Privacy Policy

1. Introduction

This document indicates the LuCE policy for the personal data management related to:

Any use of the public websites https://www.lungcancereurope.eu/, Access to Treatment Atlas and https://www.getchecked.eu or internal protected sites of the Members

Any use of paper or electronic forms during the information or membership process or public events

Any transmission of information through electronic or conventional mail or social media

Any internal processing of data with standard or customer relationship management software.

With this Privacy Policy, LuCE aims to protect the privacy and the fundamental rights of persons during the process of their data.

2. Legal Basis

Swiss Federal Act on Data Protection (nFADP) – status 01/09/23

European General Data Protection Regulation (GDPR) – status 27/04/16

3. Owner and Responsible For Data Processing

Lung Cancer Europe (LuCE), Effingerstrasse 40, 3008 Bern, Switzerland

E-Mail: [email protected]

4. Concepts, Categories of Personal Data and Consensus

As personal data, the law considers any indication or information that directly or indirectly permits the identification of a person.

In the set of the sensitive data, LuCE does not manage any kind of information about personal opinion, religion, philosophical and political ideas, sexual orientation, crimes committed / related penalties imposed and measures adopted, except about psychic / mental or physical state for the purpose of its mission (as detailed in Point 5). LuCE recommends to the Users / Members / Collaborators and Partners to not transmit, through the channels at Point 1) any kind of information not necessary for its mission.

When personal data is transmitted through paper or electronic documents, and through the public websites, the User is expressly asked for the consensus to the processing of personal data, with the sole purpose of providing activity information and/or fulfilling a contract for the supply of one or more services.

Having expressed favorable consensus, the User, by providing his/her personal data through paper or electronic documents and through the public websites, accepts that his/her data will be processed in accordance with the law and according to the purposes and lawfulness indicated at the Point 5.

All personal information that the User provides to LuCE must be true, complete and accurate, and the User must notify of any changes to such personal information.

5. Purpose and Lawfulness of Personal Data Processing

LuCE processes personal data strictly necessary for its mission as the voice of Europeans impacted by lung cancer. LuCE collaborates with Members and other stakeholders to destigmatise the disease and ensure that those impacted by lung cancer get the care they need to achieve the best possible outcomes. LuCE empowers members to ensure strong and effective lung cancer patient advocacy across Europe.

LuCE may use your personal information for the following purposes:

i) to provide and improve its services, responding to the inquiries, providing the services requested, and enhancing the functionality of its websites

ii) to communicate, sending important updates / newsletters and marketing communications related to the services. In any time the User will have the right to opt-out of receiving marketing communications

iii) to comply with legal obligations (applicable laws, regulations, or legal processes).

With its public websites, LuCE collect information through:

Cookies (small text files sent to your browser by the website you visit, that help that website to remember information about your visit, which can both make it easier to visit the site again and make the site more useful to you – the cookies can contain information about your position, the web pages visited, the User preferences and other statistic data)

Anonymous statistic processing with customer relationship management software

Online electronic forms for the User requests about information and membership.

All the information are stored and processed on servers in Switzerland or in Spain.

The cookies saved on the User device can be deleted in any time without any preclusion to the next visit on the LuCE websites.

The LuCE websites do not transmit or process any advertising content of commercial nature, and neither cookies nor completed forms are used to profile user behavior for commercial purposes.

Through direct contacts (by personal meetings / by phone / by conventional mail / by electronic mail) LuCE collect information with:

paper and electronic standard forms, asking the usual personal information (name, address, phone, e-mail) and public company information (not protected by the law).

The information can be stored and processed on servers in Switzerland or in Spain.

Under no circumstances does LuCE use personal data for commercial purposes and transmit them to other organizations/companies for commercial purposes.

LuCE does not knowingly collect data from children under 18 years of age. By using its websites, the User represents that he/she is at least 18 or that there is a parent or a guardian of such a minor and consents to such minor dependent’s use of the websites. If LuCE learns that personal information from Users less than 18 years of age has been collected, it will deactivate the account and take reasonable measures to promptly delete such data from our records.

6. Transmission, Storage, Processing, and Deletion of Personal Data

For the management of the personal data collected, LuCE implements and constantly updates with its Partners all internal IT security measures proportionate to the risks against: unauthorized access to its systems and internal databases, the action of malicious programs (viruses, malware, spyware and others) that could alter or transmit data to unauthorized third parties, the loss of data through cancellation or destruction. These actions include measures of a technical, physical and organizational nature.

In the case of data transmitted via the website or e-mail, considering the characteristics of the Internet as an “open” network, LuCE cannot guarantee that the personal data transmitted will not be intercepted and acquired by unauthorized third parties.

LuCE advises every User to ensure the protection of his/her systems through at least minimal security measures, as well as prudential behavior. LuCE collaborates with Partners who provide Web and e-mail services with servers located in Switzerland or in Europe, compliant with the same legal bases as in Point 2) but cannot assume any responsibility for the services offered by the User’s Partners.

In general personal data are retained by LuCE for the time strictly necessary for the purposes and lawfulness indicated at Point 5). If there are no accounting needs that require a storage until 10 years, each websites visitor personal data will subsequently be permanently deleted without notice after 1 year.

In general personal data are processed internally by LuCE collaborators solely for the purposes and lawfulness indicated at Point 5) and are, if necessary, transmitted to one or more Partners management systems with servers located in Switzerland or in Europe compliant with the same legal bases as at Point 2) Each LuCE collaborator manages personal data only if necessary in the context of his/her duties.

7. User Rights Over Personal Data

Each User who has provided personal data to LuCE has the right to:

Ask for a verification and possible correction of the data stored, and have a copy of them

Ask for information on the processing of the data transmitted

Request the deletion of personal data (if this does not conflict with legal or accounting requirements)

In case of illicit processing of personal data, request the immediate blocking of processing and immediate cancellation

Withdraw his/her consent to data processing.

Each request must be addressed in writing to the Owner and Responsible for data processing (at Point 3), attaching a copy of the identity card or passport, who will have 30 days to process the request and confirm it to the User.

Preserving the User rights, LuCE may update this Privacy Policy from time to time to reflect changes in its practices or applicable laws. LuCE encourages every User to review this Privacy Policy periodically for any updates. The revised Privacy Policy will be effective when posted on LuCE websites or presented with any paper and electronic form.

8. Applicable Law and Competent Court

The legal relationship between the User and LuCE regarding the processing of personal data is governed by Swiss law on the legal bases indicated at Point 2).

In the event of a dispute, the competent court is in Bern (Canton Bern – Switzerland).