Data Controller
For processing activities where SGEM World Science determines the purposes and means of processing, the data controller is:
SGEM World Science
The full legal name, registered address and contact details of the operating entity are available in the Legal Notice / Impressum published on this website.
Questions concerning privacy or the processing of personal data may be submitted using the contact details published on the website.
Our Role in Event Projects
Depending on the individual project, SGEM World Science may process personal data in different legal roles.
SGEM World Science as Controller
SGEM World Science generally acts as data controller where it determines why and how personal data is processed, for example in relation to:
- website inquiries;
- project requests;
- quotations and contracts;
- client administration;
- accounting and invoicing;
- supplier and partner relationships;
- operation of its own events or services;
- website security;
- legitimate business communications.
SGEM World Science as Processor
For certain client events, SGEM World Science may process participant, speaker, exhibitor or other personal data solely on behalf of the Client.
In such cases, the Client normally remains the data controller and SGEM World Science acts as a data processor in accordance with the Client’s documented instructions and, where required, under a data-processing agreement.
The precise allocation of responsibilities depends on the circumstances of the individual project.
Categories of Personal Data We May Process
Depending on how you interact with KongressExpert and the services involved, we may process the following categories of personal data.
Identification and Contact Information
This may include:
- name;
- title;
- organisation;
- position or professional role;
- postal address;
- email address;
- telephone number;
- preferred means of communication.
Project and Business Information
This may include:
- company or institutional information;
- project requirements;
- event information;
- requested services;
- correspondence;
- proposals and quotations;
- contractual information;
- project instructions;
- operational notes.
Event and Participation Information
Where relevant to an event, this may include:
- registration information;
- event participation status;
- speaker or moderator information;
- programme participation;
- session information;
- exhibitor information;
- badge information;
- attendance records;
- accommodation or transport requirements;
- event-related preferences.
Billing and Transaction Information
This may include:
- billing details;
- VAT information;
- invoice information;
- payment status;
- transaction references;
- contractual and accounting records.
Payment card or banking information may be processed by authorised payment or financial-service providers where applicable.
Technical and Website Data
When you use our website, technical information may be processed automatically, including:
- IP address;
- browser type;
- device information;
- operating system;
- date and time of access;
- requested pages;
- referrer information;
- server log information;
- security and diagnostic information.
Communications and Uploaded Materials
If you contact us or upload information as part of a project request, we may process:
- emails;
- messages;
- correspondence;
- attachments;
- technical specifications;
- plans;
- presentations;
- documents;
- images;
- other materials voluntarily submitted to us.
Please avoid submitting personal data that is not necessary for the relevant inquiry or project.
Special Categories of Personal Data
Certain event requirements may occasionally involve information that could constitute a special category of personal data under the GDPR.
For example:
- accessibility requirements;
- disability-related requirements;
- certain dietary information that may reveal health information or religious beliefs;
- other health-related accommodation requirements.
We request such information only where it is relevant and necessary to provide the requested service.
Where the GDPR requires explicit consent or another specific legal basis for processing such information, the relevant legal basis will be obtained or established before processing.
Clients providing such information about other persons are responsible for ensuring that they are authorised to provide it and that all applicable data-protection requirements have been satisfied.
Purposes of Processing
We may process personal data for the following purposes:
Responding to Inquiries
To:
- respond to requests;
- assess project requirements;
- prepare proposals;
- communicate regarding possible cooperation;
- arrange meetings or consultations.
Contract and Project Management
To:
- prepare and administer contracts;
- plan and manage projects;
- coordinate services;
- manage venues and suppliers;
- organise personnel and logistics;
- provide technical and operational services;
- fulfil agreed contractual obligations.
Event Administration
Where applicable, to:
- manage registrations;
- communicate with participants;
- coordinate speakers and exhibitors;
- prepare programmes and badges;
- organise access;
- manage event logistics;
- provide participant support;
- administer online or hybrid event systems.
Financial and Legal Administration
To:
- issue quotations and invoices;
- administer payments;
- maintain accounting records;
- meet tax and legal obligations;
- establish, exercise or defend legal claims.
Website Operation and Security
To:
- operate and maintain the website;
- protect systems against misuse and unauthorised access;
- identify technical problems;
- maintain system stability;
- prevent fraud, abuse and security incidents.
Service Development and Quality Assurance
Where appropriate and legally permitted, information may be used to:
- evaluate service quality;
- improve operational procedures;
- improve event workflows;
- develop technical systems;
- analyse recurring service requirements.
Where possible, aggregated or anonymised information is used for these purposes.
Professional Communications and Marketing
Where legally permitted, we may communicate with existing or prospective professional contacts regarding services, projects or related professional activities.
Where consent is legally required, such communications will be sent only after valid consent has been obtained.
You may object to direct marketing at any time.
Legal Bases for Processing
Depending on the circumstances, SGEM World Science processes personal data on one or more of the following legal bases.
Performance of a Contract or Pre-Contractual Measures
Article 6(1)(b) GDPR
Processing may be necessary to:
- prepare a quotation;
- respond to a concrete project request;
- enter into a contract;
- provide contracted services;
- administer an event or project.
Legal Obligations
Article 6(1)(c) GDPR
Certain information must be processed or retained in order to comply with legal obligations, including accounting, taxation, commercial and regulatory requirements.
Legitimate Interests
Article 6(1)(f) GDPR
Where appropriate, processing may be based on legitimate interests, including:
- operating and protecting our business;
- communicating with business clients and institutional contacts;
- ensuring IT and website security;
- managing professional relationships;
- maintaining project documentation;
- preventing misuse;
- establishing, exercising or defending legal claims.
Where we rely on legitimate interests, we consider the interests, rights and freedoms of the individuals concerned.
Consent
Article 6(1)(a) GDPR
Where processing is based on consent, you may withdraw your consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.
For special categories of data, where required, explicit consent may be relied upon in accordance with Article 9 GDPR.
Data Obtained from Clients or Other Sources
For event projects, SGEM World Science may receive personal data from:
- event organisers;
- institutional clients;
- employers;
- partner organisations;
- universities;
- exhibitors;
- speakers;
- event registration systems;
- authorised project partners.
For example, an organisation commissioning KongressExpert may provide a participant or speaker list necessary for event administration.
Where another organisation provides the data and remains the controller, that organisation is responsible for providing the relevant privacy information and establishing a lawful basis for providing the data.
Where SGEM World Science independently determines the purposes and means of further processing, it will fulfil its own obligations as controller.
Recipients of Personal Data
Personal data is made available only to persons and organisations that require access for legitimate operational purposes.
Depending on the project, recipients may include:
- authorised employees of SGEM World Science;
- event personnel;
- technical personnel;
- venues;
- hotels;
- transport providers;
- audiovisual providers;
- logistics providers;
- printers and production partners;
- IT and hosting providers;
- event software providers;
- payment and financial-service providers;
- accountants, auditors or professional advisers;
- other contractors necessary for the delivery of the agreed service.
Only the information reasonably necessary for the relevant purpose will be disclosed.
Where third parties process personal data solely on behalf of SGEM World Science, appropriate contractual arrangements will be used where required by the GDPR.
International Data Transfers
SGEM World Science aims to process personal data within the European Economic Area wherever reasonably possible.
However, certain technical providers, cloud services, communication systems or international project partners may involve processing outside the EEA.
Where personal data is transferred to a country outside the EEA, SGEM World Science will use an appropriate transfer mechanism where required, such as:
- an adequacy decision of the European Commission;
- Standard Contractual Clauses approved by the European Commission;
- another legally recognised transfer mechanism.
Additional safeguards may be implemented where required by applicable law.
Data Retention
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required by applicable law.
Retention periods depend on the type of information and may be influenced by:
- the duration of a project;
- contractual obligations;
- accounting and taxation requirements;
- limitation periods;
- legal obligations;
- potential legal claims;
- legitimate documentation requirements.
Unsuccessful inquiries and project requests may be retained for a reasonable period where necessary for follow-up, documentation or legitimate business purposes.
When personal data is no longer required and no legal basis for further retention exists, it will be deleted, anonymised or otherwise removed from active processing as appropriate.
Website Server Logs
When the KongressExpert website is accessed, the hosting infrastructure may automatically record technical information required for operation and security.
Such information may include:
- IP address;
- requested URL;
- date and time;
- browser information;
- operating system;
- referring page;
- response status;
- technical error information.
Server logs are used primarily for:
- technical operation;
- troubleshooting;
- security;
- abuse prevention;
- detection and investigation of attacks.
They are retained only for a period appropriate to those purposes unless longer retention is required for the investigation of a specific security incident or legal claim.
Cookies and Similar Technologies
The KongressExpert website may use cookies or comparable technologies.
Technically Necessary Technologies
Technologies strictly necessary for the functioning, security or delivery of a service explicitly requested by the user may be used without optional consent where permitted by applicable law.
Optional Technologies
Analytics, marketing, external media or other non-essential technologies are activated only where the legally required consent has been obtained.
Where a consent-management system is provided, users can manage or withdraw optional cookie consent through the relevant settings.
Withdrawal of consent does not affect processing that occurred lawfully before withdrawal.
Further details regarding individual technologies, providers, purposes and storage periods may be provided in the website’s cookie settings or a separate Cookie Policy.
External Content and Third-Party Services
The website or services may contain links to or integrations with third-party platforms.
Examples may include:
- maps;
- video platforms;
- conferencing platforms;
- social networks;
- payment services;
- event platforms;
- external registration systems.
Third-party services may process personal data under their own responsibility.
Where technically feasible and legally required, optional third-party services are not activated before the necessary consent has been obtained.
SGEM World Science is not responsible for independent processing carried out by third parties outside its control.
Users should consult the privacy information of the relevant provider where appropriate.
Photographs, Video and Event Recordings
Professional events may involve photography, video recording, livestreaming or other forms of media production.
Where SGEM World Science determines the purpose of such processing, participants will be informed as required by applicable law.
The legal basis will depend on the circumstances and may include:
- consent;
- contractual necessity;
- legitimate interests;
- another applicable legal basis.
Where KongressExpert provides photography, recording or streaming services solely on behalf of a Client, the Client may remain responsible for determining the relevant legal basis and providing participant notices.
Specific event notices may supplement this Privacy Policy.
Email and Professional Communications
If you contact KongressExpert by email or another communication channel, information contained in the communication will be processed for the purpose of responding to and administering the relevant matter.
Business correspondence may be retained where necessary for:
- project administration;
- contractual documentation;
- accounting;
- legal compliance;
- legitimate business records.
Please do not send confidential or sensitive personal information unless it is necessary for the relevant matter.
Direct Marketing
Where SGEM World Science sends direct marketing communications, processing will take place only where permitted by applicable law.
Where consent is required, marketing communications will be sent only after consent has been obtained.
You have the right to object at any time to processing of personal data for direct-marketing purposes.
Where you object, your personal data will no longer be used for that purpose.
Data Security
SGEM World Science uses appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- unlawful processing;
- accidental loss;
- unauthorised disclosure;
- alteration;
- destruction.
Measures are selected according to the nature of the information, the processing involved and the reasonably foreseeable risks.
Access to personal data is limited to authorised persons who require access for legitimate professional purposes.
No electronic system or transmission method can be guaranteed to be completely secure. Security measures are therefore reviewed and improved where appropriate.
Your Data-Protection Rights
Subject to the conditions and limitations provided by the GDPR, you may have the following rights:
Right of Access
You may request information about whether your personal data is being processed and obtain access to that data.
Right to Rectification
You may request correction of inaccurate personal data and completion of incomplete information.
Right to Erasure
You may request deletion of personal data where the applicable legal requirements are satisfied.
Right to Restriction of Processing
You may request restriction of processing in circumstances provided by the GDPR.
Right to Data Portability
Where applicable, you may request personal data provided by you in a structured, commonly used and machine-readable format and may have the right to transmit that data to another controller.
Right to Object
Where processing is based on legitimate interests, you may object on grounds relating to your particular situation.
You may object to processing for direct-marketing purposes at any time.
Right to Withdraw Consent
Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
Rights Concerning Automated Decisions
Where applicable, you have rights concerning decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
Exercising Your Rights
Requests concerning your personal data may be submitted to SGEM World Science using the contact details published in the Legal Notice / Impressum or on the KongressExpert website.
To protect personal information, we may request reasonable information necessary to verify the identity of the person making the request.
Requests will be handled in accordance with the time periods and requirements established by applicable data-protection law.
Right to Lodge a Complaint
If you believe that personal data relating to you has been processed unlawfully, you have the right to lodge a complaint with a competent supervisory authority.
For SGEM World Science in Austria, the relevant supervisory authority is:
Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Individuals may also have the right to contact another competent data-protection authority within the European Union where permitted under the GDPR.
Automated Decision-Making
SGEM World Science does not ordinarily use solely automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them.
If such processing is introduced for a particular service, the individuals concerned will receive the information required by applicable law.
Children
KongressExpert is a professional congress and event service and is not primarily directed at children.
Where an event legitimately involves minors, appropriate arrangements concerning consent, supervision and personal-data processing must be established according to the circumstances and applicable law.
Client Responsibilities
Clients that provide personal data to KongressExpert are responsible for ensuring that:
- the data was collected lawfully;
- there is a valid legal basis for providing it;
- affected individuals have received required privacy information;
- only information necessary for the project is provided;
- any required consents have been obtained.
This is particularly important where Clients provide participant, speaker, employee, exhibitor or guest information.
Changes to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect:
- changes in services;
- changes in technology;
- changes in processing activities;
- legal or regulatory developments;
- improvements to data-protection practices.
The current version will be published on the KongressExpert website together with the date of the latest update.
Material changes may be communicated separately where required by law.
Contact
Questions concerning this Privacy Policy or the processing of personal data by KongressExpert may be addressed to SGEM World Science using the contact information published on this website.
- E-mail
- [email protected]
- Phone
- +43 (1) 424 0031
- Address
- Haidingergasse 1, C/1113, 1030 Wien, Austria
- Authority
- Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna