PROTECTION OF YOUR PERSONAL DATA

Processing operation: EBRAINS Summit 2025 (hereinafter referred to as “Event”)

‍Name and Address of the Data Controller: EBRAINS AISBL, Chau. de la Hulpe 166, 1170 Watermael-Boitsfort, Belgium (hereinafter referred to as “controller”)

‍

1. Introduction

Personal data is any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier.

EBRAINS is committed to protect your personal data and to respect your privacy. EBRAINS collects and further processes personal data pursuant to the General DataProtection Regulation (EU) 2016/679 ('GDPR').

This privacystatement explains the reason for the processing of your personal data in the context of the Event undertaken by the controller It explains the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data.It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights and the Data Protection Officer.

2. Purpose - Why and how do we process your personal data?

The controller collects and further processes your personal data to provide youwith information about the Event (before, during and after) and to process yourregistration for participation therein.

Live web-streaming and audio-visual recording of the speakers, organisers and participants, as well as photographs of the speakers, participants and organisers will be taken on behalf of EBRAINS by authorised staff members and an external service provider and published in the context of the Event at the EBRAINS.eu website, EBRAINS social Media channels, for press or public relations work.

Your personal data will not be used for any automated decision-making including profiling.

3. On what legal ground(s) do we process your personal data?

The personal data is processed by the controller based on the voluntary transmission of the Personal Data by the participant and the participant’s consent.

The participation to the Event is offered to each participant in order to learn more about EBRAINS and EBRAINS’s services. The participant is warmly invited to participate in the Event. The participant has the option but not the obligation to participate in the Event. This does not exercise any pressure onData Subjects who are not willing to participate in the Event.

Your consent is required for:

• the processing of your personal data to provide you with information about theEvent (before, during and after) and to process your registration for participation therein;
• the processing of your personal data relating to your dietary requirements and/or access requirements;
• taking photographs during the Event and publishing it in the context of the Event at the EBRAINS.eu website, EBRAINS social Media channels, for press or public relations work;
• audio-visual recordings during the Event and publishing it in the context of the Event at the EBRAINS.eu website, EBRAINS social Media channels, for press or public relations work;
• the sharing of the participants’ list containing your name and affiliation with other participants for the following purposes: future collaboration, networking, match making;
• the sharing of the Event attendee list containing your name and affiliation among participants, in order to create working groups to continue the collaborate work launched during the Event;
• the processing of your personal data for inviting you to future events the data controller may organise;
• the processing of your personal data for managing your subscription to a newsletter of the data controller.

If you opt-in, you are giving us your explicit consent under Article 5(1)(d)of Regulation (EU) 2018/1725 to process your personal data for those specific purposes. You can give your consent via a clear affirmative actby ticking the box(es) on the online registration form.

Your consent for these matters can be withdrawn at any time:

• for unsubscribing from the newsletter, please send an email to privacy@ebrains.eu
• for withdrawing consent that you have provided in order to benefit from other services, please contact the controller of the Event at privacy@ebrains.eu

Provision applicable to speakers at theEvent: The processing operations on personal data of the speakers with whom a contract is concluded, are carried out in line with the contractual provisions.Consequently, that processing is necessary and lawful under Article 5(1)(c) ofRegulation (EU) 2018/1725 (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract).

4. Which personal data do we collect and further process?

The following personal data will be processed:

‍

5. How long do we keep your personal data?

The Data Controller only keeps your personal data for the time necessary to fulfil the purpose of collection orfurther processing.

For each of the categories of personal data that is processed, please find below the retention details:

• All personal data related to the organisation and management of theEvent (this includes the information given during the registration, before, during or after the event) will be deleted one year after the last action in relation to the Event.
• Sensitive personal data relating to dietary and/or access requirements will be deleted as soon as they are no longer necessary for the purpose for which they have been collected in the framework of the Event, but no later than within 1 month after the end of theEvent.
• In case of audio-visual recording of the Event, the recordings will be kept for 4 years after the Event before being deleted.
• Personal data shared with the controller for future mailing purposes (e.g.,for receiving newsletters or invitations to similar events) are processed until the person revokes its consent.
• Selected service providers for organisational purposes (such as caterers, travel agents or event management organisations) are contractually bound toprocess personal data on behalf of and in line with the instructions of the data controller, keep confidential any data they process and protect it from unauthorised access, use and retention.

6. How do we protect and safeguard your personal data?

All personal data in electronic format(e-mails, documents, databases, uploaded batches of data, etc.) are stored on the servers of EBRAINS or by its suppliers as listed in this privacy notice.

In order to protect your personal data, EBRAINS has put in place a number of technical and organisational measures. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your personal data and to whom is it disclosed?

Access to your personal data is provided to EBRAINS staff responsible for carrying out this processing operation and to other authorised staff according to the “need to know” principle. Such staff abide by statutory, and when required, additional confidentiality agreements.

Where necessary, we may also share your information with service providers for the purposes of organising the Event.

‍

‍

7.1 Third party IT tools, including Social Media

We use third party IT tools to register for the event, enable networking and collaboration, to inform about and promote the Event through widely used communication channels, including the social media.

You can watch our videos, which we also upload to our social media channels

‍
https://twitter.com/ebrains_eu

https://www.linkedin.com/company/ebrains-eu/about/

https://www.youtube.com/channel/UC6E796cVVR5Xrs2A5jJmleQ

https://mastodon.social/@ebrains

https://bsky.app/profile/ebrains.bsky.social

In order to protect your privacy, our use of third-party IT tools to connect to those services does not set cookies when our website pages are loaded on your computer (or other devices), nor are you immediately redirected to those social media or other websites. Only in the event that you click on a button or “play” on a video to watch it, a cookie of the social media company concerned will be installed on your device. If you do not click on any social media buttons or videos, no cookies will be installed on your device by third parties.

In order to view such third-party content on our websites, a message will alert you that you need to accept those third parties’ specific Terms and Conditions, including their cookie policies, over which EBRAINS has no control.

We recommend that users read the relevant privacy policies of Ebrains (https://www.ebrains.eu/page/terms-and-policies) carefully before using them.These explain each company’s policy of personal data collection and further processing, their use of data, users' rights and the ways in which users can protect their privacy when using those services.

The use of a third party IT tool does not in any way imply that EBRAINS endorses them or their privacy policies. In the event that one or more third party IT tools are occasionally unavailable, we accept no responsibility for lack of service due to their downtime.

7.2 International transfers

Personal data is primarily processed within the European Union (EU), in accordance with Regulation (EU) 2016/679(GDPR), which ensures a high level of data protection.

In cases where, for technical or operational reasons, it becomes necessary to transfer personal data to countries outside the European Economic Area (EEA), such transfers will be carried out in full compliance with applicable data protection laws. Where there is no adequacy decision by the European Commission, we ensure that appropriate safeguards are in place, including the use of the European Commission’s Standard Contractual Clauses (SCCs), to protect your data during and after the transfer.

8. What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) ofRegulation (EU) 2018/1725, in particular the right to access, your personal data and to rectify them in case your personal data are inaccurate or incomplete. Where applicable, you have the right to erase your personal data, to restrict the processing of your personal data, to object to the processing, and the right to data portability.

You have the right to object to the processing of your personal data, which is lawfully carried out pursuant to Article 5(1)(a) of Regulation (EU) 2018/1725 on grounds relating to your particular situation.

You have consented to provide your personal data to the data controller for the present processing operation. You can withdraw your consent at any time by notifying the data controller via privacy@ebrains.eu. The withdrawal of your consent will not affect the lawfulness of the processing carried out before you have withdrawn the consent.

You can exercise your rights by contacting the data controller, or incase of conflict the Data Protection Officer.

9. Contact information

You may contact the Data Protection Officer  (privacy@ebrains.eu) with regard to issues related to the processing of your personal data under Regulation (EU) 2018/1725.

We make every effort to handle your personal data in a careful and legitimate manner in accordance with applicable regulations.

Nevertheless, if you believe that your rights have been violated and if your concerns have not been addressed within EBRAINS, you are free to lodge a complaint with the: Belgian Data Protection Authority Rue de la Presse 35, 1000Brussels /Drukpersstraat 35, 1000 Brussels +32 (0)2 274 48 00 +32 (0)2 274 4835 contact@apd-gba.be

You can also contact the data protection authority for all general questions relating to the processing and protection of Personal Data. You may also have a right to lodge a complaint with another data protection authority(DPA).

Contact information for the European Data Protection Board and EU DPAs is available here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080https://edpb.europa.eu/aboutedpb/board/members_en.

In addition, you may bring an action before a court if you believe that you would suffer damage as a result of the processing of your Personal Data.