Skip to main content
EGMEDC

PRIVACY POLICY

How we handle personal data when you use the EGMEDC website.

Effective Date: August 25, 2026

Last Revised: August 25, 2026


1. Overview and Data Protection Principles

The European Genomic Medicine Consortium (EGMEDC) is committed to protecting your personal data and privacy. As a pan-European non-profit association, we process personal data in strict compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable national data protection laws.

This Privacy Policy informs you about how we collect, process, and protect your personal data when you visit our official website (www.egmedc.eu), participate in our platform, interact with our Secretariat, Executive Board, Advisory Board, or subscribe to consortium communications.


2. Data Controller Contact Details

The Data Controller within the meaning of Article 4(7) GDPR is:

The European Genomic Medicine Consortium (EGMEDC)
Kalvebod Brygge 39, 5.
1560 Copenhagen V
Denmark

Email: secretariat@egmedc.eu

Website: www.egmedc.eu


3. Categories of Personal Data We Process and Purpose

A. Website Access and Technical Server Logs

When you visit our website, your browser automatically transmits technical metadata to our web hosting servers. This data includes:

  • IP address
  • Date and time of access for 7 days, unredacted
  • Time zone difference to GMT
  • Web page visited / file requested
  • HTTP status code
  • Volume of data transferred
  • Browser type, version, and operating system
  • Purpose: Ensuring system security, stability, server optimization, and network safety.
  • Legal Basis: Article 6(1)(f) GDPR (Legitimate Interest in maintaining secure and operational IT infrastructure).

B. Contact Requests and Secretariat Communication

When you contact the EGMEDC Secretariat, Executive Board, or Working Groups via email, contact forms, or stakeholder intake forms, we process:

  • Name, Title, and Professional Designation
  • Stakeholder Category (Patient/Patient Org, Clinician, Academic/Researcher, Industry, Policymaker, Regulatory Body)
  • Work Email Address and Organizational Affiliation
  • Message content and inquiry details
  • Purpose: Responding to inquiries, processing stakeholder involvement, managing consortium operations, and facilitating cross-sector alignment.
  • Legal Basis: Article 6(1)(b) GDPR (Performance of a contract/pre-contractual basis for formal stakeholder-involvement processes) and Article 6(1)(f) GDPR (Legitimate Interest for general inquiry handling).

C. Consortium Membership and Governance Registrations

For individuals and legal entity representatives applying for or holding membership within EGMEDC, we collect organizational details, contact information, board or advisory committee appointments, and governance documentation.

  • Purpose: Fulfilling membership administration, transparent governance, board operations, and general assembly administration.
  • Legal Basis: Article 6(1)(c) GDPR (Legal Obligation): Processing of personal data required by EGMEDC's Bylaws, governance framework, and applicable Danish law governing non-profit associations (e.g., membership registration, statutory board and committee administration, mandatory record-keeping). Article 6(1)(f) GDPR (Legitimate Interest): Processing of additional personal data necessary for EGMEDC's operational functioning, cross-sector coordination, stakeholder management, and internal governance activities beyond statutory minimums (e.g., organizational affiliation details for consortium alignment, contact preferences for governance communications). Balancing Assessment: EGMEDC's legitimate interests in maintaining a functional association, transparent governance, and effective stakeholder coordination outweigh any privacy intrusions, as members voluntarily join knowing these data are essential to membership administration.

D. Newsletters and Stakeholder Communications

If you consent to receive updates, policy briefs, and event invitations from EGMEDC:

  • Data collected: Name, email address, stakeholder group, language preference.
  • Legal Basis: Article 6(1)(a) GDPR (Explicit Consent via double opt-in). You may revoke your consent at any time by clicking the "Unsubscribe" link in any email or contacting secretariat@egmedc.eu.

E. Provision of Data (Statutory or Contractual Requirement)

Disclosure under Art. 13(2)(e) GDPR: Providing certain personal data (for example, in connection with membership applications or governance appointments) may be a contractual or statutory requirement. Where this is the case, failure to provide the requested data may mean EGMEDC is unable to process the relevant application, membership, or appointment.

F. Automated Decision-Making and Profiling

Disclosure under Art. 13(2)(f) GDPR: EGMEDC does not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.


4. Cookies and Analytical Tools

We prioritize visitor privacy. EGMEDC uses no cookies or similar technologies for advertising, profiling, or cross-site tracking. 

  • Essential Cookies: Necessary for the technical operation of the platform. (Legal basis: Art. 6(1)(f) GDPR).
  • Website Analytics: We use Umami, an open-source analytics application self-hoasted on our behalf within the European Economic Area. Umami sets no cookies, does not store IP addresses, and performs no cross-site tracking, fingerprinting, or profiling. It records the page requested, referring URL, date and time, approximate country-level location, device category, browser and operating system, screen resolution, and language setting. To distinguish returning visits without cookies, Umami derives a pseudonymous identifier from a non-reversible hash combined with a secret value that rotates hourly and monthly; earlier identifiers cannot subsequently be reproduced or matched. Your visit is counted on an analytics instance operated for us in Europe, and the data is not passed to advertising networks or data brokers.
  • Purpose: Understanding aggregate use of our website in order to improve its content, structure, and accessibility.
  • Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest). We deliberately chose an analytics tool that stores nothing on your device and keeps no personal identifiers, which is why you are not asked to accept cookies when you arrive. Should you nevertheless prefer that we do not count your visit, you can object at any time under Art. 21 GDPR by writing to secretariat@egmedc.eu, and we will exclude you.
  • Technical Processor: Dr. Leopold Dürrauer (duerrauer.com), under a data processing agreement (DPA) pursuant to Art. 28 GDPR, on infrastructure provided by Hetzner Online GmbH, Germany. All analytics data remains within the European Economic Area (EEA).
  • Retention: Individual analytics records are deleted after 25 months. Non-identifying statistical aggregates are retained for long-term trend analysis.


5. Recipients and International Data Transfers

We do not sell, rent, or trade personal data. Data is shared strictly on a need-to-know basis under appropriate security conditions:

  • Internal Consortium Bodies: Secretariat personnel, Executive Board, and committee administrators bound by confidentiality.
  • Technical Processors: Hosting providers, IT system maintainers, and email service providers acting as Data Processors bound by GDPR Art. 28 Data Processing Agreements (DPAs). This includes Dr. Leopold Dürrauer (duerrauer.com) for the operation of our self-hosted website analytics, and Hetzner Online GmbH (Germany) as the underlying infrastructure provider. 
  • International Transfers: Personal data is primarily processed within the European Economic Area (EEA). If data must be transferred outside the EEA, EGMEDC ensures appropriate safeguards pursuant to Art. 44 et seq. GDPR, such as standard contractual clauses (SCCs) approved by the European Commission.


6. Retention Period

Personal data is retained only as long as necessary to fulfill the operational, statutory, or organizational purposes outlined above:

  • Server Logs: Retained for 7 days, then automatically deleted.
  • General Inquiries: Retained for as long as required to resolve the inquiry, and deleted within 12 months after closure, unless statutory retention laws apply.
  • Membership / Governance Data: Retained for the duration of consortium affiliation plus applicable statutory archiving periods (e.g., corporate/tax obligations).
  • Website Analytics: Individual analytics records retained for 25 months, then deleted. Non-identifying statistical aggregates retained indefinitely.


7. Your Data Subject Rights under the GDPR

Under Chapter III of the GDPR, you have the following enforceable rights regarding your personal data:

  • Right of Access (Art. 15 GDPR): Request confirmation and a copy of the personal data held about you.
  • Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete data.
  • Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of data where legal grounds apply.
  • Right to Restriction of Processing (Art. 18 GDPR): Request temporary suspension of data processing under certain conditions.
  • Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): Object at any time to processing based on legitimate interests (Art. 6(1)(f) GDPR).
  • Where processing is for direct marketing purposes (e.g., newsletters), the right to object is ABSOLUTE under Art. 21(2)-(3) GDPR — EGMEDC will stop such processing on request, with no balancing test or exceptions, distinct from the qualified objection right for legitimate-interest processing generally.
  • Right to Withdraw Consent: Revoke any consent previously given at any time with future effect.

To exercise any of these rights, please contact us at: secretariat@egmedc.eu.


8. Right to Lodge a Complaint

If you consider that the processing of your personal data infringes the GDPR, you have the statutory right under Article 77 GDPR to lodge a complaint with a competent Data Protection Supervisory Authority in an EU Member State (such as the state of your habitual residence, place of work, or place of the alleged infringement).


9. Updates to this Privacy Policy

EGMEDC reserves the right to update this Privacy Policy to reflect changing legal requirements, technical updates, or changes to consortium governance. The latest version will always be accessible on this page.