CX Privacy Policy
Information in accordance with article 13 GDPR
General BIBA Medical data use terms and conditions
In order to deliver a wide range of services related to our CX Symposium participants, we process certain categories of your personal data which we receive from you. For the purpose of transparency and in accordance with Article 13 of the General Data Protection Regulation (GDPR), we therefore want to inform you about the data processing as follows:
1. General information
The controller of the data processing is BIBA Medical, 526 Fulham Road, London SW6 5NR, United Kingdom. BIBA Medical has a series of affiliated websites pertaining to different areas of the medical sphere and our websites are hosted within the UK. Our CX Symposium registration and participation platform (portal.cxsymposium.com) is hosted on Amazon Web Services (AWS) in the UK.
2. Legal basis for data use
For all BIBA Medical activities we adhere to British and European data protection legislation, in particular the EU GDPR and the Data Protection Act UK. Our data processing is in our and our exhibitors’ legitimate business interests, namely regarding the use of your data for the purposes of promoting the CX Symposium, by the sending of newsletters, congress information as well as related promotional information by email or post. Where you make a payment or we reimburse you, that data is also processed in order to perform our contract with you.
For any request and further information regarding the processing of your personal data please contact us at [email protected]
3. What personal data we process
The following data will be used:
• Title
• Names (First and Last Names)
• Profession
• Contact information (email, telephone number)
• Associated medical institution (name, postal address)
• Job speciality and topic area preferences
• Previous congress participations
• Previous funding for congress attendance
• Copies of any documents you send us to process your registration (e.g. proof of status)
• Content you submit to CX Symposium (e.g. abstracts, posters, presentations and supporting materials)
• Where you are a member of our faculty whom we are reimbursing, your bank/payment details (e.g. account holder name, sort code and account number, or IBAN and SWIFT/BIC) — used solely to pay your expenses
• Your IP address
4. What we use your data for:
• Communication with you
• Sending newsletters and information about our activities
• Administration of your BIBA Medical account
• Internal statistical use for collating delegate numbers and trends and optimisation of our activities
• Usage patterns on the CX Symposium website and platform
• Processing your submissions and, where accepted, publishing them on the CX Symposium platform (for example poster galleries and on-demand presentations)
• Administering and reimbursing faculty expenses
5. How your data is stored and handled
This data is stored on our systems — including our CX Symposium registration and participation platform hosted on Amazon Web Services (AWS) in the UK, with files held in AWS S3 (UK) — for as long as you remain active with BIBA Medical (CX Symposium website profile, participation in CX Symposium, or subscription to our publications) and will be deleted after 7 years of inactivity or upon your justified request in accordance with Art 17 GDPR (see section 6 of this information sheet for further details).
Our database developer is contractually obliged to adhere to all standards of data protection according to EU GDPR. Furthermore, your data will be handled exclusively by BIBA Medical and CX Symposium staff and will not be disclosed to any third parties with the exception of IT companies providing administration software or any authorities, and companies with a legitimate interest in the data for purposes of event management, such as the badging company and our AV partner handling faculty presentations for CX Symposium, or when your data is necessary in order to distribute newspapers to your email or postal address.
Access to administrative areas of our platform is protected by multi-factor authentication. Where we reimburse faculty expenses, the bank/payment details you provide are encrypted, are accessible only to authorised BIBA Medical administrators for the purpose of making payment, and are deleted approximately six months after your claim is paid (or earlier on a valid erasure request). Please note however, that if you have submitted the same data in the context of a different service or contract with BIBA Medical or CX Symposium (e.g. grant application, newspaper subscription, event participation) additional data usage terms and condition may apply.
5a. Information about how we may share your data with our industry partners
With your consent, we will make limited registration information available to our industry partners, limited to your name, speciality, institution, email and country. This is in our and our industry partners’ legitimate business interests: it allows us to attract the most appropriate sponsors for the Symposium and to facilitate business-to-business communication between our industry partners and our registrants.
We will never share your personal contact information with industry partners such as your email address, phone number or postal address unless you have given active consent like in the instances detailed below.
5b. Service providers (processors) we use
To run CX Symposium and our platform we use a small number of carefully selected service providers, each under contract and bound to GDPR-standard protections. These include Opayo/Elavon (secure card payments), SendGrid (service emails), Campaign Monitor (newsletters and marketing emails), Amazon Web Services (hosting and file storage, UK), Swapcard and Visit Cloud (on-site badging, attendance and networking), Vimeo (video hosting), and Google (address lookup on the registration form and, where you have accepted cookies, Google Analytics and Google Ad Manager — delivered via Google Tag Manager — to measure and improve how the platform and website are used). Where a provider is located outside the UK/EEA (for example Google, Vimeo and Campaign Monitor), any transfer of your data is made under appropriate safeguards such as UK/EU standard contractual clauses or an adequacy decision. Analytics and advertising cookies are only used with your consent — see our Cookie Policy.
6. Your rights
Information and Access
You are entitled to obtain information by BIBA Medical as to which personal data are being processed and to get access to that personal data upon your request. We will provide you with one copy of the personal data undergoing processing free of charge, unless the disclosure may adversely affect the rights and freedoms of others.
Withdrawing consent
Should you have consented to a specific use of your data by BIBA Medical, you can withdraw that consent at any time, by changing your account settings or contacting us at [email protected].
Rectification and Erasure
You are entitled to request rectification of inaccurate personal data or completion of incomplete personal data concerning you without undue delay.
You are entitled to request erasure of personal data without undue delay, if
(i) Personal data are no longer necessary in relation to the purposes for which they were collected,
(ii) You object to the processing
(iii) Personal data have been unlawfully processed
(iv) Personal data have to be erased for compliance with a legal obligation applicable to BIBA Medical
However, BIBA Medical is not obliged to execute such erasure if processing is necessary
(i) for exercising the right of freedom of expression and information,
(ii) for compliance with a legal obligation to which BIBA Medical is subject,
(iii) for the establishment, exercise or defence of legal claims.
Restriction of Processing
You are entitled to request the restriction of processing of personal data in the following circumstances and for the following periods of time:
(i) you contest the accuracy of the personal data concerning you; restriction of processing may be affected for a period enabling us to verify the accuracy of the relevant personal data,
(ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
(iii) we do no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims,
(iv) you have objected to processing, for the period until the verification whether our legitimate grounds override those of you.
Data Portability
You are entitled to data portability, namely to receive your personal data which you have provided to BIBA Medical and which is processed
(i) based on the concluded contract
(ii) and by automated means in a structured, commonly used and machine-readable format.
You are entitled to request that the personal data is transmitted directly to another controller by us, where technically feasible. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on our legitimate interests according to Art 6 para 1 point of GDPR. If you object to processing of your personal data, we shall cease to process this data unless our legitimate interests to processing your personal data prevail. If you have agreed to your personal data being processed for marketing purposes, you shall have the right to object at any time to processing of personal data concerning you. In this case, we will cease the processing or your personal data for marketing purposes immediately.
Right to file complaint
You have the right to file a complaint with the Information Commissioner’s Office (ICO), if you believe that your rights to data protection are being infringed.
Last updated July 2026