Personal Data Processing Policy
BOS. org s. r. o. | website and registration system
| Item | Details |
|---|---|
| Personal data controller | BOS. org s. r. o., Company ID No. 64049876, VAT ID No. CZ64049876, with its registered office at Kekulova 615/38, 400 01 Ústí nad Labem |
| Contact for personal data protection | ochrana@bos-congress.cz |
| Website | www.bos-congress.cz |
| Document version | 2026-06 |
| Effective date | 16 June 2026 |
1. Purpose of this document
This document explains how BOS. org s. r. o., as the personal data controller, processes the personal data of persons who use the website and registration system, create a user account, register for professional events, submit an application for active participation, communicate with BOS. org or subscribe to information about professional events.
This document serves to fulfil the information obligation under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). The processing of personal data also takes place in accordance with Act No. 110/2019 Coll., on the Processing of Personal Data, Act No. 480/2004 Coll., on Certain Information Society Services, Act No. 127/2005 Coll., on Electronic Communications, accounting and tax regulations and other related legal regulations.
Creating a user account, registering for an event or submitting an application for active participation does not constitute consent to the processing of personal data. In these cases, we process data primarily so that we can provide the requested service, organise the event, communicate with participants, issue documents, comply with legal obligations and protect legal claims. We use consent only where the processing is genuinely voluntary, for example for newsletters, optional cookies or voluntarily provided more sensitive data.
2. Who these principles apply to
- visitors to the BOS. org website;
- persons who use the “Create user account” form;
- participants who use the “Event registration” form;
- authors, speakers and co-authors who use the “Application for active participation” form;
- payers, customers, employers or participants’ contact persons;
- representatives of professional societies, partners, exhibitors, suppliers, hotels and other cooperating entities;
- persons captured in ordinary photo documentation or video recordings from a professional event;
- persons who send BOS. org an enquiry, request, complaint or other communication;
- persons who have consented to receiving information about professional events and related services.
3. What personal data we process
| Data category | Examples of data |
|---|---|
| Identification and professional data | title, first name, surname, workplace, position or role, specialisation, medical or professional field, professional organisation, identification of the payer or customer. |
| Contact details | e-mail, telephone number, contact address, delivery address, workplace address. |
| Billing and payment data | billing address, Company ID No., VAT ID No., order number, invoice number, variable symbol, amount, payment information, bank details and data required for accounting and tax purposes. |
| User account data | login e-mail, username, account creation date, login history to the necessary extent, account settings and confirmation of having read the principles. |
| Event registration data | event name, type of participation, selected courses or workshops, accompanying programme, accommodation or catering, payments, issued documents, QR code or ticket, confirmation of participation and certificate. |
| Active participation data | presentation title, abstract, authors and co-authors, workplace, contact person, presentation, curriculum vitae, speaker’s photograph, technical requirements and data required for remuneration or travel expenses, if provided. |
| Communication | e-mails, form messages, notes from phone calls, requests, complaints, registration change requests and organisational instructions. |
| Photographs and video | ordinary documentation of the event, images of halls, panels, speakers, exhibitors and social parts of the event. |
| Technical data | IP address, date and time of an action in the system, browser user agent, device type, system logs and data on the granting or withdrawal of consent. |
| Voluntarily provided more sensitive data | in particular information about allergies, dietary restrictions, health limitations or assistance requirements, if the person provides them themselves in order to ensure catering, safety or accessibility of the event. |
We do not process copies of identity documents unless a specific legal or contractual reason arises in a particular situation. We require the date of birth only if it is genuinely necessary for the given service, confirmation or document.
4. Purposes and legal bases of processing
| Purpose | Legal basis | Note |
|---|---|---|
| Creating a user account | performance of a contract or steps prior to entering into a contract; legitimate interest in account administration and system security | When creating an account, the user confirms that they have read the principles. This is not consent to the processing of personal data. |
| Event registration | performance of a contract or steps prior to entering into a contract; compliance with legal obligations; legitimate interest | The data is necessary for registration, organisational communication, issuing documents, checking payments, admission to the event and issuing confirmation or a certificate. |
| Application for active participation | performance of a contract or steps prior to entering into a contract; legitimate interest; possibly consent for voluntary additional data | The data may be used to compile and publish the professional programme, proceedings, event website and for communication with authors and speakers. |
| Billing, accounting and taxes | compliance with a legal obligation | The processing arises mainly from accounting and tax regulations. |
| Communication with participants and customers | performance of a contract; legitimate interest | Organisational instructions, confirmations, programme changes, technical information, answers to enquiries and complaints. |
| Attendance records and certificates | performance of a contract; legitimate interest; possibly fulfilment of the requirements of a professional society or professional education | The data serves to document attendance at a professional event and to issue confirmation. |
| Protection of legal claims and dispute resolution | legitimate interest | Retention of necessary documentation in case of complaints, inspections, disputes or debt recovery. |
| Security of the website and registration system | legitimate interest; compliance with a legal obligation, where applicable | System logs and security records serve to protect accounts, data and services. |
| Ordinary documentation of events through photographs and video | legitimate interest | Recordings serve to document the professional event, for archiving and for reasonable promotion of BOS. org’s activities. Consent may be requested for significant individual promotional outputs. |
| Newsletter to persons who are not customers | consent | Consent is voluntary, not pre-ticked and may be withdrawn at any time. |
| Commercial communications to existing customers about similar events and services | legitimate interest in connection with Section 7(3) of Act No. 480/2004 Coll. | This is used only for BOS. org’s own similar events and services, provided that the customer had the opportunity to refuse such communications and may refuse them in every subsequent communication. |
| Optional cookies, analytics and marketing tools | consent | Necessary technical cookies do not require consent. Analytical and marketing cookies are used according to the settings in the cookie banner. |
5. Creating a user account
The “Create user account” form is used to set up access to the BOS. org registration system. We use the data entered when creating an account to identify the user, administer the account, enable repeated login, ensure account security and simplify further registrations.
When creating an account, the user confirms that they have read the Personal Data Processing Principles. This confirmation is not consent to the processing of personal data and must not be confused with marketing consent.
6. Event registration
The “Event registration” form is used to register for a specific professional event, conference, congress, symposium, seminar, course, workshop or accompanying programme. We use personal data to carry out the registration, check payment, issue accounting documents, conduct organisational communication, issue a ticket or QR code, ensure attendance on site and, where applicable, issue confirmation of attendance.
If the payer or customer is an employer, hospital, workplace or another legal entity, we also process the necessary data of that entity and its contact persons.
7. Application for active participation
The “Application for active participation” form is used to submit a lecture, poster, course, workshop or another professional part of the programme. We may use the data provided in the application to communicate with authors, assess and include the contribution, compile the programme, publish the programme on the website and in printed or electronic event materials, create proceedings, administer remuneration or reimbursements and archive the professional programme.
Providing the name, titles, workplace, title of the contribution, abstract and co-authors is usually necessary for active participation in the professional programme. If an author provides a photograph, curriculum vitae or other supplementary materials, we process them to the extent necessary for the programme and event communication or on the basis of separate consent where additional promotional use is involved.
8. Newsletter and commercial communications
We send information about professional events, conferences, seminars, courses and related services in two ways:
- to persons who are not our customers, only on the basis of voluntary consent;
- to existing customers, we may also send information about our own similar events and services on the basis of legitimate interest and the customer opt-out regime under Section 7(3) of Act No. 480/2004 Coll., provided that they had the opportunity to refuse such communications and have this option in every subsequent communication. For existing customers, we use this regime only if we obtained the electronic contact details in connection with the provision of a service, if the communication concerns BOS. org’s own similar events or services, and if the customer had the opportunity to refuse such communications when the contact details were obtained and in every subsequent commercial communication.
Every commercial communication clearly identifies the sender and includes a simple unsubscribe option. Withdrawal of marketing consent or refusal of commercial communications does not affect the processing of data necessary for registration, accounting, legal obligations, handling participation in an event or protecting legal claims.
9. Photographs and video from events
At events organised or administratively arranged by BOS. org, reasonable photo documentation and video recordings may be made for the purpose of documenting the event, archiving, informing the professional public and reasonably promoting the activities of BOS. org and the event concerned.
Ordinary images of the hall, lectures, panels, exhibition areas, speakers and participants are generally processed on the basis of legitimate interest. If an individual promotional portrait, interview, paid advertising campaign or other significant use of a specific person is involved, we will request separate consent or another appropriate legal basis, depending on the circumstances.
A person who does not wish to appear in a specific published image may contact us at ochrana@bos-congress.cz. We will assess the objection according to the specific situation and the legitimate grounds for processing. Participants may also be informed about the taking of standard photographs or video recordings during registration, in event instructions or by a visible notice at the event venue. If a person does not wish to be captured in an individual shot, they may contact the event organiser.
10. Individual requests, diets, allergies and health limitations
The registration system may allow participants to voluntarily provide information about dietary restrictions, allergies, health limitations or accessibility or assistance requirements. We request such information only where it is necessary to provide catering, safety or accessibility at the event.
A general dietary preference does not necessarily constitute a special category of personal data. However, if the information provided reveals a health condition, such as an allergy, illness or health limitation, it constitutes a special category of personal data.
Such data are processed only on the basis of the explicit voluntary consent of the person who provided them and only to the extent necessary to provide catering, safety or accessibility at the event. The data are disclosed only to recipients who strictly need them to provide the service, such as catering providers or hotels, and, where possible, without unnecessary identification of the person.
11. To whom we may disclose personal data
We disclose personal data only to the necessary extent. Recipients may include in particular:
- operators of the registration system, web hosting, e-mail services, payment gateways and IT support;
- hotels, congress centres, venue lessors, catering providers, technical agencies, production and registration staff;
- professional societies, scientific committees, guarantors and co-organisers of the event, where necessary for the programme and organisation of the event;
- accountants, tax advisers, auditors, legal advisers and insurance companies;
- carriers, printers, graphic designers, suppliers of certificates, badges, tickets and other organisational services;
- public authorities, where required by legal regulation or an authorised inspection.
We do not disclose personal data to partners, exhibitors or other third parties for their own marketing unless there is a separate legal reason or the explicit consent of the data subject.
12. Transfers of data outside the EU/EEA
We primarily process personal data in the Czech Republic and within the European Union or the European Economic Area. If a technical supplier were to process data outside the EU/EEA, we will ensure appropriate legal safeguards under the GDPR, in particular an adequacy decision, standard contractual clauses or another lawful mechanism.
13. How long we retain data
| Type of data | Usual retention period |
|---|---|
| User account data | for the duration of the account; after account cancellation only to the extent necessary to document registrations, payments, documents, legal claims or legal obligations. |
| Event registration data | for the duration of the event organisation and subsequently usually for 5 years from the end of the event or the last contractual relationship, unless longer retention is necessary due to legal obligations, inspection or legal claims. |
| Accounting and tax documents | for the period stipulated by law, usually 10 years. |
| Active participation and professional programme data | for the duration of the preparation and holding of the event; the programme, proceedings and professional archive may be retained longer as documentation of the professional event. |
| Marketing consent | until consent is withdrawn; we retain a record of the granting or withdrawal of consent for the period necessary to prove the legal basis. We may retain the e-mail address of a person who has withdrawn consent or refused communications to the necessary extent in a suppression list / unsubscribe list in order to ensure that commercial communications are not sent to them again. |
| Commercial communications to customers under the opt-out regime | until the sending is refused; we retain a record of the refusal for the period necessary to ensure that we do not contact the customer again contrary to their wishes. |
| Voluntarily provided more sensitive data | only for the period necessary to ensure the specific service, typically for the duration of the preparation and holding of the event; afterwards the data is erased or anonymised, unless retention is necessary due to an incident or legal claim. |
| Security and system logs | for the period necessary to ensure security, investigate incidents and prove performed actions, usually in the order of months; audit records of consents and confirmations are retained longer if necessary to prove the legal basis. |
| Photographs and video | for a period appropriate to the purpose of documenting and promoting the event; the ordinary event archive may be retained longer, provided that the rights and interests of a specific person do not prevail. |
14. Confirmation of having read the principles and records of consent
For the “Create user account”, “Event registration” and “Application for active participation” forms, we record confirmation that the person has read the Personal Data Processing Principles. This confirmation is not marketing consent.
For actual consents, especially newsletters and voluntarily provided more sensitive data, we record the date and time of granting consent, the source or form, the version of the consent text, IP address, user agent, scope of consent and any withdrawal date. The history is not overwritten; it is retained for the period necessary to prove the legal basis, comply with legal obligations and protect legal claims.
15. Cookies and similar technologies
The website may use technical cookies necessary for the operation of the website and registration system. These cookies do not require consent. If the website uses analytical, preference or marketing cookies, they are used only according to the user’s settings in the cookie banner and according to separate Cookie Information.
Optional cookies, in particular analytical and marketing cookies, are not activated before consent is given. The user must be able to refuse consent as easily as to give it and must be able to change their settings later.
16. Rights of data subjects
In connection with the processing of personal data, you have in particular the following rights:
- the right of access to personal data;
- the right to rectification of inaccurate or incomplete data;
- the right to erasure, if the conditions under the GDPR are met;
- the right to restriction of processing;
- the right to data portability, if the processing is based on consent or contract and is carried out by automated means;
- the right to object to processing based on legitimate interest, including an objection to direct marketing;
- the right to withdraw consent at any time, if the processing is based on consent; withdrawal does not affect the lawfulness of processing before withdrawal;
- the right to lodge a complaint with the Office for Personal Data Protection.
We do not carry out automated individual decision-making within the meaning of Article 22 GDPR or profiling that would have legal or similarly significant effects on the data subject.
Requests and questions regarding personal data protection may be sent to ochrana@bos-congress.cz or in writing to the company’s registered office at Kekulova 615/38, 400 01 Ústí nad Labem.
17. Updates to the principles
We may update these principles in particular in the event of changes to the registration system, website, services provided, legal regulations or methods of personal data processing. The current version is always published on the BOS. org s.r.o. website.