18-ICML Privacy Policy

This Data Protection Policy “18-ICML Privacy Policy” (hereinafter the “Policy”) governs and informs how the Foundation for the Institute of Oncology Research, a Swiss-based not-for-profit foundation, processes personal data collected from participants registering to the International Conference on Malignant Lymphoma (“ICML”), authors of abstracts and other contact persons (hereinafter the “Data Subject”), pursuant to and in accordance with Sections 19 of the Federal Act on Data Protection ("FADP").

Data Controller

The Data Controller is the Foundation for the Institute of Oncology Research, Via Francesco Chiesa 5, 6500 Bellinzona, Switzerland (“Controller”).

Any communication regarding personal data protection may be submitted to the following email address: info@icml.com

Categories of Processed Personal Data

Depending on the type of services the Data Subject uses, the Controller collects the following personal data:

Identity Data: such as name, surname, nationality, title, city.
Professional Data: such as profession, specialty/focus, research areas of interest and HCP status, workplace, and professional address.
Contact Data: phone number, e-mail address.
Passport details or a copy thereof, only if you request an invitation letter to apply for a visa to enter Switzerland or if you apply for a reduced registration fee.
Pictures, curriculum vitae, disclosure of conflict of interest: if you are invited to be a member of ICML Scientific Advisory Board and/or Faculty.
Disclosure of conflict of interest: if you are the author and/or co-author of an abstract.
Photographs taken and videos made during the Conference.
Rating that is given to presentations and/or the event (Evaluation Form) and voting in a survey (polling tool) during the Conference and the person that has given such a rating and vote.
Questions submitted via the Q&A tool

Purposes of the Processing and Retention Period

Purposes of the Processing	Retention Period
A. Registration and Attending to the Conference Data is processed to enable Data Subjects to register for and participate in the International Conference on Malignant Lymphoma. You will need to use your personal account on the myICML platform to register. This process includes the sending of information emails about the relevant edition of the ICML and participation in the event. These emails are necessary to transmit organisational and logistical information related to the event. We do not process your credit card information. This is handled by Worldline Financial Services (Europe) SA. For further information on their privacy policy, please refer to their website (https://worldline.com/en-ch/compliancy/privacy.html). The submission of data flagged with an asterisk in the event registration form is required to enable the Controller to complete your registration and allow you to participate in the event.	4 years
B. On-site access control (badge) If you participate in the ICML in person, you will receive a badge containing the following data: first name, initial of the middle name, last name, workplace, country and HCP status. Due to access control needs, this data cannot be hidden. Therefore, by registering, you are requested to consent to such processing. If you do not wish to consent to such processing, you will have to attend the event remotely. The data may also be communicated to an external accommodation partner, to properly handle registration and accommodation requests.	Processed only during ICML days
C. General Photos and Videos of ICML premises ICML reserves the right to photograph and record the congress and participants, and to use such photographs and videos in any internal and external communication referring to ICML (website, social channels, press releases, newsletter or other publications). Please note that due to the large audience of participants, we cannot guarantee that you will not be the subject of photos or videos. Therefore, by registering, you are requested to consent to such processing. If you do not wish to consent to such processing, you will have to attend the event remotely.	The archive of recordings, photos, and videos is stored in a way accessible only to authorized persons.
D. Videos of the congress scientific sessions ICML is a hybrid event and it will live broadcast via the MyICML platform. The recording of the scientific sessions will be available on-demand for registered attendees and ESMO members. By taking on any role in the scientific programme (Invited speaker, proffered presenter, chairperson, discussant), all members of the faculty are requested to consent to such processing.	The videos are made available to ICML registered attendees and ESMO members for 6 months after the conference, then stored in a way accessible only to authorized persons.
E. Data Collection and Transmission to to companies and agencies present at the conference During online and on-site participation, companies and agencies that wish to track their interactions with participants may request the transmission of personal data or the scanning of participants' badges (if they are attending in-person). If, during the registration process, consent was given, the following information is transferred: first name, last name, email address, workplace, city, country, specialty/main activity, research areas of interest and HCP status. If consent was denied, no data will be transferred, even if the badge is scanned for access control to events organised by the companies and agencies.	Until the consent is revoked
F. Reports on virtual attendance of participants registered with third parties/group registration Companies sponsoring attendees’ participation (or their appointed agencies) may require reports on virtual attendance of their own third parties/group registration participants. By accepting the invitation, it is assumed that consent to this data processing (transmission of the list of live and on-demand virtual accesses to Scientific and Industry Programmes, virtual Poster and Exhibition Area) has been given. Invitees who do not agree to the report can decline the invitation.	The data are collected until the closure of the MyICML platform (6 months after the end of the conference). While the retention time is described in point A, the reports can be required within 1 year after the end of the conference.
G. Data Collection and Transmission to AACR and ESMO Subject to the consent of the Data Subject, personal data shall be disclosed and transmitted to: (1) the American Association for Cancer Research (AACR), 615 Chestnut St., 17th Floor, Philadelphia, PA 19106, USA; and (2) the European Society for Medical Oncology (ESMO), via Ginevra 4, 6900 Lugano, Switzerland. The transmission is to enable these associations to send you information on activities and events they have organised, as well as for statistical evaluations of participants in ICML and events of similar content. If consent is denied, no data will be transferred.	Until the consent is revoked
H. Abstract / Article Submission If you submit an abstract or an article, we store information of the categories of personal data 1, 2, 3 and 6 stated above about the first author and co-authors. We also store the content of the abstract or article and, after the reviewers’ evaluation and based on the Organising Committee decisions, we will pass it to the 18-ICML publisher (John Wiley and Sons Ltd) to be included in the Abstract Book and the Educational Book.	As long as there is a public interest in the processing of data for scientific research purposes.
I. Votes' Technical Check (Evaluation Form and poll tool) The rating (category 8) given by a participant is only processed to verify that there are no duplicate votes. Apart from this technical verification, the ratings remain anonymous.	1 year
J. Questions submitted via the Q&A tool Questions submitted by a participant via the Q&A tool cannot be anonymous. The name of the submitter is visible to chairpersons of the sessions, that may read it to the faculty members and to the audience if the question is selected for the Q&A session. By submitting questions via the Q&A tool, it is assumed that consent has been given to such data processing.	1 year
K. Anonymised Data Analysis Data is made anonymous for statistical purposes, in such a manner that the Data Subject is not or no longer identifiable (for example, statistical studies on the sourcing countries or research areas).	N/A

Recipients of Data

Personal data will be accessed only by those employees duly authorised and instructed to access personal data by the Controller, and only to the extent necessary according to the pursued purpose.

The Controller may communicate the personal data to third-party service providers, whose activities are legally mandatory or necessary to perform the Controller’s obligations. Third parties are entrusted with processing activities and appointed as processors when required by applicable laws.

The data and registration management system is hosted by Microsoft Azure (Switzerland), OVH (France) and Hetzner (Germany/Finland).

Please read the following table by way of example:

Categories of recipients	Purposes
Controlling company, subsidiaries and/or affiliates	Fulfillment of administrative and accounting requirements, as well as those connected with the services under the Agreement or building access control.
Third-party technical providers	Supply of services (assistance, maintenance, delivery/shipping of products, performance of additional services, providers of networks and electronic communication services) associated with the Agreement.
Tax or legal advisors	Assistance and consulting in accounting, administrative, legal, financial and tax issues.
Public authority	Fulfillment of legal obligations, defence of rights of the Controller, execution of orders.
18-ICML Publisher (John Wiley and Sons Ltd)	Publication of the conference scientific publications (Educational Book and Abstract Book)
Pharmaceutical Companies and Cooperating Associations (AACR and ESMO)	Analysis of participants' attendance and areas of interest.

Cross-Border Disclosure of Personal Data

The Data Subjects’ personal data shall be processed in the country where the Controller is located within countries mentioned in this Policy, that provide adequate protection and are listed in Annex 1 of the Data Protection Ordinance.

In the event personal data is disclosed to recipients not based in countries that guarantee an adequate level of protection, the Controller shall sign with the data importer the standard data protection clauses that the FDPIC has approved, issued, or recognized beforehand, according to Section 16, 2° d FADP, or shall implement other measures described in the same section in order to guarantee lawful processing of personal data.

Rights of the Data Subject

The Data Subject shall have the rights outlined in Section 25 et seq. of the FADP and Section 16 et seq. of the Data Protection Ordinance.

In particular, the Data Subject may request from the Controller access to the data, their deletion, the rectification of inaccurate data, integration of incomplete data, as well as the restriction of processing in the cases provided for in Section 25 et seq. FADP and Section 32 FADP.

Data Subjects also have the right to receive in a usual electronic format the Data concerning them or to demand its transmission to another data controller in the event that the conditions for the exercise of the right to have the Data delivered or to demand its transmission to a third party are met, as provided for in Section 28 FADP.

The Controller will use reasonable efforts to give the Data Subjects the requested information within 30 days (or will notify them of the period within which the information may be provided) and free-of -charge. A fee may be charged if the provision of the information involves a disproportionate burden.

These rights may be exercised by contacting the Controller at info@icml.ch.

The Data Subject may also file actions concerning the protection of personality by requesting the prohibition of specific processing of Data, prohibition of the disclosure of Data to third parties, and deletion or destruction of Data, as provided for in Section 32(2) FADP.

Revoke of consent

Data Subjects have the right to withdraw their consent at any time through their account in the reserved area of the MyICML platform or by sending an e-mail to info@icml.ch.

Withdrawing consent does not affect the lawfulness of processing based on consent given before such withdrawal.

18-ICML Privacy Policy – updated on 12 June 2024