The EBMT (European Group for Blood and Marrow Transplantation) is committed to user privacy. The EBMT website https://www.ebmt.org – has been structured so that users can visit it without identifying themselves or revealing any personal information.
Any personal data that a user may decide to provide us will be used to support the relationship between the EBMT and this user.
What is personal data?
Personal data is any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
How is personal data obtained?
EBMT collects personal data only if you voluntarily submit it by completing the on-line forms. When you choose to submit personally identifiable information to EBMT, the latter will use your information only for the purposes for which you have consented. The purpose for processing the personal data is detailed in the on-line form or application form.
Cookies and Online Tracking
EBMT uses cookies on its website to enhance user experience and monitor website performance. These cookies may collect non-identifiable information about how users interact with the website. Users can manage their cookie preferences or disable cookies through their browser settings. For more details, please visit our https://www.ebmt.org/cookie-policy
How is personal data processed?
The EBMT ensures that all personal data under its responsibility is processed according to the General Data Protection Regulation (GDPR 2016/679)
- Processed lawfully, fairly and in a transparent manner in relation to the data subject;
- Collected for legitimate purposes;
- Processed adequately, relevantly and not excessively in relation to the purposes for which they are collected and/or further processed;
- Accurate and up to date;
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
- Processed in a manner that ensures appropriate security of the personal data through technical and organisation measures.
Legal Basis for Processing Personal Data
EBMT processes personal data based on the following legal grounds, as specified by the GDPR:
- Consent (Article 6(1)(a)): When users voluntarily provide personal data through online forms or other means.
- Legitimate Interests (Article 6(1)(f)): To support scientific research and the development of improved transplant and therapy procedures.
- Legal Obligations (Article 6(1)(c)): To comply with regulatory requirements, such as obligations to national health authorities.
For sensitive personal data, such as health-related data, processing is performed under GDPR Article 9(2)(j) for scientific research purposes, and appropriate safeguards are in place.
Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law. Specifically:
- Research-related data will be retained for 10 years after the study concludes, in accordance with scientific standards.
- Personal data provided for general communications will be retained until consent is withdrawn.
- Records related to regulatory obligations will be stored for the period required by applicable laws.
Retention periods are reviewed periodically to ensure compliance with GDPR requirements.
Personal Data Transfers
EBMT will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so.
EBMT works with “Collaboration Partners,” including national registries, national health authorities, researchers, and marketing authorization holders (MAHs), to support clinical research and improve treatment outcomes.
Collaboration Partners may act as:
- Joint Controllers: Sharing responsibility for the data processing.
- Processors: Acting under EBMT’s instructions and safeguards.
All data transfers are subject to data protection agreements, ensuring compliance with GDPR. If data is transferred outside the EEA, EBMT ensures equivalent protection through Standard Contractual Clauses (SCCs) or adequacy decisions.
Where is the Personal Data Stored?
Personal data is stored in an electronic database property of EBMT which will be allocated in the EEA (European Economic Area) or in countries that are provided with the same level of protection for privacy.
What are my rights as the Data Subject?
- Right to access information.
- Right to rectification.
- Right to withdraw consent.
- Right to erasure ("right to be forgotten").
- Right to lodge a complaint with a supervisory authority.
How to Exercise Your Rights:
To exercise any of the rights listed above, contact:
Email: data.protection@ebmt.org
Postal Address:
The Data Protection Officer
EBMT Executive Office
Aticco Med Fórum
Passeig de Garcia Fària, 49
08019 Barcelona, Spain
Automated Decision-Making
EBMT does not use automated decision-making or profiling processes that significantly impact individuals. Should such processes be introduced, individuals will be informed about the logic involved, as well as the significance and potential consequences of these decisions, in accordance with GDPR Article 22.
Comments or questions
If you have any comments or questions about this privacy policy, please send them to data.protection@ebmt.org
The Data Protection Officer
EBMT Executive Office
Aticco Med Fórum
Passeig de Garcia Fària, 49
08019 Barcelona, Spain