This policy explains how TIMBFRAS CONFERENCES & EVENTS S.R.L. (“TIMBFRAS”, “we”), the organiser of the TIMBFRAS congress and its Cadaver Course, processes personal data collected through timbfras.org and during the event, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
1. Who is responsible for your data
TIMBFRAS CONFERENCES & EVENTS S.R.L., with the details shown at the top of this page, is the data controller. For any question about your data or to exercise your rights, write to timbfras@gmail.com.
2. What data we collect
Ticket buyers and attendees
- Title, first and last name, email address, phone number, medical specialty, country.
- CUIM (Romanian physician registration code), only if you provide it, for EMC credits.
- For the Cadaver Course: glove size, scrub size and dominant hand, so we can prepare your workstation.
- Billing data: name or company name, tax/VAT number, trade register number, address and invoice email.
- Order data: tickets purchased, amounts, exchange rate, payment status and invoice number. We never see or store your card details — payments are processed by Stripe.
Bright Talent applicants
- Name, title, email, institution, ticket order number, presentation title, the abstract (PDF) and your photo.
Website visitors
- If you accept audience statistics in the cookie banner: the page visited, the referring website, the device type and the country derived from the IP address. The IP address itself is not stored; it is combined with the browser type into a one-way code that changes every day, so visitors cannot be identified or followed from one day to the next.
- Technical server logs kept by our hosting provider for security purposes.
Contact
- The data you include when you write to us by email or phone.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Registering you, issuing tickets and badges, organising the congress and the Cadaver Course, sending confirmations and practical information | Performance of the contract — Art. 6(1)(b) GDPR |
| Issuing invoices, sending them to the national e-Factura system (SPV) and keeping accounting records | Legal obligation — Art. 6(1)(c) GDPR, Romanian Fiscal Code and Accounting Law no. 82/1991 |
| Reporting attendance for EMC credits (if you provided your CUIM) | Performance of the contract, at your request — Art. 6(1)(b) GDPR |
| Evaluating Bright Talent abstracts, announcing selected presenters and publishing the programme | Your consent given when submitting — Art. 6(1)(a) GDPR |
| Checking attendees at the entrance, preventing fraud, securing the website | Legitimate interest — Art. 6(1)(f) GDPR |
| Audience statistics on the website | Your consent through the cookie banner — Art. 6(1)(a) GDPR |
| News about future TIMBFRAS editions | Your consent (optional checkbox at registration) — Art. 6(1)(a) GDPR |
| Defending legal claims and handling complaints | Legitimate interest — Art. 6(1)(f) GDPR |
We do not use your data for automated decision-making or profiling, and we do not sell it.
4. Photos and video at the event
The congress is photographed and filmed for documentation and for promoting future editions. Pictures of the audience and of speakers on stage may be published on timbfras.org and on our social media pages, based on our legitimate interest in presenting the event. If you prefer not to appear in close-up pictures, tell the photographers or the registration desk, and you can always ask us to remove a published picture in which you can be identified.
5. Who receives your data
We share data only with service providers that process it on our behalf, under data processing agreements, and only to the extent needed:
- Stripe Payments Europe, Ltd. (Ireland) — card payments and refunds.
- Oblio Software S.R.L. (Romania) — invoicing software; invoices are transmitted to the Romanian tax authority (ANAF) through e-Factura, as required by law.
- Brevo (Sendinblue SAS) (France) — sending transactional emails: confirmations, tickets, invoices, abstract decisions.
- Supabase, Inc. — database and file storage for registrations and abstracts.
- Vercel, Inc. — hosting of the website.
- Our accountant, the venue (Iulius Congress Hall) and event staff, only for the data needed for their tasks.
- The College of Physicians of Romania, only the data required for EMC credits, for attendees who provided their CUIM.
- Public authorities, when required by law.
Speakers’ names, photos and biographies, and the names of selected Bright Talent presenters, are published in the programme.
6. Transfers outside the European Economic Area
Some providers (Supabase, Vercel, and Stripe’s group companies) may process data in the United States. Such transfers are protected by the EU–U.S. Data Privacy Framework, where the provider is certified, or by the European Commission’s Standard Contractual Clauses.
7. How long we keep it
- Invoices and accounting documents: for the periods required by Accounting Law no. 82/1991 (currently 5 to 10 years).
- Registration and attendee data: until the end of the year following the edition you attended, then deleted or anonymised, except what we must keep for accounting.
- Bright Talent abstracts and photos: rejected submissions are deleted within 12 months of the decision; accepted presentations remain part of the programme archive.
- Marketing preferences: until you unsubscribe or withdraw your consent.
- Audience statistics: kept for up to 26 months.
- Emails: as long as needed to answer you, and no longer than 3 years.
8. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw your consent at any time (without affecting processing done before). To exercise them, write to timbfras@gmail.com; we answer within one month.
You may also lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest, www.dataprotection.ro.
9. Security
Data is transmitted over encrypted connections (HTTPS), access to the registration database is limited to authorised organisers with individual accounts, and card data is handled exclusively by Stripe, which is PCI-DSS certified.
10. Cookies
See our Cookie policy.
11. Changes
We may update this policy; the current version is always published on this page with its date.