Privacy Policy
How ESP Event Management handles personal data
Version 1.0 · effective 13 October 2026
reply within one month
Western Europe region
www.dpa.gr
1. Who we are
The data controller is ESP Event Management ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (single-member private company), General Commercial Registry (GEMI) no. 183973709000, VAT EL802852335, registered office 27–29 Alipedou Street, 185 40 Piraeus, Greece; offices 7 Sevastoupoleos Street, 115 26 Athens, Greece; tel. +30 697 876 3739; e-mail info@esp.events. For any question about your personal data or to exercise your rights, write to info@esp.events.
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and Greek Law 4624/2019.
2. When we act as controller and when as processor
We are the controller for data we process for our own purposes: our website, our customers and suppliers, events we organise in our own name, and equipment rental. When we organise an event or run registrations on behalf of a client (for example a scientific society or a company), the client is usually the controller and we act as processor under a data-processing agreement (Article 28 GDPR). In that case the client's privacy notice also applies, and requests about your data may be forwarded to the client.
3. What data we process, why, and on what legal basis
| Who / what | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Event registrants and ticket buyers | Name, contact details, organisation, profession/speciality, membership or eligibility details, registration choices, dietary or accessibility requirements you tell us, payment and invoice details | Registration, badges, attendance, certificates, invoices, event communications | Contract (6(1)(b)); legal obligation for invoicing and tax (6(1)(c)). Accessibility or dietary information that reveals health data is processed only with your explicit consent (Art. 9(2)(a)). |
| Healthcare professionals at sponsored events | Identity, speciality, institution, hospitality provided | Compliance with the transparency and hospitality rules of EOF and the EFPIA/SFEE and MedTech Europe codes | Legal obligation (6(1)(c)) and legitimate interest in compliance (6(1)(f)) |
| Speakers and faculty | Name, affiliation, biography, photo, presentations, travel and honoraria data | Programme, publication of the faculty, travel, payments | Contract (6(1)(b)); legal obligation for payments (6(1)(c)) |
| Attendees in photos, video and streams | Image and voice | Event documentation, streaming, on-demand content, promotion of the event | Legitimate interest (6(1)(f)); consent where required. You may opt out at registration and on site. |
| Rental and services customers | Contact persons' names and business contact details, order, delivery and payment data; ID details of the person receiving or returning equipment | Quotations, contracts, delivery and return of equipment, invoicing, protection of our property | Contract (6(1)(b)); legal obligation (6(1)(c)); legitimate interest in protecting our equipment (6(1)(f)) |
| Website visitors | IP address, browser data, strictly necessary cookies (see section 8) | Operating and securing the website and the shopping cart | Legitimate interest (6(1)(f)) |
| Newsletter subscribers | E-mail address, name, interests | Information about our events and services | Consent (6(1)(a)), which you can withdraw at any time via the unsubscribe link |
| Enquiries | Whatever you send us through forms, e-mail or phone | Answering your enquiry | Legitimate interest (6(1)(f)) or steps before a contract (6(1)(b)) |
4. Who receives your data
We share personal data only as needed for the purposes above, with:
- the organising society or company of the event you register for;
- venues, hotels, transport and catering providers involved in your participation;
- accrediting bodies (for CME/CPD credits) and, for sponsored healthcare professionals, sponsors and authorities where the law or the applicable codes require it;
- our IT and service providers acting as processors: Microsoft (Microsoft Azure, which hosts our business platform and website, with data located in the Western Europe region; and Microsoft 365 for e-mail and documents) and Stripe (online card payments; card data is entered directly with Stripe and is not stored by us);
- our accountants, legal advisers and auditors, banks, and public authorities (including the Independent Authority for Public Revenue / myDATA) where required by law.
We do not sell personal data.
5. Transfers outside the European Economic Area
Where a service provider processes data outside the EEA, we ensure an adequate level of protection, for example an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses. Our main providers, Microsoft and Stripe, store our data in the EEA but may access or transfer it outside the EEA for support, security or fraud prevention; they rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
6. How long we keep data
- Accounting and tax records (invoices, payments): for the period required by Greek tax and accounting law, generally 5 years from the end of the financial year to which they relate, and longer where an audit or dispute is pending.
- Registration and attendance records: for 5 years after the event, or longer where an accrediting body or the applicable healthcare-compliance rules require it.
- Rental contracts and handover records: 5 years after the end of the contract.
- Newsletter data: until you unsubscribe.
- Enquiries that do not lead to a contract: 12 months.
- Event photos and videos: for as long as they are used for the stated purpose; you may ask us to remove an image in which you are clearly identifiable.
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability, under the conditions of Articles 15–22 GDPR. Where processing is based on consent, you may withdraw it at any time without affecting earlier processing. To exercise your rights, write to info@esp.events; we will answer within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority, 1–3 Kifissias Avenue, 115 23 Athens, www.dpa.gr.
8. Cookies
Our website uses cookies that are strictly necessary for it to work (for example session, language, shopping cart and security cookies). During online payment, Stripe also sets cookies that are necessary to process the payment and prevent fraud. These do not require consent. We do not use analytics, advertising or social-media tracking cookies.
9. Security
We protect personal data with appropriate technical and organisational measures, including access control, encrypted connections and limited staff access on a need-to-know basis.
10. Changes
We may update this policy. The current version is always available on this page with its effective date.