DATA PROTECTION/PRIVACY INFORMATION

Version: 19 August 2026

1. Controller

The controller responsible for the processing of personal data is:

FEMclub – Female Excellence in Medicine
c/o WMA
Alser Straße 4
1090 Vienna
Austria

Email: femclub@wma.co.at
Website: www.femclubmed.org

The controller determines the purposes and means of processing personal data.

2. Who does this Privacy Information apply to?

This Privacy Information applies to:

• members and persons applying for membership;
• participants and other persons registering for FEMclub events;
• persons contacting FEMclub;
• recipients of the FEMclub newsletter;
• speakers, presenters, sponsors, cooperation partners and other event-related contacts.

Participation in an event does not require the person concerned to be a member of FEMclub.

3. What data do we process?

Depending on the purpose, we may process the following categories of personal data:

• name and, where applicable, academic or professional title;
• contact details, in particular email address, postal address and telephone number;
• professional information, such as institution, field of expertise or function;
• membership details, including commencement, status and membership fees;
• event registration data, such as the event selected, participation options, workshop preferences or catering requirements;
• invoicing and payment details;
• correspondence and other information you provide to FEMclub;
• technical data generated when using the website or an online registration form.

FEMclub does not generally intend to collect special categories of personal data within the meaning of Article 9 GDPR, such as health data. Please only provide such data if it is expressly required and you are specifically asked to do so.

4. Purposes and legal bases

4.1 Membership administration

Data relating to members and membership applicants is processed for the following purposes:

• processing membership applications;
• establishing, administering and terminating membership;
• membership administration and communication with members;
• organising and carrying out the association’s activities;
• collecting and administering membership fees;
• complying with statutory retention and documentation obligations.

The legal bases are Article 6(1)(b) GDPR, insofar as processing is necessary for the membership relationship, Article 6(1)(c) GDPR, insofar as processing is necessary to comply with legal obligations, and, where applicable, Article 6(1)(f) GDPR, based on FEMclub’s legitimate interest in proper association administration.

4.2 Organisation of events

Data relating to participants is processed for the following purposes:

• processing and confirming registrations;
• preparing participant lists;
• organising admission, name badges, seating arrangements and programme sessions;
• communicating organisational changes;
• invoicing and payment administration;
• issuing certificates of participation;
• carrying out and documenting the event;
• complying with statutory retention and documentation obligations.

The legal basis is generally Article 6(1)(b) GDPR where processing is necessary to carry out the requested event or process a registration. Where processing is not directly necessary for the performance of the relevant contract, it may be based on Article 6(1)(f) GDPR, in particular FEMclub’s legitimate interest in efficient and secure event organisation.

4.3 Newsletters and association communications

FEMclub may send newsletters and other electronic communications where valid consent has been provided or where such communication is otherwise permitted by law.

When subscribing to the newsletter, we generally process the subscriber’s name and email address. Subscription is generally carried out using a double opt-in procedure. Consent may be withdrawn at any time with effect for the future. You may unsubscribe using the unsubscribe link included in each newsletter or by emailing femclub@wma.co.at.

The lawfulness of processing carried out before consent was withdrawn remains unaffected. Following unsubscribing, the data will be removed from the active newsletter distribution list. Evidence of subscription and unsubscribing may be retained as required by law.

The legal basis is Article 6(1)(a) GDPR where the newsletter is based on consent.

Membership alone does not automatically mean that a person may be added to a general newsletter distribution list. Necessary organisational communications relating to an existing membership or a booked event must be distinguished from general newsletter communications.

4.4 Contact

If you contact FEMclub by email, contact form, telephone or other means, FEMclub processes the information you provide in order to deal with and respond to your enquiry.

The legal basis is Article 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract. In all other cases, the legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in appropriate communication.

5. Obligation to provide data

The provision of certain data is necessary for membership or participation in an event. The required data is indicated in the relevant membership or registration form and is generally marked as mandatory.

If required data is not provided, FEMclub may be unable to administer the membership or carry out the requested event participation. The provision of additional data marked as voluntary is not mandatory.

6. Recipients and processors

Personal data is disclosed only where this is necessary for the purposes described above, required by law or permitted on another legal basis under data protection law.

FEMclub may engage the following categories of recipients:

• FEMclub employees and officers, insofar as they require the data to perform their duties;
• tax advisers, accounting providers and other service providers subject to professional confidentiality obligations;
• event, congress and registration service providers;
• IT, hosting and email service providers;
• payment service providers and banks;
• printing and mailing service providers;
• public authorities, courts or other bodies where required by law.

Where service providers process personal data on behalf of FEMclub, they are engaged as processors pursuant to Article 28 GDPR. Data processing agreements or other appropriate data protection agreements are concluded with such providers.

FEMclub uses EventsAir for event registration. FEMclub uses MailerLite to send newsletters and, where applicable, other association communications. The data processed may include names, email addresses, organisational or professional information and event-related details, insofar as necessary for the relevant purpose.

The specific recipients, subprocessors and storage locations may change as a result of changes to the services used. The providers’ current privacy policies and lists of subprocessors also apply.

7. Transfers to third countries

Personal data is transferred to countries outside the European Economic Area only where the requirements of Chapter V GDPR are met.

This may be based in particular on an adequacy decision of the European Commission, appropriate safeguards – such as Standard Contractual Clauses – or another legally permitted basis. Under its contractual terms and depending on the subprocessors used, MailerLite may process data outside the European Economic Area. Any such transfers must be based on the safeguards provided for under the GDPR.

8. Retention period

FEMclub stores personal data only for as long as necessary for the relevant purposes.

The following principles apply in particular:

• Membership data is generally stored for the duration of the membership and thereafter for as long as statutory retention, documentation or limitation periods apply.
• Event data is stored for as long as necessary to organise, invoice and follow up the event.
• Invoicing and payment data is stored in accordance with statutory retention obligations.
• Newsletter data is stored in the active distribution list until unsubscribing or withdrawal of consent.
• Data required for the establishment, exercise or defence of legal claims may be stored until the relevant limitation or procedural periods have expired.

Once the relevant purpose has ceased and statutory retention periods have expired, the data will be deleted or anonymised unless another legal basis permits or requires continued storage.

9. Automated decision-making

No automated decision-making, including profiling, takes place that produces legal effects concerning you or similarly significantly affects you.

10. Your rights

Subject to the statutory requirements, you have the following rights:

• the right to obtain access to your personal data;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to withdraw consent at any time with effect for the future;
• the right to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR;
• the right to object at any time to the processing of personal data for direct marketing purposes.

To exercise your rights, please contact:

FEMclub Secretariat
c/o WMA
Alser Straße 4
1090 Vienna
Austria

Email: femclub@wma.co.at

11. Data security

FEMclub takes appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure and unauthorised access.

Access to membership and event data is restricted to those persons who require the data to perform their duties. Databases, local systems and cloud services should be protected by appropriate access controls, secure passwords, up-to-date software and, where appropriate, encryption.

12. Photographs and reporting on events

Photographs, video recordings and other reports relating to events are not automatically covered by this Privacy Information. Publication will only take place where an appropriate legal basis exists.

Where recordings and publication are planned, FEMclub will provide separate information concerning:

• the purpose of the recording and publication;
• the media and communication channels concerned;
• the scope of the publication;
• where applicable, the legal basis and available withdrawal or objection options.

At events, it should be clearly indicated whether photographs or videos will be taken and whom persons may contact if they do not wish to be recorded.

13. Updates to this Privacy Information

FEMclub may amend this Privacy Information where legal requirements, processing purposes or the service providers used change. The version published on the website at the relevant time shall apply.