Privacy Policy

Stichting Vivli Europe

Last updated: 30 October 2026

1. Introduction

Vivli Europe is an independent European non-profit organisation established in the Netherlands. We work to support the responsible secondary use of health data for research and innovation, including the development of practical governance and operational approaches under the European Health Data Space (EHDS).

We are committed to protecting personal data and respecting the privacy of individuals who visit our website, engage with our organisation, or participate in our activities.

This Privacy Policy explains how we collect, use, store, and protect personal data, as well as the rights individuals have under the EU General Data Protection Regulation (GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming – UAVG).

2. Who We Are

The data controller responsible for the personal data processing described in this Privacy Policy is:

Stichting Vivli Europe

Rokin 92

1012 KZ Amsterdam

The Netherlands

Website: https://vivli.eu

Email: info@vivli.eu

Stichting Vivli Europe is an independent legal entity established under the laws of the Netherlands. For questions about this Privacy Policy or the processing of your personal data, please contact us using the details above.

3. Personal Data We Collect

We collect and process the following categories of personal data:

Information you provide directly

  • Contact & Professional Identification: Name, work email address, telephone number, organisation, professional role, and job title.
  • Inquiries & Correspondence: Information submitted through contact forms, email correspondence, or stakeholder surveys.
  • Event & Meeting Registration: Registration details, dietary requirements (if catering in-person events), attendance records, and questions submitted for webinars, forums, workshops, or roundtables.
  • Recruitment Data: CVs, cover letters, employment history, and references submitted during job applications.

Information collected automatically When you browse our website, technical telemetry data may be collected:

  • IP address, browser type and version, and operating system.
  • Referring URLs, pages visited, time spent per page, and navigation paths.
  • Technical diagnostics necessary for website security, firewall management, and service uptime.

For more information on tracking mechanisms, please see Section 9.

Information obtained from third parties We may collect professional contact details from publicly accessible sources (e.g., academic directories, institutional websites, LinkedIn) or through mutual professional introductions where permitted by applicable law.

4. How We Use Personal Data & Legal Bases

We process personal data only where we have a lawful basis under Article 6 of the GDPR:

Processing Purpose

Category of Personal Data

Lawful Basis (GDPR Art. 6)

Responding to inquiries and general communication

Contact details, correspondence

Legitimate interests (Art. 6(1)(f)) to operate our organisation and assist stakeholders

Organising webinars, roundtables, and events

Registration details, event attendance

Contractual necessity (Art. 6(1)(b)) or Legitimate interests (Art. 6(1)(f))

Sending newsletters and institutional updates

Name, email address

Consent (Art. 6(1)(a))

Recruitment and candidate evaluation

CV, application files, interview notes

Pre-contractual steps (Art. 6(1)(b)) and Legitimate interests (Art. 6(1)(f))

Managing institutional partnerships & vendor contracts

Contact details, contract terms, billing data

Contractual necessity (Art. 6(1)(b))

Website functionality, telemetry, and cyber defense

IP address, device logs

Legitimate interests (Art. 6(1)(f)) to secure our infrastructure

Statutory administrative & tax reporting

Accounting and transactional records

Legal obligation (Art. 6(1)(c)) under Dutch law

Where we process personal data based on legitimate interests, we carry out a balancing test to ensure that our interests are not overridden by your fundamental rights and freedoms. Where processing is based on consent, you may withdraw your consent at any time.

5. Stakeholder Engagement, Events, and Recordings

Vivli Europe convenes events involving researchers, industry experts, academic institutions, and policymakers.

  • Third-Party Platforms: When virtual events take place via platforms such as Zoom, Microsoft Teams, or Eventbrite, those platforms also process personal data as data processors or independent controllers under their respective privacy notices.
  • Recordings: If an event or webinar is being recorded, participants will be notified in advance (both via pre-event correspondence and system audio/visual prompts). If you do not wish to be recorded, you may keep your camera and microphone turned off and participate via chat.
  • Opt-Out: You can unsubscribe from our event updates or mailing lists at any time by clicking the "unsubscribe" link in any communication or by contacting info@vivli.eu.

6. Sharing Personal Data

We do not sell, rent, or trade personal data. We disclose personal data only to the following recipients:

  • Service Providers / Processors: Cloud hosting, website infrastructure, customer relationship management (CRM), and communication platforms operating under written Data Processing Agreements (DPAs) in compliance with GDPR Article 28.
  • Affiliates & Partners: Vivli Europe works in operational coordination with Vivli Inc., an independent non-profit entity based in the United States. Where personal data is shared between these entities for operational coordination, appropriate contractual safeguards are maintained.
  • Professional Advisers: External legal, accounting, auditing, and tax advisers bound by professional confidentiality.
  • Public Authorities: Regulatory, tax, or law enforcement authorities where legally mandated by Dutch or EU law.

7. International Data Transfers

When personal data is transferred outside the European Economic Area (EEA)—including data shared with our US affiliate, Vivli Inc., or US-based cloud infrastructure providers—we ensure an adequate level of data protection by implementing one or more of the following mechanisms:

  • Adequacy Decisions: Transfers to jurisdictions recognised by the European Commission as offering adequate protection (GDPR Art. 45), including certified organisations under the EU–U.S. Data Privacy Framework.
  • Standard Contractual Clauses (SCCs): In the absence of an adequacy decision, transfers are governed by the European Commission’s Standard Contractual Clauses (GDPR Art. 46(2)(c)), accompanied by supplementary Technical and Organisational Measures (TOMs) and transfer impact assessments where necessary.

You may request a copy of the applicable transfer safeguards by contacting us.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • General Inquiries: Retained for up to 12 months after the matter is resolved.
  • Event Attendee Data: Retained for up to 2 years following the event for administrative review and impact assessment.
  • Newsletter Subscriptions: Retained until you withdraw consent or unsubscribe.
  • Recruitment Data: Candidate applications are deleted within 4 weeks after the recruitment procedure ends, unless the applicant gives explicit consent to retain records on file for up to 1 year.
  • Financial & Corporate Records: Retained for 7 years to comply with the statutory retention obligations under the Dutch Civil Code (Burgerlijk Wetboek) and the Dutch State Taxes Act (Algemene wet inzake rijksbelastingen).

9. Cookies and Analytics

Our website uses cookies and similar tracking technologies:

  • Strictly Necessary Cookies: Essential for the website to function, navigate, and maintain security. These do not require user consent.
  • Analytical / Performance Cookies: Help us understand aggregate visitor behaviour to improve site layout and content. Non-essential cookies are disabled by default and are activated only when you provide explicit consent through our cookie consent banner.

You can update or withdraw your cookie preferences at any time via the cookie settings banner located in our site footer. For complete details on individual cookies, expiration windows, and third-party tools, please visit our Cookie Policy.

10. Technical and Organisational Security Measures

We implement technical and organisational measures appropriate to the risk of processing personal data, including:

  • Transport Layer Security (TLS/HTTPS) encryption across our web domains.
  • Role-based access controls and multi-factor authentication (MFA) for administrative systems.
  • Routine security patching, vulnerability reviews, and continuous backups.
  • Confidentiality obligations binding all personnel and contractors handling personal data.

11. Your GDPR Rights

Under Articles 15–22 of the GDPR, you have the following rights regarding your personal data:

  • Access: The right to obtain confirmation as to whether your data is processed and request a copy of it.
  • Rectification: The right to request the correction of inaccurate or incomplete personal data.
  • Erasure ("Right to be Forgotten"): The right to request data deletion where retention is no longer justified.
  • Restriction of Processing: The right to request that we temporarily suspend data processing under certain circumstances.
  • Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
  • Objection: The right to object to processing based on legitimate interests (GDPR Art. 6(1)(f)).
  • Withdraw Consent: The right to withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at info@vivli.eu. We respond to all verified requests within one calendar month.

Right to Lodge a Complaint:

If you believe our processing violates data protection laws, you have the right to lodge a complaint with your local supervisory authority or with our lead supervisory authority in the Netherlands:

Autoriteit Persoonsgegevens (Dutch Data Protection Authority)

Bezuidenhoutseweg 30

2594 AV Den Haag, The Netherlands

Website: https://autoriteitpersoonsgegevens.nl

12. Health Data and Research Platforms (EHDS Scope)

Stichting Vivli Europe advocates for, and supports the operational readiness of, secondary health data use frameworks under the European Health Data Space (EHDS).

This Privacy Policy applies solely to our administrative, institutional, and web-based operational activities. Any specific platform, data governance environment, or data access mechanism governed by clinical data sharing agreements, data processor contracts, or independent EHDS Health Data Access Body (HDAB) permits is subject to separate, dedicated Data Governance Charters and Data Processing Agreements.

13. Third-Party Links

Our website may contain links to external websites, platforms, or resources. Vivli Europe is not responsible for the privacy practices, content, or policies of external sites. We encourage you to review the privacy notices of any external site you visit.

14. Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect operational, legal, or regulatory updates. Any changes will be published on this page with an updated revision date. Where material changes affect your rights, we will provide prominent notification or communicate with you directly where feasible.

15. Contact Us

For questions, data subject requests, or privacy concerns, please contact:

Stichting Vivli Europe

Rokin 92, 1012 KZ Amsterdam, The Netherlands

Email: info@vivli.eu

Website: https://vivli.eu