Last Updated: 14 March 2022
The Ehlers-Danlos Society
We are The Ehlers-Danlos Society (“Ehlers Danlos”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 10722868 and we have our registered office at Wayman House 141 Wickham Road, Shirley, Croydon, Surrey, England, CR0 8TE. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”) in relation to our processing of Personal Data under registration number ZB343307.
Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.
The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘How To Contact Us’ section.
Who This Privacy Notice Applies To
This privacy notice applies to you if:
• You visit our website
• You join our global registry and repository
• You make a donation to The Ehlers-Danlos Society
• You volunteer with The Ehlers-Danlos Society
• You engage in fundraising for The Ehlers-Danlos Society
• You become an advocate of The Ehlers-Danlos Society
• You sign up to receive newsletters and/or other communications from us
What Is Personal Data
‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.
‘Special Category Personal Data’ is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation.
How We Collect Your Information
We collect most of the Personal Data directly from you in person, by telephone, text or email and/or via our website.
However, we may also collect your Personal Data from third parties such as:
• others to whom you have provided consent
• publicly available sources such as social media platforms
Personal Data We Collect
The type of Personal Data we collect about you will depend on our relationship with you. For the type of Personal Data we collect see the table below in the section entitled ‘Purposes, Lawful Bases and Retention Periods’.
Purposes and Lawful Basis
We will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:
Purpose of Processing Lawful Basis
|Purpose of Processing||Lawful Basis|
|Process Donation||1. Performance of Contract|
2. Legitimate Interest to use moneys received to support The Ehlers-Danlos Society’s strategic goals
|To send you newsletters and other promotional material||Consent|
|Event Registration||1. Performance of Contract|
|Virtual Support Group Registration||1. Performance of Contract|
2. Legitimate Interest to offer support to individuals that contact The Ehlers-Danlos Society via the helpline
|Global Registry||Legitimate Interest to manage the registry database|
|Application Processing||Legitimate Interest to process applications for various positions, coalitions, educational programs, grant funding|
|Healthcare Professionals Directory||Legitimate Interest to manage the healthcare professionals’ directory|
|Social Media||1. Consent|
2. Legitimate Interest to promote The Ehlers-Danlos Society and it’s aims
Sharing Your Personal Data
We may also disclose your information to third parties in connection with other purposes set out in this policy. These third parties may include:
• business partners, suppliers and sub-contractors who may process information on our behalf
• external researchers when explicit consent is given by the participant (in regard to Global Registry)
• researchers, any joint funders of research, host institutions, and external members of our committee
• advertisers, social media platforms, and advertising networks
• analytics and search engine providers
• IT service providers
Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors, and/or, where we consider necessary to protect the rights, property or safety of The Ehlers-Danlos Society, its personnel, users or others.
Your Personal Data may be processed outside of the UK. This is because the organizations we use to provide our service to you are based outside the UK.
We have taken appropriate steps to ensure that the Personal Data processed outside the UK has an essentially equivalent level of protection to that guaranteed in the UK. We do this by ensuring that:
• Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation) or
• We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organization and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here international-data-transfer-agreement.pdf (ico.org.uk))
How Long We Keep Your Data
We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.
At the end of the retention period, your personal data will be securely deleted or anonymized, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.
We Respect Your Confidentiality
The Ehlers-Danlos Society (hereby referred to as The Society) requires that your personal information be held in strict confidence. We use your information only for its intended Society purposes. We do not sell or trade your information to other organizations or individuals.
We Protect Your Information
The Ehlers-Danlos Society takes every possible measure to ensure that your information is not compromised in any way. We implement appropriate technical and organizational measures to protect data that we process from unauthorized disclosure, use, alteration or destruction. Our privacy promise is in place in respect of our website only. Other online services will be serviced by their own privacy policies.
In addition to the technical and organizational measures we have put in place, there are a number of simple things you can do to in order to further protect your personal information;
1. Never share a One Time Passcode (OTP).
2. Never enter your details after clicking on a link in an email or text message.
3. Always send confidential information by encrypted email where possible this reduces the risk of interception.
4. If you are logged into any online service do not leave your computer unattended.
5. Close your internet browser once you have logged off.
6. Never download software or let anyone log on to your computer or devices remotely, during or after a cold call.
Secure Online Services
You can easily identify secure websites by looking at the address in the top of your browser which will begin https:// rather than http://.
What Are Your Data Protection Rights?
The Ehlers-Danlos Society would like to make sure you are fully aware of your rights. We will always ensure, no matter where you are located in the world, that we adhere to and fully respect your data protection rights. If you wish to exercise your data protection rights please email [email protected]
If you are located in the UK or EU you have the following rights:
• The right to access You have the right to request from The Ehlers-Danlos Society copies of your personal data and information about our processing of it.
• The right to rectification You have the right to request that The Ehlers-Danlos Society correct any information you believe to be inaccurate. You also have the right to request The Society to complete information you believe is incomplete.
• The right to withdraw You have the right to withdraw your consent at any time when The Ehlers-Danlos Society are relying on consent as the lawful basis for processing your personal data.
• The right to erasure You have the right to request that The Ehlers-Danlos Society erase your personal data, under certain conditions. Some data that is being used under certain conditions may not be able to be deleted, such as research data, however in these instances we will ensure all data being used is de-identified and cannot be linked with you.
• The right to restrict processing You have the right to request that The Ehlers-Danlos Society restrict the processing of your personal data, under certain conditions.
• The right to object to processing You have the right to object to The Ehlers-Danlos Society processing of your personal data, under certain conditions. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
• The right to data portability You have the right to request that The Ehlers-Danlos Society transfer the data that we have collected to another organization, or directly to you, under certain conditions. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
If you wish to exercise your rights, please contact us at [email protected]
You can also lodge a complaint with your relevant data protection supervisory authority.
Privacy Policies of Other Websites
We do not offer our products and services to children and we do not knowingly collect Personal Data of children without parental consent, unless permitted by law. If you are a child, you must have your parent’s permission to use our services. If you learn that a child has provided us with their Personal Data without parental consent, you may contact us, as described below, and if appropriate, we will securely and permanently delete it, in accordance with applicable law.
How to Contact Us and Our Data Protection Officer
Email us at: [email protected]
Call us: +1 410-670-7577 or +44 203 887 6132
Or write to us at: The Ehlers-Danlos Society Headquarters, 447 Broadway, 2nd FL #670, New York, NY 10013, or The Ehlers-Danlos Society Europe Office, Office 7, 35-37 Ludgate Hill, London, EC4M 7JN, United Kingdom.
We have also appointed a Data protection Officer (“DPO”). Our DPO is Evalian Limited and can be contacted as follows:
Using the above Society email or postal addresses, please send you’re your communication clearly indicating ‘FAO the ‘Data Protection Officer’, your message will be passed directly to Evalian Limited for attention.
Our EU Representative
We are based outside the EU and under the EU GDPR, we are required to appoint an EU representative. The purpose of an EU representative is to make it easy for people in the EU to contact us should they wish to exercise their rights or make a complaint or enquiry in relation to how we are processing their Personal Data. It is also a contact point for the supervisory authorities located in the EU.
Our EU representative is DataRep who can be contacted as follows:
• Sending an email to DataRep at [email protected] quoting ‘The Ehlers-Danlos Society’ in the subject line
• Sending an online webform at www.datarep.com/data-request
• Mailing your inquiry to DataRep at the most convenient of the addresses in the table below. Please note when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not The Ehlers-Danlos Society or your inquiry may not reach its destination.
DataRep Postal Address List:
|Austria||DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria|
|Belgium||DataRep, Place de L’Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium|
|Bulgaria||DataRep, 132 Mimi Balkanska Str., Sofia, 1540, Bulgaria|
|Croatia||DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia|
|Cyprus||DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus|
|Czech Republic||DataRep, IQ Ostrava Ground floor, 28. rijna 3346/91, Ostrava-mesto, Moravska, Ostrava, Czech Republic|
|Denmark||DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark|
|Estonia||DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia|
|Finland||DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland|
|France||DataRep, 72 rue de Lessard, Rouen, 76100, France|
|Germany||DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany|
|Greece||DataRep, 24 Lagoumitzi str, Athens, 17671, Greece|
|Hungary||DataRep, President Centre, Kálmán Imre utca 1, Budapest, 1054, Hungary|
|Iceland||DataRep, Kalkofnsvegur 2, 101 Reykjavík, Iceland Ireland|
|Ireland||DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland|
|Italy||DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy|
|Latvia||DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia|
|Liechtenstein||DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria|
|Lithuania||44A Gedimino Avenue, 01110 Vilnius, Lithuania|
|Luxembourg||DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg|
|Malta||DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta|
|Netherlands||DataRep, Cuserstraat 93, Floor 2 and 3, Amsterdam, 1081 CN, Netherlands|
|Norway||DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway|
|Poland||DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland|
|Portugal||DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal|
|Romania||DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania|
|Slovakia||DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia|
|Slovenia||DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia|
|Spain||DataRep, Calle de Manzanares 4, Madrid, 28005, Spain|
|Sweden||DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE – 211 46, Sweden|
How To Complain
You have the right to lodge a complaint with the relevant supervisory authority, if you are concerned about the way in which we are handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at:
Contact us | ICO
Or by telephone on 0303 123 1113
For supervisory authorities in other countries within the EU see the link below:
Policy Review and Amendments
We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify of the changes where required by applicable law to do so.