal obligation. Where special category information is involved, we will also identify the applicable special category condition.
6. Legitimate interests and consent
Where we rely on legitimate interests, we consider the benefit of the processing, whether it is necessary and its potential effect on the people concerned.
You may object to processing based on legitimate interests. Information about how to object is provided in the section on your rights.
Where we rely on consent, you may withdraw your consent at any time. Withdrawing consent does not affect processing already carried out lawfully.
If information is required to provide a service you have requested, declining to provide it or withdrawing consent may limit our ability to provide that particular service. We will explain this when relevant.
7. Electronic marketing
We may send you EBCSS news and information about future events where you have asked to receive it, given valid consent, or where electronic-marketing law permits us to use a soft opt-in and we gave you a clear opportunity to object when collecting your details.
You can unsubscribe at any time by using the link in a marketing message or emailing ebcss@igc.ed.ac.uk.
We may retain limited information on a suppression list so that we continue to respect your choice and do not add you back to a marketing list accidentally.
Operational messages about a booking, payment, safety matter, timetable change or service you requested are not marketing. We will nevertheless keep these messages relevant and proportionate.
8. Cookies and similar technologies
The EBCSS website uses cookies and related technologies.
Strictly necessary technologies may be used for security, network management and features you request. Preference technologies may remember choices you make. Measurement technologies may help us understand aggregate website use and improve the website.
We use non-essential technologies only with consent unless a specific exception under the Privacy and Electronic Communications Regulations applies.
Where we rely on an exception for statistical or appearance-related purposes, we provide the required information and a simple way to object.
You can review or change your choices through the Cookie Settings link displayed on the website. Rejecting or objecting to non-essential technologies will not prevent you from accessing the core website.
9. Who we share information with
We may share personal information with organisations that help us provide the website, administer registrations, take payments and deliver EBCSS events.
These organisations may include Eventbrite, the payment services used within Eventbrite, Wix, the provider of our email or newsletter service, our abstract-submission provider, our event-app provider and our event contractors.
Event contractors may include the venue, caterers, accessibility providers, badge printers, check-in providers, photographers, audiovisual suppliers and technical support providers. They receive only the information reasonably necessary to provide their services.
We may share relevant information with a group-booking contact, employer or sponsoring organisation where that organisation arranged or paid for attendance.
We may disclose information to professional advisers, auditors and insurers. We may also disclose information to regulators, courts, law-enforcement bodies or other authorities where disclosure is required or legally permitted.
If the organisation responsible for EBCSS is genuinely restructured or transferred, relevant information may be provided to a successor organisation subject to appropriate safeguards.
Our website links to HotelMap and other external services. When you follow an external link, the service receives information directly from you and your browser under its own privacy notice. EBCSS does not necessarily receive information about bookings made through these external services.
We require processors acting on our instructions to protect personal information, use it only for agreed purposes and comply with applicable data-protection law.
We do not sell personal information. We do not share attendee contact details with sponsors, exhibitors or business partners for their own marketing without a valid and specific basis, normally your consent.
10. International transfers
Some of our suppliers may process personal information outside the United Kingdom.
Where personal information is transferred to a country that is not covered by UK adequacy regulations, we use an appropriate safeguard where required. This may include the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, binding corporate rules or another lawful transfer mechanism.
We also assess relevant transfer risks and apply supplementary protections where appropriate.
You may contact us for more information about the transfer mechanism used and how to obtain a copy of the relevant safeguards, subject to appropriate redactions.
11. How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected, including applicable legal, accounting and reporting requirements.
General enquiries will normally be retained for a period of up to two years after the enquiry is closed.
Registration, attendance and contractual records will normally be retained for a period of six years after the relevant event.
Financial and tax records will be retained for the period required by our legal and financial obligations.
Accessibility, dietary and optional health information will normally be deleted 30 days after the event unless it is required for an incident, complaint, legal obligation or continuing service.
Information about unsuccessful advocate or other applications will normally be retained a period of six months after the selection process or event, unless the applicant has agreed to a longer retention period.
Abstracts, programmes and published conference materials may form part of a long-term academic or public record.
Marketing information will be retained until you withdraw consent or object, subject to an inactivity review period of 2 years. Limited suppression information may be retained for as long as necessary to honour an opt-out.
Event photographs and recordings will be retained for 2 years and distinguish promotional material from the permanent event record.
Website logs and analytics information will be retained for 2 years.
Records of data-protection requests and complaints will be retained for a period of six years after the matter is closed, or the period in the controller’s approved complaints schedule.
When a retention period expires, we delete or anonymise the information unless it must be retained for a legal claim, investigation or another overriding legal reason.
12. Security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include access controls, supplier checks, secure systems, confidentiality requirements and procedures for responding to suspected personal-data breaches.
No internet or electronic storage system is completely secure. If you believe information connected with EBCSS has been compromised, please contact us promptly at ebcss@igc.ed.ac.uk.
13. Your data-protection rights
Depending on the circumstances and the lawful basis used, you may have the right to ask whether we process your personal information and obtain a copy of it.
You may have the right to correct inaccurate or incomplete information, request erasure, restrict how information is used, or object to processing based on legitimate interests.
You may have the right to receive information you provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller.
Where processing is based on consent, you may withdraw that consent at any time.
You have an absolute right to object to the use of your personal information for direct marketing.
You also have the right to object to processing based on our legitimate interests. We may continue that processing if we can demonstrate compelling legitimate grounds or if the information is required for legal claims.
These rights are not absolute, and legal exemptions may apply. If we cannot fulfil a request in whole or in part, we will explain our decision.
To exercise a right, email ebcss@igc.ed.ac.uk. Please provide enough information to identify the relevant records and explain which right you wish to exercise.
We may request proportionate proof of identity. We normally respond within one month, although data-protection law permits an extension in certain circumstances.
14. Data-protection complaints
If you are concerned about our use of your personal information, please contact us so that we can investigate.
You can email ebcss@igc.ed.ac.uk using the subject line “Data protection complaint”.
We will acknowledge a data-protection complaint within 30 days. We will take appropriate steps to investigate the complaint without undue delay, keep you informed about progress and tell you the outcome.
You may also complain to the Information Commissioner’s Office, the UK’s data-protection regulator.
The ICO’s complaint service is available at ico.org.uk/make-a-complaint.
The ICO can be contacted by telephone on 0303 123 1113 or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
If another European data-protection law applies, you may also have the right to complain to the supervisory authority in the country where you live, work or believe an infringement occurred.
15. Automated decisions
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
16. Children
EBCSS services are primarily intended for adult healthcare professionals, researchers, advocates and other conference participants. Our minimum registration age is 18 years old.
17. Changes to this notice
We review this privacy notice regularly and update it when our activities, suppliers or legal obligations change.
The date at the top of this notice shows when it was last updated. If a change would significantly affect individuals, we will provide an additional notice where appropriate before the change takes effect.
18. Contact us
If you have questions about this privacy notice or our use of personal information, please contact us.
Our email address is ebcss@igc.ed.ac.uk.