1. Who we are and what this Policy covers
European Conferences United Sp. z o.o. (“ECU”, “we”, “us”) organises and develops professional events, communities, research activities and industry platforms, primarily for the retail, consumer-goods and related business sectors.
This Privacy Policy explains how ECU collects and processes personal data in connection with activities including:
Poland & CEE Retail Summit and related conferences and events;
Club of 369;
Solution Providers Hub;
Advisory Committees, speakers, moderators and panelists;
Dinners2Connect and other ECU dinners and meetings;
awards and recognition programmes;
surveys, interviews, research and industry-contribution projects;
sponsorships, partnerships, exhibitions and other commercial relationships;
ECU websites, registration forms and digital services;
ECU’s wider professional relationship database.
Our activities are business-to-business and concern primarily people acting in their professional capacity.
2. Controller and privacy contact
The controller of your personal data is:
European Conferences United Sp. z o.o.
ul. Ludwinowska 7/16
30-331 Kraków
Poland
KRS: 0000132734
NIP: 6762228354
For privacy questions, objections or requests, contact:
info@conferences-united.eu
3. What personal data we process
Depending on our relationship with you, ECU may process:
Professional identity and contact information
name;
job title, role and professional responsibilities;
employer, organisation or business affiliation;
business email address;
professional telephone number where available;
business address;
LinkedIn profile or other publicly available professional profile.
Professional relationship information
professional interests, expertise and areas of responsibility;
previous interactions with ECU;
invitations and responses;
event participation and attendance history;
Club of 369, Advisory Committee, speaker, panel or other contribution history;
correspondence;
feedback, survey responses and research contributions;
relevant communication preferences.
Event and operational information
registrations;
badge and attendance information;
programme participation;
event requests;
information necessary to administer attendance or participation.
Commercial and administrative information
contractual information;
company and invoicing details;
transaction and payment-status information;
sponsorship, exhibition, partnership or supplier information.
ECU does not store payment-card numbers or comparable payment credentials. Such credentials are handled by the relevant payment or banking provider.
Photographs and audiovisual material
We may process photographs, video recordings and other audiovisual material created in connection with ECU activities.
Website and technical information
When you use an ECU website or digital service, ECU or the provider operating that service may process technical information necessary to deliver and secure the service, such as IP address, device or browser information, timestamps and technical or security logs.
Optional special-category information
For a particular event, you may choose to give us information concerning allergies, dietary requirements, disability, accessibility requirements or similar matters.
Where such information reveals health information, religious or philosophical beliefs, or other special-category personal data within Article 9 GDPR, it receives additional protection.
4. Where we obtain personal data
Information obtained directly from you
We may obtain information when you:
register for or attend an ECU activity;
communicate with ECU;
participate as a speaker, moderator, panelist or Advisory Committee member;
participate in Club of 369;
complete a survey or contribute to research;
participate in a dinner or meeting;
request information;
enter into a commercial or contractual relationship with ECU;
use an ECU form, website or digital service.
Information created through our relationship with you
ECU may create and retain information about our interactions with you, such as participation history, correspondence, contributions, relevant professional interests and communication preferences.
Public professional sources
ECU conducts professional market and industry research. We may therefore obtain limited professional information from publicly available sources, including:
LinkedIn;
company and organisational websites;
public professional profiles;
public business or professional information;
other relevant public industry sources.
We do not purchase or rent personal-data lists for inclusion in our professional relationship database.
5. Information about data obtained from other sources
Where ECU obtains your personal data from a source other than you and Article 14 GDPR applies, we provide the required privacy information within the period required by the GDPR.
This normally means within a reasonable period after obtaining the information and no later than one month. If we communicate with you earlier, the information is provided no later than the first communication. If disclosure to another recipient is envisaged earlier, the information is provided as required before or at that disclosure.
Exceptions apply only where permitted by law, for example where you already have the relevant information or another Article 14 exception applies.
6. Why we process personal data and our legal bases
Different legal bases apply to different processing activities.
Providing an event, service or contractual relationship
We process data where necessary to:
administer a requested registration;
provide participation in an event or activity;
administer a commercial relationship;
take requested steps before entering into a contract;
perform an agreement with you.
The principal legal basis is Article 6(1)(b) GDPR, where the processing is necessary for a contract with the individual or requested pre-contractual steps.
Legal and administrative obligations
We process information where necessary for:
accounting;
taxation;
statutory documentation;
compliance with legal obligations.
The principal legal basis is Article 6(1)(c) GDPR.
Professional relationship management and industry research
ECU has legitimate interests in:
understanding the professional markets in which we operate;
identifying professionals relevant to ECU’s activities;
maintaining accurate professional relationship records;
understanding previous interactions with ECU;
developing events, programmes and professional communities;
identifying suitable contributors, speakers and committee participants;
preventing duplicate or inappropriate research and contact;
protecting ECU’s systems, business and legal interests.
Where appropriate, this processing is based on Article 6(1)(f) GDPR, legitimate interests.
Before relying on legitimate interests, we must consider the purpose, necessity of the processing, professional context, reasonable expectations of the individual and possible effects on that person’s interests and rights.
Consent
We rely on consent where consent is the appropriate or legally required basis.
Examples may include:
specific sharing of identifiable information with a named sponsor or partner for that organisation’s own purposes;
particular optional uses of personal data;
certain uses of photographs or audiovisual material where permission is required;
processing of special-category information, including health information or information revealing religious or philosophical beliefs, where explicit consent is required.
Where processing under the GDPR is based on consent, the legal basis is Article 6(1)(a) GDPR.
You may withdraw GDPR consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Special-category information
Where allergy, dietary, disability, accessibility or similar information reveals health data, religious or philosophical beliefs, or other special-category personal data, ECU normally processes it on the basis of your explicit consent under Article 9(2)(a) GDPR, in addition to the applicable Article 6 basis.
We use this information only for the particular operational purpose for which it was provided.
7. Electronic commercial communications
The fact that ECU may lawfully hold professional information does not automatically mean that ECU may use every communication channel for commercial marketing.
Where Polish or other applicable electronic-communications law requires prior consent to use a particular electronic communication method for commercial information or direct marketing, ECU will obtain the required consent before using that method for that purpose.
The legal basis for maintaining professional relationship information under the GDPR and the legal permission required to use a particular electronic marketing channel are separate matters.
Operational communications that are necessary to administer a registration, requested service, event participation or contractual relationship are treated separately from optional promotional marketing.
8. One professional relationship across related ECU activities
ECU maintains an integrated professional relationship database.
This allows us to recognise that interactions with different ECU activities may form part of one professional relationship with ECU.
For example, previous participation in Retail Summit, Club of 369, an Advisory Committee, a dinner, survey, research project or another ECU activity may form part of the professional relationship history associated with you.
Information from different ECU activities may be combined where the purposes are related and compatible with the purposes for which the information was originally processed, or where another lawful basis supports the further processing.
Participation in one ECU activity does not give ECU unlimited permission to use your personal data for unrelated purposes or through every communication channel.
Where ECU intends to use personal data for a materially different purpose that is not compatible with the original purpose, we will establish an appropriate legal basis and provide additional information where required.
9. Professional research
ECU may identify professionals through publicly available professional sources where there is a reasonable professional connection between the person’s role and an ECU activity.
We seek to collect only professional information relevant to that purpose.
Public availability of professional information does not remove ECU’s obligations under data-protection or electronic-communications law.
10. Communication preferences and objections
You may ask ECU to stop particular communications or uses of your personal data.
If you object to the processing of your personal data for direct-marketing purposes, ECU will stop processing the data for that direct-marketing purpose as required by Article 21 GDPR.
If you clearly tell ECU that you do not want to receive proactive contact from us, we will record and apply that instruction across ECU’s proactive contact activities.
We may retain a minimal suppression record containing enough information to recognise you and respect your instruction. This prevents somebody who has opted out from later being researched, imported into a system and contacted again by mistake.
A later registration, enquiry or other interaction initiated by you may require ECU to process your data and contact you regarding that new activity. Such interaction does not automatically remove a previous objection to unrelated direct marketing.
11. Event registrations and participation
When you register for or participate in an ECU activity, we may use information necessary to:
administer your registration;
confirm your participation or eligibility;
provide event information;
manage access and attendance;
prepare badges or similar credentials;
administer programme participation;
process contracts, payments and invoices;
respond to requests;
operate the event safely and effectively.
12. Is providing personal data mandatory?
This depends on the situation.
Information identified as mandatory on a registration form, contractual document or other process is required where ECU cannot provide the requested activity, service or contract without it.
If required information is not provided, ECU may be unable to register you, provide the requested service, enter into or perform a contract, or fulfil the relevant request.
Other information is optional.
Providing allergy, dietary, accessibility, disability or similar information is voluntary. If you choose not to provide such information, ECU may not be able to make arrangements that depend on knowing about that requirement.
Information ECU obtains through public professional research is not information you are required to provide directly to us.
13. Dietary, allergy, accessibility and similar information
Information concerning allergies, dietary requirements, disability, accessibility requirements or similar matters is handled separately from ECU’s permanent professional relationship data.
Where such information constitutes special-category personal data within Article 9 GDPR, we apply the additional safeguards required for such data.
We use it only to make relevant arrangements for the particular event or activity.
Access is restricted to people who need the information for that purpose.
Where necessary, limited information may be provided to a venue, caterer or other operational provider responsible for fulfilling the requirement.
The information is deleted or anonymised after the relevant operational need ends, unless there is a lawful reason requiring longer retention.
14. Photography and video at ECU activities
Photography and video may take place at Retail Summit, dinners, meetings and other ECU activities.
This Privacy Policy explains ECU’s processing of personal data connected with photographs and recordings. It does not itself constitute permission to publish an individual’s image where separate permission is required under applicable image-rights law.
Crowd, group and event-atmosphere material
Participants may appear as part of:
audiences;
networking scenes;
exhibition or stand areas;
group scenes;
event-atmosphere photographs;
background scenes;
general event video.
Where an individual is merely a detail of a larger whole, such as a gathering or event, Polish image-rights law may permit dissemination without individual permission.
For the associated processing of personal data, ECU may rely on legitimate interests where the legal requirements for that basis are met.
Such material may be used to document ECU activities and communicate or promote ECU and its current or future activities through websites, social media, presentations and promotional material.
Featured or individual images
Attendance at an ECU event does not by itself give ECU unlimited permission to publish a close-up or featured image of an individual.
Where a person’s image is the main or clearly featured subject and Polish image-rights law or other applicable law requires permission for dissemination, ECU will obtain the necessary permission unless another legal exception applies.
Speakers, panelists and other public roles
Where a person accepts a public role such as speaker, moderator, panelist or Advisory Committee member, ECU may publicly present professional information relevant to that role, such as:
name;
job title;
company;
professional biography;
programme role;
photograph where appropriately authorised.
Where permission for publication of an individual’s photograph is required, that permission should form part of the relevant role, submission or approval process.
If you have a particular concern about the use of an identifiable photograph or recording, contact info@conferences-united.eu.
No biometric identification
ECU does not use photographs or event video for facial recognition, biometric identification, AI identity matching or comparable biometric purposes.
15. Sharing information with sponsors and partners
ECU does not provide sponsors, solution providers or other commercial organisations with unrestricted access to a general participant database.
ECU does not operate a general participant directory for commercial third-party access.
Where an ECU activity gives you the option of allowing your identifiable information to be provided to a named sponsor or partner for that organisation’s own purposes, this will be presented separately.
Where consent is required, information will be shared only after a specific, informed choice concerning that sharing.
Once an independent sponsor or partner lawfully receives information for its own purposes, that organisation is responsible for its own subsequent processing as an independent controller.
16. Other recipients and service providers
ECU uses external organisations to operate its activities.
Depending on the circumstances, recipients may include providers of:
CRM and professional relationship management systems;
cloud productivity, storage and collaboration services;
email delivery and communications services;
AI-assisted tools and other artificial-intelligence services used to support ECU’s work;
IT, security and technical support;
website hosting and website-building services;
registration and survey services;
event-management and operational services;
venues and catering;
accounting, legal and other professional services;
banking and payment services.
Some of these organisations process personal data on ECU’s instructions as processors.
Others, such as banks, professional advisers, authorities or certain business partners, may process information as independent controllers where applicable.
ECU may also disclose information where required by law or where necessary for the establishment, exercise or defence of legal claims.
We do not sell personal data.
Information about specific recipients relevant to your data can be provided in connection with a valid data-access request as required by applicable law.
17. International transfers
Some service providers may process personal data or make it accessible from countries outside the European Economic Area.
Where personal data is transferred internationally and the GDPR requires a Chapter V transfer mechanism, ECU uses an appropriate mechanism, which may include:
a European Commission adequacy decision;
approved Standard Contractual Clauses;
another lawful transfer mechanism.
Where required, additional safeguards are considered in light of the circumstances of the transfer.
You may contact info@conferences-united.eu for further information about safeguards applicable to relevant transfers and, where applicable, how to obtain a copy of them.
18. Websites, cookies and tracking
At the effective date of this Privacy Policy, ECU does not intentionally use non-essential analytics, advertising, retargeting or behavioural-tracking technologies on its websites.
ECU also does not currently use marketing analytics to track email opens or link clicks.
ECU websites and the service providers required to operate them may use technical storage or similar technologies necessary to:
deliver a requested website or service;
maintain security;
operate forms;
maintain essential functionality;
transmit communications.
Where such technologies fall within an applicable statutory exception for technologies necessary to provide a requested service or transmit a communication, separate tracking consent is not required.
If ECU introduces non-essential analytics, advertising, behavioural tracking or similar technologies in the future, we will update the relevant privacy information and introduce a prior consent mechanism where required before activating those technologies.
19. How long we retain information
We apply different retention periods according to the purpose and type of information.
Active professional relationship records
A professional relationship record normally remains active while there is a meaningful ongoing relationship with ECU.
Where there has been no meaningful interaction for three years, the record should normally leave active professional relationship management unless there is another lawful reason to retain it in active form.
Meaningful interaction may include, depending on the circumstances, registration, attendance, participation, correspondence, a contribution, a request, a commercial interaction or another substantive professional engagement.
Reduced recognition archive
After leaving active relationship management, ECU may retain a substantially reduced recognition record for up to a further three years.
The purpose is to:
recognise a previous ECU relationship;
avoid unnecessary duplicate research;
avoid treating an established former contact as a completely unknown person;
make an informed decision about whether renewed professional engagement is appropriate.
The reduced record should contain materially less information than an active professional profile.
At the end of this period, the remaining information is deleted or anonymised unless:
a new professional relationship has arisen;
law requires continued retention;
information is required for legal claims;
another documented lawful reason supports continued retention.
Suppression records
Minimal information required to remember and enforce an objection or do-not-contact instruction may be retained for as long as reasonably necessary to ensure the instruction continues to be respected.
Contractual, accounting and legal records
Contracts, invoices, accounting records and related information are retained for the statutory periods applicable to the relevant records and, where necessary, applicable limitation periods.
Event-specific special-category information
Special-category information provided for a particular event is deleted or anonymised once the relevant operational requirement has ended unless a lawful reason requires longer retention.
Photographs and audiovisual archives
Selected event photographs and audiovisual material may be retained for longer where they form part of ECU’s legitimate documentary, historical or communications archive.
Retention is subject to continued relevance, the purpose of the material, applicable image-rights rules and the rights and interests of identifiable individuals.
20. Security and access
ECU applies organisational and technical measures intended to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Access to personal data is role-based and limited according to professional responsibilities.
Where a person working for ECU leaves or moves to a role that no longer requires particular access, access should be removed or adjusted promptly.
Service providers processing information for ECU are subject to appropriate data-protection requirements according to their role and the applicable law.
21. AI and automated decision-making
ECU may use software and AI-assisted tools to support human work, research, administration and productivity.
ECU does not currently use solely automated decision-making to make decisions about individuals that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.
In particular, ECU does not use an automated system to make a final decision, without meaningful human involvement, about whether an identifiable individual may join Club of 369, become a speaker, obtain a professional ECU role or receive or lose another similarly significant opportunity.
ECU does not use photographs for biometric AI identification.
22. Your data-protection rights
Subject to the circumstances and conditions established by the GDPR, you may have the right to:
obtain confirmation whether ECU processes your personal data;
access your personal data and receive a copy;
correct inaccurate or incomplete personal data;
request deletion of personal data;
request restriction of processing;
object to processing based on legitimate interests;
object at any time to processing for direct-marketing purposes;
receive certain data in a portable format where the requirements for data portability apply;
withdraw consent where processing is based on consent;
lodge a complaint with a competent supervisory authority.
Some rights depend on the legal basis and circumstances of the processing and therefore do not apply automatically in every situation.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
23. Exercising your rights
To exercise a privacy right or ask a question about ECU’s use of personal data, contact:
info@conferences-united.eu
Please give us enough information to identify the relevant relationship and understand your request.
Where reasonably necessary, ECU may request additional information to verify identity before disclosing or changing personal data.
ECU will respond in accordance with the requirements and time limits of applicable data-protection law.
24. Complaints
You have the right to complain to a competent data-protection supervisory authority.
For ECU in Poland, the supervisory authority is:
President of the Personal Data Protection Office Urząd Ochrony Danych Osobowych ul. Stanisława Moniuszki 1A 00-014 Warsaw Poland
You do not have to contact ECU before exercising your right to complain to a supervisory authority.
25. Changes to this Privacy Policy
ECU’s activities, systems and legal requirements may change.
We will update this Privacy Policy when necessary.
If a change materially affects how personal data is processed, ECU will provide additional information or obtain new consent where required.
The effective date at the beginning of this Policy identifies the current version.
26. Contact
For privacy requests, questions, objections or concerns:
European Conferences United Sp. z o.o.
ul. Ludwinowska 7/16
30-331 Kraków
Poland
Email: info@conferences-united.eu