Privacy Policy

PRIVACY POLICY – TIF Education

Comprehensive Privacy Policy for Processing of Personal Data (EU, UK, USA, Canada, Brazil, Australia, Middle East, and Global)
 

1. Introduction

This Privacy Policy explains how Thalassaemia International Federation (TIF), operating the TIF Education platform (https://tifeducation.org), collects, uses, discloses, and protects your personal data when you use our platform and participate in TIF Education events.

This Privacy Policy is designed to comply with GDPR (EU), UK GDPR, CCPA/CPRA, PIPEDA, LGPD, Privacy Act 1988 (Australia), UAE Data Protection Law, and DPDP Act 2023 (India).

By using TIF Education and registering for events, you acknowledge that you have read, understood, and accepted the practices described in this Privacy Policy.

If you do not agree with this Privacy Policy, please do not use the TIF Education platform or register for events.

2. Who We Are

Thalassaemia International Federation (TIF), operating the TIF Education platform, is the data controller responsible for your personal data.

Registered Address:
Ifigenias 31, Strovolos 2083, Cyprus

Contact for Privacy and Data Protection Matters:
Email: admin@tifeducation.org

TIF is a non-profit international federation based in Cyprus (European Union).

TIF has not appointed a Data Protection Officer (DPO). For privacy matters, use the contact email above.

3. What Personal Data We Collect

3.1. Information You Provide Directly

We collect personal data that you provide directly when you:

• Create a user account
• Log in to your account
• Register for events
• Submit abstracts, research papers, or speaker applications
• Book accommodation
• Contact us for support or information
• Participate in surveys or feedback forms

The types of personal data we collect include:

• Full name
• Email address
• Telephone number
• Postal address (if provided)
• Country of residence
• Professional title (e.g., Doctor, Researcher, Professor, Medical Student)
• Organization, institution, or university
• Department or division
• Academic qualifications
• Curriculum Vitae (CV) and biography (when submitted as speaker or faculty)
• Professional interests and specialization areas
• Event(s) registered for
• Registration type (free or paid)
• Registration date and time
• Payment status
• Dietary requirements (if provided)
• Accessibility or special assistance requests
• Payment method type (e.g., credit/debit card)
• Transaction amount and currency
• Transaction date and time
• Payment gateway reference (Stripe)
• Check-in date (accommodation)
• Check-out date (accommodation)
• Room type preferences
• Special accommodation requests
• Hotel name and location (when booking is facilitated)
• Scientific abstracts
• Research summaries
• Academic submissions
• Research papers
• Educational materials
• Author information
• Institution details
• Biographies
• CVs
• Presentation materials
• Review and evaluation comments (internal)

3.2. Information Collected Automatically

When you use the TIF Education platform, we automatically collect certain information about your device and usage:

• User account credentials (username, hashed password)
• Login history and session data
• Profile information
• Device type
• Browser type
• Operating system
• IP address
• Pages visited on the platform
• Time spent on pages
• Click patterns
• Referring website or source
• Error logs
• Performance data

3.3. Information We Collect from Third Parties

We may receive personal data about you from third parties, including:

• Stripe (payment processing confirmation)
• Zoom (virtual event participation data)
• Scientific committee members (submission review feedback)
• Event partners or collaborators (co-hosted events)
• Publicly available sources (professional directories, academic databases)

3.4. Information from Zoom Virtual Events

TIF Education uses Zoom Video Communications exclusively for virtual events. When you participate in Zoom-based events, Zoom may collect:

• Attendance logs (join/leave times)
• Session participation data
• Chat messages (public and private, if enabled)
• Poll responses
• Questions submitted via Q&A feature
• Webinar engagement statistics
• IP address and device information
• Video and audio data (if camera/microphone is enabled)

Zoom acts as a data processor on behalf of TIF Education. Zoom's privacy policy is available at: https://zoom.us/privacy

3.5. Information from Event Recordings

TIF Education records events, including conferences, webinars, workshops, and hybrid sessions. Content that may be recorded includes:

• Video of participants and speakers
• Audio of discussions and presentations
• Screen shares
• Presentations (slides, documents)
• Questions and answers
• Discussions and panel interactions

Recorded content may later be published on TIF Education platforms or third-party platforms, archived for long-term educational use, shared as educational content, or used for future training programs.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

4.1. Event Registration and Administration

We use your personal data to process your registration for events, manage event access, issue certificates, and handle administrative tasks.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity (to fulfill your event registration).

4.2. Payment Processing

We use your personal data to process payments for paid registrations and accommodation bookings.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity.

Note: Payment processing is handled through Stripe. TIF Education does not store complete card details. Stripe's terms and privacy policy apply.

4.3. Accommodation Booking

We use your personal data to manage hotel booking support related to conferences and accommodation management for event attendees.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity.

4.4. Event Communications and Administrative Notifications

We use your personal data to send event-related communications, including event announcements, registration confirmations, event reminders, educational updates, and conference information.

Legal basis (GDPR/UK GDPR): Article 6(1)(a) – Consent (for optional communications); Article 6(1)(b) – Contractual necessity (for essential administrative communications related to your registration).

You may opt out of optional communications at any time.

4.5. Sponsor and Exhibitor Data Sharing

Official TIF Policy: Attendee data is never shared with sponsors or exhibitors unless the attendee expressly opts in during registration.

• Default: No sharing
• Explicit consent required for any sharing
• No automatic sponsor access to attendee data

Legal basis (GDPR/UK GDPR): Article 6(1)(a) – Consent.

You may withdraw consent at any time by contacting admin@tifeducation.org.

4.6. Virtual Event Infrastructure (Zoom)

We use your personal data to enable participation in webinars, virtual conferences, hybrid conference sessions, and educational meetings via Zoom.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity (to provide the virtual event service you have registered for); Article 6(1)(a) – Consent (for recording and additional processing beyond essential participation, where applicable).

4.7. Event Recordings and Publication

We use your personal data to record events and later use recordings for educational content, archival, future training purposes, and publication (depending on event rules).

Legal basis (GDPR/UK GDPR): Article 6(1)(a) – Consent.

By participating in recorded events, you acknowledge that sessions may be recorded. If you do not consent to recording, you may still attend the event, but certain participation features may be limited.

You may withdraw consent before the recording is published or archived by contacting admin@tifeducation.org. After publication, withdrawal may not be technically or legally feasible due to archival and distribution constraints.

4.8. Abstract, Research Paper, and Speaker Submissions

We use your personal data to process submissions for abstract submissions, research paper submissions, speaker registrations (speakers, faculty members, presenters), and scientific and educational activities.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity (if your submission is accepted and you participate as speaker/faculty); Article 6(1)(a) – Consent (for submission and review process).

By submitting, you confirm that you hold the necessary rights to the content and that the content does not infringe third-party intellectual property rights.

4.9. Certificate Issuance

We use your personal data to issue certificates of attendance, participation, speaker recognition, educational completion, or conference completion, depending on event requirements.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity (if certificates are part of event requirements); Article 6(1)(f) – Legitimate interests (for educational recognition and record-keeping).

4.10. Account Management and Platform Functionality

We use your personal data to enable user account creation, login, profile maintenance, and platform functionality.

Legal basis (GDPR/UK GDPR): Article 6(1)(b) – Contractual necessity (to provide the platform service); Article 6(1)(f) – Legitimate interests (account security and platform integrity).

4.11. Security and Fraud Prevention

We use your personal data to ensure the security of the platform, prevent fraud, and protect the rights and property of TIF Education and its users.

Legal basis (GDPR/UK GDPR): Article 6(1)(f) – Legitimate interests (security and fraud prevention).

4.12. Legal Obligations

We use your personal data to comply with legal obligations under Cyprus law, EU law, or international obligations.

Legal basis (GDPR/UK GDPR): Article 6(1)(c) – Compliance with a legal obligation.

4.13. Internal Analytics and Reporting

We use your personal data to understand how the TIF Education platform is used, to improve services, to monitor event participation, to manage registrations, to issue certificates, to support scientific and educational operations, to improve platform security and performance, and to generate operational insights.

Legal basis (GDPR/UK GDPR): Article 6(1)(f) – Legitimate interests (operational improvement, service quality, platform security).

Note: Analytics is generated from our own database and platform records (first-party analytics). We do not use Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity, or similar third-party advertising analytics tools at this time. Analytics may be aggregated or pseudonymized where possible, but where personal data is used, it is processed under the legal bases above.

4.14. Service Improvement and Development

We use your personal data to improve the TIF Education platform, develop new features, enhance user experience, and optimize platform performance.

Legal basis (GDPR/UK GDPR): Article 6(1)(f) – Legitimate interests (service improvement and development).

4.15. Research and Statistical Analysis

We use your personal data for research and statistical analysis related to thalassaemia education, event participation trends, and educational outcomes. Data may be aggregated or anonymized for this purpose.

Legal basis (GDPR/UK GDPR): Article 6(1)(f) – Legitimate interests (research and statistical analysis).

5. Sensitive (Health) Data – Article 9 GDPR / Special Category Data

IMPORTANT: TIF Education is an educational platform focused on thalassaemia and related disorders, which are medical/health conditions. Under GDPR Article 9, health data is classified as Special Category Data requiring heightened protection.

5.1. What We Do Not Collect Intentionally

TIF Education does not intentionally collect the following sensitive data:

• Medical diagnosis or test results (for patients)
• Treatment history
• Medication details
• Genetic test results (unless submitted as part of research)
• Sexual orientation
• Religious beliefs
• Political opinions
• Trade union membership

5.2. What You May Voluntarily Provide

In limited cases, you may voluntarily provide information that could reveal health-related data, such as:

• Patient status (yourself or family member)
• Personal experience with thalassaemia
• Dietary requirements related to medical conditions
• Disability-related accommodation requests
• Research data involving health/medical information

5.3. Legal Basis for Processing Sensitive Data

If you voluntarily provide health-related data, TIF Education processes it under the following legal bases:

• GDPR (EU): Article 9(2)(a) – Explicit Consent for processing special category data
• UK GDPR: Article 9(2)(a) – Explicit Consent + Data Protection Act 2018, Schedule 1
• CCPA (California): Not classified as sensitive under CCPA, but treated with heightened protection
• PIPEDA (Canada): Sensitive information – requires Express Consent
• LGPD (Brazil): Article 11 – Explicit Consent for sensitive data
• Australia Privacy Act: Sensitive information – requires Express Consent
• UAE Data Protection Law: Article 12 – Explicit Consent for health data
• DPDP Act (India): Special protection for sensitive personal data

5.4. Your Rights Regarding Sensitive Data

• You may choose not to provide health-related data
• If you provide it, you may withdraw consent at any time
• TIF will delete sensitive data upon withdrawal, unless retention is required for legal obligations
• Sensitive data is stored with enhanced security measures

By providing health-related data, you confirm that you are providing it voluntarily and consent to its processing under the terms above.

6. Who We Share Your Data With

6.1. Third-Party Service Providers (Processors)

TIF engages third-party processors to provide specific services. These processors act on TIF's instructions and are bound by contractual obligations:

• Stripe: Payment processing (payment gateway)
• Zoom Video Communications: Virtual event infrastructure
• Hosting and cloud service providers: Data storage and platform hosting
• Email service providers: Transactional email delivery (where applicable)
• Technical support and maintenance providers

All processors are required to implement appropriate technical and organizational measures to protect your personal data.

6.2. Scientific Committee and Reviewers

For abstract, research paper, and speaker submissions, limited data may be shared with:

• Scientific committee members
• Peer reviewers
• Faculty coordinators

6.3. Sponsors and Exhibitors (Only with Explicit Consent)

TIF's official policy: Attendee data is never shared with sponsors or exhibitors unless you expressly opt in during registration.

• If you opt in, shared data may include: name, email, professional title, organization, and event interests
• You may withdraw consent at any time

6.4. Public and Educational Audience (Recordings and Publications)

Recorded events and submitted content may be:

• Published on TIF Education platforms
• Shared on third-party platforms (e.g., YouTube, Vimeo, institutional repositories)
• Used for internal educational and training purposes
• Archived in digital repositories

Once published, such content may be accessible to the general public or specific academic/medical communities.

6.5. Regulatory and Legal Authorities

TIF may disclose personal data to:

• Data protection authorities (e.g., Cyprus Commissioner for Personal Data Protection)
• Law enforcement agencies (where required by law)
• Courts and tribunals (in legal proceedings)

6.6. Business Transfers

If TIF Education is involved in a merger, acquisition, sale of assets, or bankruptcy, your personal data may be transferred as part of that transaction. You will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal data.

7. International Transfers of Personal Data

TIF Education is based in Cyprus (EU), but your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including but not limited to:

• United States (Stripe, Zoom, hosting providers)
• United Kingdom (post-Brexit data transfers)
• Canada
• Brazil
• Australia
• Middle East (UAE, Saudi Arabia, etc.)
• India

Such transfers are subject to appropriate safeguards in accordance with applicable data protection laws, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• UK International Data Transfer Agreement (IDTA) for UK transfers
• Adequacy decisions (where the European Commission or relevant authority has determined the country provides adequate protection)
• Binding Corporate Rules (where applicable)
• Industry-standard encryption and security measures

You may request a copy of the appropriate safeguards by contacting admin@tifeducation.org.

8. Data Retention Periods

TIF Education retains your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, or as required by law.

8.1. Event Registration Data

Retention period: Duration of the event plus up to 2 years afterward.

Purpose: Administrative, legal, compliance, and educational record-keeping.

8.2. Payment Data

Retention period: As required by Cyprus tax and accounting laws (typically 5–7 years).

Purpose: Legal and fiscal obligations.

8.3. Accommodation Data

Retention period: Duration of the stay plus up to 2 years afterward.

Purpose: Administrative and legal record-keeping.

8.4. Virtual Event Data (Zoom)

Retention period: Up to 2 years after the event, unless longer retention is required for legal or educational purposes.

Zoom's own retention policies also apply (see Zoom Privacy Policy).

8.5. Event Recordings

Retention period: Indefinitely or until formally deleted.

Purpose: Educational, archival, and training purposes.

You may withdraw consent before publication, but not after.

8.6. Abstracts, Research Papers, Speaker Submissions

Retention period: Indefinitely or until formally deleted.

Purpose: Academic and educational archival.

8.7. Account Data

Retention period: Until account deletion plus up to 2 years afterward.

Purpose: Administrative and legal record-keeping.

8.8. Marketing Communications Data

Retention period: Until you withdraw consent or unsubscribe.

Purpose: Marketing and educational communications.

8.9. Analytics and Technical Data

Retention period: Up to 2 years for identifiable data; aggregated/anonymized data may be retained indefinitely.

Purpose: Platform improvement, performance monitoring, operational insights.

If you request erasure of your data, TIF will comply unless retention is necessary for compliance with legal obligations, performance of a contract, establishment/exercise/defense of legal claims, or archival purposes in the public interest, scientific or historical research, or statistical purposes.

9. Your Rights by Jurisdiction

Your privacy rights may vary depending on your location. Below is a summary of your rights:

9.1. EU Users (GDPR)

You have the following rights:

• Right to access your personal data (Article 15)
• Right to rectification of inaccurate data (Article 16)
• Right to erasure / right to be forgotten (Article 17)
• Right to restrict processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing (Article 21)
• Right to withdraw consent at any time (Article 7)
• Right to lodge a complaint with your national Data Protection Authority

Regulator: Contact your national DPA (e.g., Cyprus Commissioner, Irish DPC, German BfDI).

9.2. UK Users (UK GDPR)

You have the same rights as EU GDPR, plus the right to complain to the UK Information Commissioner's Office (ICO).

Regulator: https://ico.org.uk/

9.3. USA Users (CCPA/CPRA + State Laws)

California Residents (CCPA/CPRA):

• Right to know what personal data is collected
• Right to delete personal data
• Right to opt-out of sale or sharing of personal data
• Right to correct inaccurate personal data
• Right to limit use of sensitive personal information
• Right not to be discriminated against for exercising rights

TIF's policy is NO sharing of attendee data with sponsors unless you expressly opt in. TIF does not sell your personal data to third parties.

How to Opt-Out: Contact admin@tifeducation.org to opt out of any data sharing.

Other States: Virginia (VCDPA), Colorado (CPA), Connecticut (CDPA), Utah (UCPA) have similar rights. TIF complies with all applicable state laws.

Federal Laws: The FTC enforces federal privacy laws. TIF complies with applicable federal regulations.

9.4. Canadian Users (PIPEDA)

You have the following rights:

• Right to access your personal information
• Right to challenge accuracy and completeness
• Right to withdraw consent (with limitations)
• Right to complain to the Office of the Privacy Commissioner of Canada (OPC)

Regulator: https://www.priv.gc.ca/

Sensitive Information: Health data is sensitive under PIPEDA and requires Express Consent.

9.5. Brazilian Users (LGPD)

You have the following rights:

• Right to confirm processing (Article 18)
• Right to access your data (Article 18)
• Right to correct incomplete or inaccurate data (Article 18)
• Right to anonymize, block, or erase data (Article 18)
• Right to data portability (Article 18)
• Right to delete data processed with consent (Article 18)
• Right to know about third-party sharing (Article 18)
• Right to revoke consent (Article 8)
• Right to complain to ANPD

Regulator: https://www.gov.br/anpd/

Sensitive Data: Health data is sensitive under LGPD Article 5 and requires Explicit Consent (Article 11).

9.6. Australian Users (Privacy Act 1988)

You have the following rights:

• Right to know why data is collected (APP 1)
• Right to know how data is collected (APP 1)
• Right to access your data (APP 5)
• Right to correct your data (APP 5)
• Right to complain about privacy breaches (APP 1)
• Right to complain to the Office of the Australian Information Commissioner (OAIC)

Regulator: https://www.oaic.gov.au/

Sensitive Information: Health data is sensitive information under APP 3 and requires Express Consent.

9.7. Middle East Users (UAE, Saudi Arabia, etc.)

UAE (Dubai/Abu Dhabi):

• Right to access data (Article 10)
• Right to correct data (Article 10)
• Right to withdraw consent (Article 7)
• Right to complain to TDRA (Telecommunications and Digital Government Regulatory Authority)

Regulator: https://www.tdra.gov.ae/

Saudi Arabia:

• Right to access data
• Right to correct data
• Right to withdraw consent
• Right to complain to CDA (Communications and Digital Authority)

Regulator: https://www.cda.gov.sa/

Health Data: Requires Explicit Consent under UAE Data Protection Law Article 12 and Saudi FDA.

9.8. Indian Users (DPDP Act 2023)

You have the following rights:

• Right to access information (Section 11)
• Right to grievance redressal (Section 12)
• Right to erasure (Section 11)
• Right to nominate (Section 13)
• Right to complain to Data Protection Board of India

Regulator: https://dpbi.gov.in/ (when operational)

Sensitive Data: Special protection for sensitive personal data under DPDP Act.

10. How to Exercise Your Rights

To exercise any of your rights, please contact:

Email: admin@tifeducation.org

Address: Ifigenias 31, Strovolos 2083, Cyprus

In your request, please include:

• Your full name
• Your email address
• The specific right you wish to exercise
• Any relevant details to help us identify your data

We will respond within one month (30 days) of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt.

No fee is required to exercise your rights, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

11. Cookies and Similar Technologies

TIF Education uses cookies and similar technologies for the following purposes:

11.1. Essential Cookies

Essential cookies are strictly necessary for:

• Login sessions and authentication
• Account security
• Registration workflows
• Payment sessions through Stripe
• Core platform functionality

Without essential cookies, the platform cannot function properly.

11.2. Non-Essential Cookies

TIF Education currently does not use:

• Google Analytics
• Google Tag Manager
• Meta Pixel / Facebook Pixel
• LinkedIn Insight Tag
• Microsoft Clarity
• Advertising or marketing tracking cookies
• Social media tracking cookies

If TIF Education introduces non-essential cookies in the future, a separate Cookie Policy and consent mechanism will be implemented in accordance with GDPR and ePrivacy Directive requirements.

12. Data Security

TIF Education implements appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, or disclosure.

Measures include:

• Secure login and authentication mechanisms
• Encryption for data in transit (HTTPS/TLS)
• Encryption for payment processing via Stripe
• Access controls limiting data access to authorized personnel only
• Regular security reviews and updates
• Secure data storage with backup and disaster recovery procedures
• Staff training on data protection and confidentiality

Despite these measures, no internet transmission is 100 percent secure. TIF Education cannot guarantee absolute security but strives to protect your data using industry-standard practices.

13. Automated Decision-Making and Profiling

TIF Education does not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Strictly necessary automated processing (e.g., registration system logic, payment validation) is based on contractual necessity and includes human oversight where appropriate.

14. Children's Personal Data

TIF Education events are primarily intended for:

• Doctors
• Healthcare professionals
• Researchers
• Scientists
• Academics
• Medical students
• Patient advocates
• Patients and families (where applicable)

Minimum Age: 18 years old for registration.

• TIF Education does not knowingly collect personal data from children under the age of 16 (GDPR default) or 13 (COPPA/UK).
• If you are under 18, you must have parental or guardian consent to register.
• If TIF Education becomes aware that it has collected personal data from a child under 16 without verifiable parental consent, it will take steps to delete such data.

15. Third-Party Links

The TIF Education platform may contain links to third-party websites or services (e.g., Zoom, Stripe, YouTube, Vimeo). When you click on a link to a third-party website, you will be taken to a site that is not controlled by TIF Education.

We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any third-party website you visit.

16. Governing Law and Jurisdiction

Governing Law: Cyprus law applies to all disputes related to this Privacy Policy and TIF Education.

Jurisdiction: Any legal disputes shall be subject to the exclusive jurisdiction of the courts of Cyprus (Nicosia).

Language: This Privacy Policy is provided in English. If provided in other languages, the English version prevails for legal interpretation.

Waiver: You may not waive your rights under applicable data protection laws.

17. Changes to This Privacy Policy

TIF Education may update this Privacy Policy from time to time to reflect changes in our practices, legal or regulatory requirements, platform features, or services.

The updated Privacy Policy will be posted on this page with an updated "Last revised" date. We encourage you to review this Privacy Policy periodically.

We will notify you of significant changes by sending a notice to the email address specified in your account or by placing a prominent notice on our platform.

Continued use of TIF Education after changes constitutes acceptance of the updated Privacy Policy.

18. Last Revised

Last revised: June 4, 2026

19. Contact Information

Thalassaemia International Federation (TIF)

Operating Platform: TIF Education

Website: https://tifeducation.org

Address: Ifigenias 31, Strovolos 2083, Cyprus

Email: admin@tifeducation.org

For privacy-related requests, data subject rights, or questions about this Privacy Policy, please contact us using the above details.

20. Acknowledgment

By using TIF Education and registering for events, you acknowledge that:

• You have read, understood, and accepted this Privacy Policy
• You agree to the processing of your personal data as described herein
• You have been informed of your rights under GDPR, UK GDPR, CCPA, PIPEDA, LGPD, Australia Privacy Act, UAE Law, and DPDP Act
• You understand that TIF Education does not share attendee data with sponsors unless you expressly opt in
• You understand that events may be recorded and recordings may be used for educational and archival purposes
• You understand that payment processing is handled through Stripe and TIF does not store complete card details
• You understand that Zoom is used for virtual events and related data may be collected
• You confirm that you are 18 years or older (or have parental consent if under 18)
• You understand that health-related data is sensitive and requires explicit consent if provided
• You understand that internal analytics is generated from our own database for operational and service improvement purposes