EUROPEAN ENDOSCOPIC SPINE SOCIETY

Privacy Policy

In accordance with EU Regulation 2016/679 (GDPR) and French data protection law

Last updated: September 2026 | Version 1.0

1. Data Controller

European Endoscopic Spine Society (EESS)
Registered non-profit scientific society — France
Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.
Website: https://eespinesociety.eu
Supervisory Authority: CNIL (Commission Nationale de l'Informatique et des Libertés) — www.cnil.fr

The European Endoscopic Spine Society (hereinafter "EESS", "we", "us", or "our") is the data controller responsible for your personal data collected through this website and through EESS activities. We are committed to protecting your personal data and processing it in compliance with the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés.

2. Scope of This Policy

This Privacy Policy applies to all personal data collected by EESS through:

This website (https://eespinesociety.eu) and any associated subdomains
Membership registration and management
Event registration and attendance (congresses, masterclasses, fellowships, webinars, symposia)
Media consent forms (photographs, video, and audio recordings)
Scientific research participation and data registries
Email communications and newsletters
Industry partnership and sponsorship enquiries

3. Personal Data We Collect

3.1 Data You Provide Directly

When you interact with EESS, we may collect the following categories of personal data:

Full name, professional title, medical specialty Identity data:
Email address, telephone number, institutional affiliation, country of residence Contact data:
Surgical specialty, hospital or institution, years of experience, professional registration details Professional data:
Registration details, dietary requirements (if provided), attendance records Event data:
Photographs, video recordings, audio recordings, and your image or likeness captured during EESS events, where consent has been given Media data:
Payment information for membership fees or event registration (processed securely via third-party payment providers — EESS does not store card details) Financial data:
Content of messages, enquiries, or correspondence sent to EESS Communication data:

3.2 Data Collected Automatically

When you visit our website, we may collect limited technical data automatically, including:

IP address and browser type
Pages visited and time spent on site
Referring URL and device type

This data is used solely for website security and performance purposes and is not used to identify individual visitors without separate consent.

4. Legal Basis for Processing

We process your personal data only where we have a valid legal basis under GDPR Article 6. The bases we rely on are:

Consent (Article 6(1)(a)): Where you have given us explicit consent — for example, for media use (photographs, video, audio), newsletter subscriptions, or participation in research activities. You may withdraw consent at any time.
Contractual necessity (Article 6(1)(b)): Where processing is necessary to fulfil a membership agreement or event registration with you.
Legitimate interests (Article 6(1)(f)): Where processing is necessary for our legitimate interests as a scientific society — such as maintaining member records, improving our website, or communicating with institutional partners — and these interests are not overridden by your rights.
Legal obligation (Article 6(1)(c)): Where processing is necessary to comply with applicable French or EU law.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

Processing and managing your EESS membership
Registering you for and administering events, congresses, courses, and webinars
Sending scientific updates, educational content, and society communications
Publishing media (photographs, video, audio) from EESS events, where consent has been given
Conducting and supporting scientific research, registries, and publications
Managing relationships with industry partners, sponsors, and institutional collaborators
Improving the EESS website and digital services
Complying with our legal obligations under French and EU law
Responding to your enquiries and requests

6. Media & Recording Data

EESS activities — including congresses, masterclasses, workshops, and digital webinars — may be photographed, filmed, or audio recorded. Where this occurs:

We will always seek your explicit prior consent via our Media Consent Form before capturing or using recordings in which you appear as an identifiable individual.
Recorded materials may be used for scientific, educational, promotional, communicational, and commercial purposes, as specified in the consent form.
Materials may be published on the EESS website, social media channels (LinkedIn, YouTube, Instagram), in print, and shared with institutional or industry partners.
You may withdraw media consent at any time by contacting This email address is being protected from spambots. You need JavaScript enabled to view it.. Withdrawal will not affect use already made of materials prior to that date.

7. Data Sharing & Third Parties

EESS does not sell your personal data. We may share your data with the following categories of trusted third parties, only where necessary and under appropriate data processing agreements:

Event management platforms and registration services
Secure payment processors (for membership fees and event registration)
Email marketing platforms (for society communications — opt-out available at any time)
Video hosting and streaming platforms (e.g., YouTube, Zoom) for digital events and webinars
Academic co-organisers and institutional partners involved in joint events or research
Web hosting and IT service providers maintaining the EESS website

All third-party providers are required to process your data in compliance with GDPR and are bound by contractual confidentiality obligations.

8. International Data Transfers

EESS is a globally active society and some of your data may be shared with partners or collaborators outside the European Economic Area (EEA). Where this occurs, we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission
Transfers to countries with an EU adequacy decision

You may request further information about international transfers by contacting us at This email address is being protected from spambots. You need JavaScript enabled to view it..

9. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention guidelines are:

Membership data: retained for the duration of membership and up to 5 years after lapse, for legitimate record-keeping purposes
Event registration data: retained for up to 3 years following the event
Media consent records: retained for as long as the corresponding media is in active use, plus 5 years
Financial records: retained for 10 years in accordance with French accounting law
Website technical data: retained for a maximum of 13 months

When data is no longer required, it is securely deleted or anonymised.

10. Your Rights Under GDPR

As a data subject under EU GDPR, you have the following rights, exercisable at any time by contacting This email address is being protected from spambots. You need JavaScript enabled to view it.:

Right of access (Article 15): Request a copy of the personal data we hold about you.
Right to rectification (Article 16): Request correction of inaccurate or incomplete data.
Right to erasure (Article 17): Request deletion of your personal data, where no overriding legal basis for retention exists.
Right to restriction (Article 18): Request that we limit processing of your data in certain circumstances.
Right to data portability (Article 20): Request a machine-readable copy of the data you provided to us, for transfer to another controller.
Right to object (Article 21): Object to processing carried out on the basis of legitimate interests.
Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We will respond to all legitimate requests within 30 days. If we are unable to comply, we will explain why.

11. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the relevant supervisory authority:

French supervisory authority:
CNIL — Commission Nationale de l'Informatique et des Libertés
Website: www.cnil.fr | Telephone: +33 1 53 73 22 22

If you are resident in another EU member state, you may also lodge a complaint with the supervisory authority in your country of residence.

12. Cookies & Website Tracking

The EESS website may use cookies and similar tracking technologies to ensure basic website functionality and to analyse website performance. Where non-essential cookies are used, we will request your consent before placing them.

You may manage cookie preferences at any time via your browser settings. Disabling cookies may affect certain website functionality.

A detailed Cookie Policy will be published separately on the EESS website. [Placeholder — to be added]

13. Data Security

EESS implements appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, disclosure, or destruction. These measures include:

Access controls and restricted permissions for staff handling personal data
Secure encrypted storage for sensitive data
Use of trusted, GDPR-compliant third-party platforms
Regular review of data handling procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNIL within 72 hours and will inform affected individuals without undue delay, in accordance with GDPR Article 33–34.

14. Children's Data

EESS activities are directed exclusively at healthcare professionals and medical researchers. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has submitted data to us, please contact This email address is being protected from spambots. You need JavaScript enabled to view it. and we will delete it promptly.

15. Changes to This Policy

EESS may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The most current version will always be available on our website at https://eespinesociety.eu, with the date of last revision indicated at the top of the document.

Where changes are material, we will notify members and registered contacts by email prior to the changes taking effect.

16. Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or your personal data, please contact:

European Endoscopic Spine Society (EESS)
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Website: https://eespinesociety.eu

For urgent data protection matters, please mark your email subject: DATA PROTECTION REQUEST