Livrare Rapida ⚡️ Oferte Zilnice. Discount-uri de pana la 15%

Privacy Policy for Medical Webinars

Last updated: 2 November 2026

1. Who we are

This Privacy Policy explains how DIGITAL INTERACTION SRL collects, uses, shares and retains personal data in connection with medical webinars that it organises and sells through medestetica.ro.

It applies to webinar enquiries, registration, payment, invoicing, participation, certificates, customer support and related communications, including where customers or participants are located in the United Kingdom, Germany or Poland.

The controller responsible for the processing described in this Policy is:

DIGITAL INTERACTION SRL
VAT identification number: RO41459230
Trade Register number: J40/9968/2019
Registered office: Bd. Timișoara no. 7, Romania
Email: info@digital-interaction.com
Telephone: +40 722 659 559

In this Policy, “we”, “us” and “our” refer to DIGITAL INTERACTION SRL.

This Policy concerns the webinar activities for which DIGITAL INTERACTION SRL determines the purposes and means of processing. Other purchases and services provided through MedEstetica may be subject to the privacy notice of the relevant provider.

2. Personal data we process

We process personal data relevant to your interaction with us. Depending on whether you enquire, purchase a place or attend a webinar, this may include the following categories.

2.1. Identification and contact information

First and last name.
Email address.
Telephone number, where supplied.
Country and billing address.

2.2. Professional information

Profession, medical specialty or professional role.
Name of the clinic, practice, employer or organisation you represent.
Professional registration details or other proportionate evidence of eligibility, where needed to verify that you meet the webinar’s attendance requirements.

We seek only the information necessary for verification. Please do not send identity documents or additional personal information unless specifically requested for a justified purpose.

2.3. Booking, billing and transaction information

The webinar and number of places purchased.
Customer and participant details.
Company name, registration details and VAT number, where applicable.
Order references, invoice details, amounts, currency and applicable taxes.
Payment status, transaction references and refund information.
Information needed to establish the correct VAT treatment and customer location.

2.4. Participation information

Depending on the webinar platform and how you participate, we may process:

Your display name and email address.
Joining and leaving times, attendance status and session duration.
Questions, chat messages, poll responses or feedback you choose to submit.
Your voice or image if you activate your microphone or camera.
Information needed to issue or correct your participation certificate.

2.5. Communications and preference records

Enquiries and correspondence.
Support requests, complaints, withdrawal requests and refund communications.
Records of contractual acceptance and any separate early-performance request.
Marketing preferences, consent records and unsubscribe requests.

2.6. Technical information

Where relevant to the systems used, technical information may include IP addresses, browser and device information, access logs, security events and cookie or similar identifiers.

Information collected through optional analytics or advertising technologies is subject to the applicable consent requirements.

3. How we obtain personal data

We obtain personal data:

Directly from you through registration, checkout, correspondence and participation.
From an employer, clinic, colleague or other person booking a place on your behalf.
From payment providers concerning transaction status, refunds and fraud prevention.
From the webinar platform concerning access, participation and technical operation.
Through website technologies, subject to applicable cookie choices.
From relevant professional or VAT registers where proportionate verification is necessary and lawful.

If someone registers you for a webinar, we may receive your name, professional details and contact information from that person or organisation.

We provide the applicable privacy information when we first contact you, or within the period required by law.

A person booking on behalf of others should provide accurate information, have a lawful basis for sharing it and make this Policy available to the participants concerned.

4. Why we process personal data and our legal bases

4.1. Enquiries and registration

We use relevant contact, professional and booking information to answer questions, check eligibility, process registrations and manage bookings.

Where you are personally entering into the contract, the legal basis is Article 6(1)(b) GDPR, covering steps taken at your request before entering into a contract and performance of that contract.

Where you attend under a booking made by an employer, clinic or other organisation, we generally rely on Article 6(1)(f) GDPR. Our legitimate interest is administering the organisation’s booking and providing the webinar to its nominated participants.

4.2. Webinar delivery and certificates

We use participant information to send access instructions, manage attendance, facilitate questions, provide support and issue the advertised certificate.

The legal basis is contractual necessity where you are the contracting individual, or our legitimate interest in delivering the booked service where another organisation has purchased your place.

4.3. Payments, invoices and tax compliance

We process billing and transaction information to administer payments and refunds, issue invoices and meet accounting, tax and reporting requirements.

The legal bases are:

Article 6(1)(b) GDPR, where necessary to perform your contract.
Article 6(1)(c) GDPR, where processing is necessary to comply with applicable legal obligations.
Article 6(1)(f) GDPR, where necessary to administer an organisation’s payment or investigate a disputed transaction.

4.4. Customer service, complaints and legal claims

We process relevant correspondence and booking records to resolve support requests, complaints, withdrawal requests, payment disputes and legal claims.

The legal basis depends on the request: performance of a contract, compliance with a legal obligation, or our legitimate interest in resolving disputes and establishing, exercising or defending legal rights.

4.5. Security and fraud prevention

We may process technical, access and transaction information to protect registrations, prevent unauthorised access, investigate misuse and maintain the security of the service.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are protecting customers, participants, payment processes and our systems.

Where a specific security or reporting obligation applies, we may also rely on Article 6(1)(c) GDPR.

4.6. Marketing communications

Where you separately subscribe or provide the required consent, we may use your contact details to send information about webinars, educational events and related services.

For these consent-based communications, the legal basis is Article 6(1)(a) GDPR, together with applicable electronic marketing rules.

Purchasing a webinar does not automatically subscribe you to promotional communications.

4.7. Optional analytics and advertising

Where optional analytics or advertising technologies are used and require consent, they are activated only after the relevant consent has been given.

We do not use legitimate interests to bypass a legal requirement for consent to cookies, advertising pixels or similar technologies.

5. Required and optional information

Certain information is necessary to process a booking, verify eligibility, deliver access, issue an invoice or comply with legal obligations.

Without the necessary information, we may be unable to accept the registration, provide attendance or issue the required documents.

Optional information is identified as such where collected.

You do not need to consent to marketing or optional tracking to purchase or attend a webinar.

Camera use, microphone use and voluntary participation in discussions are optional unless a specific requirement has been clearly disclosed before purchase.

6. Payment processing through Stripe

Card payments are processed through Stripe.

Stripe processes payment and technical information necessary to complete transactions, authenticate payments, prevent fraud and meet its own legal obligations.

We receive information needed to administer the booking and transaction, such as payment status, transaction references and, where made available, limited payment-method information.

Stripe may act as a processor for some activities and as an independent controller for others, including certain fraud-prevention and regulatory activities. Its processing is also described in the Stripe Privacy Policy.

Please do not send full payment-card numbers or card security codes to us by email, chat or a general contact form.

7. Webinar participation and visibility to others

The webinar platform used for the event is identified in the joining instructions.

Depending on its settings, your display name, questions, chat contributions, voice or image may be visible or audible to the speaker, moderators or other participants.

You can limit voluntary disclosure by keeping your camera or microphone off and avoiding unnecessary personal information in your display name or contributions.

The speaker and authorised moderators may receive the participant information necessary to manage the session and answer questions.

Attendance information may be used to confirm participation and issue certificates.

We do not use acceptance of this Policy as consent to publish your image, voice, testimonial or participation for promotional purposes.

If a recording involving identifiable participants or a separate publicity activity is proposed, we will explain its purpose, audience, retention and legal basis beforehand and obtain any separate consent required by law.

8. Health information and clinical demonstrations

We do not request your personal medical history or identifiable patient records as part of ordinary webinar registration.

Please do not submit patient names, photographs, medical records, diagnoses or other identifiable health information through registration forms, email enquiries, chat or questions.

Where clinical cases are discussed, participants should use information that does not identify the patient.

Any processing of identifiable health information requires both an appropriate legal basis and an applicable condition under Article 9 GDPR.

A patient or model appearing in a clinical demonstration must receive separate information about the relevant processing and any required consent arrangements.

This participant Privacy Policy does not replace that information and does not authorise the use or disclosure of a patient’s health information.

9. Who receives personal data

We disclose personal data only where necessary for the purposes described in this Policy and on an appropriate legal basis.

Recipients may include:

Authorised personnel administering registrations, access, certificates and support.
Speakers and moderators, to the extent necessary for delivery.
Payment providers, including Stripe, banks and payment networks.
Webinar and videoconferencing providers.
Hosting, email, cloud-storage and other technical service providers.
Booking, invoicing and customer-management service providers.
Accountants, legal advisers and other professional advisers.
Tax authorities, courts, regulators and other competent authorities where disclosure is legally required or otherwise lawful.
Analytics or advertising providers where the relevant technology is used with the required consent.

Providers acting on our behalf are subject to appropriate contractual requirements concerning processing, confidentiality and security.

Some recipients act as independent controllers for their own processing. Their privacy notices apply to those activities.

Where your employer or clinic purchases your place, we may provide the booking contact with necessary booking administration information. Any disclosure of your attendance or certificate information must have an appropriate legal basis and be limited to what is necessary.

We do not sell participant contact lists or provide them to speakers, sponsors or other businesses for their independent marketing without an appropriate, separately disclosed legal basis.

10. International transfers

Some payment, communication and technology providers operate internationally. Their services may involve processing or remote access outside the European Economic Area or the United Kingdom.

Where a transfer is subject to international data-transfer restrictions, we use a mechanism permitted by the applicable law.

Depending on the destination and recipient, this may include:

A valid adequacy decision or applicable UK adequacy regulations.
European Commission Standard Contractual Clauses.
An applicable UK International Data Transfer Agreement or UK Addendum.
Other safeguards or exceptions permitted by law.

Where required, we assess the transfer and use supplementary safeguards appropriate to the circumstances.

You may contact info@digital-interaction.com for information about the safeguards relevant to your data and to request a copy, subject to necessary protection of confidential information.

11. How long we retain personal data

We retain personal data for the period necessary for its purpose, taking account of legal obligations, the nature of the information and any need to resolve disputes.

11.1. Booking and participation records

We retain the information necessary to deliver the webinar, provide the certificate and complete related customer support.

After those activities are completed, we retain only the information needed for an identified purpose, such as resolving a complaint, evidencing contractual performance or defending a legal claim.

The applicable limitation period and any ongoing dispute determine the duration of that further retention.

11.2. Accounting and tax records

Financial and accounting documents are retained for the periods required by applicable law.

Under the general Romanian accounting rule, relevant accounting registers and supporting documents are normally retained for five years calculated from 1 July of the year following the financial year in which they were prepared.

Where a transaction falls within an applicable VAT One Stop Shop scheme, the records required for that scheme are retained for ten years from the end of the year in which the transaction took place.

A specific legal obligation, investigation or dispute may require longer retention of particular records.

11.3. Marketing records

Contact information used for consent-based marketing is retained until you withdraw consent or the marketing purpose ends.

We may retain a limited record of your unsubscribe or objection to ensure that your preference continues to be respected.

Consent evidence may be retained where necessary to demonstrate compliance.

11.4. Technical information

Technical logs are retained according to their security or operational purpose and the time needed to investigate relevant incidents.

Cookie and similar-technology retention periods are described in the website’s applicable cookie information or preference interface.

When information is no longer needed, it is deleted or anonymised. Data retained for a legal obligation or dispute is restricted to that purpose.

12. Marketing preferences

You can withdraw consent to promotional communications at any time by:

Using the unsubscribe facility in the relevant message; or
Contacting info@digital-interaction.com.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You also have the right to object at any time to processing for direct marketing, including related profiling. Once you object, we stop processing your personal data for that purpose.

Unsubscribing from marketing does not stop necessary booking, access, payment, certificate, security or event-change communications.

13. Cookies and similar technologies

The website may use cookies or similar technologies for essential operation, preferences, measurement and advertising.

Technologies strictly necessary to provide a service you request may operate without consent where permitted by applicable law.

Optional analytics and advertising technologies requiring consent must remain inactive unless you choose to enable them.

You can change or withdraw the relevant choices through the website’s cookie-preference controls. Browser settings provide additional options, although blocking essential cookies may affect functionality.

Information about the technologies actually used, their purposes, providers and retention periods must be made available through the applicable cookie information or preference interface.

Accepting this Privacy Policy is not consent to optional cookies or advertising technologies.

14. Your data protection rights

Depending on the applicable law and circumstances, you may have the right to:

Access: obtain confirmation of processing and a copy of your personal data.
Rectification: correct inaccurate or incomplete information.
Erasure: request deletion where the legal conditions are met.
Restriction: request that processing be limited in specified circumstances.
Portability: receive relevant data in a structured, commonly used and machine-readable format where processing is automated and based on consent or a contract.
Objection: object to processing based on legitimate interests on grounds relating to your particular situation.
Object to direct marketing: require us to stop using your data for that purpose.
Withdraw consent: withdraw consent where it is the basis for processing.
Protection concerning automated decisions: exercise applicable rights concerning solely automated decisions that produce legal or similarly significant effects.
Complain: lodge a complaint with a competent supervisory authority.

These rights are subject to legal conditions. For example, a deletion request does not require us to erase information that must be retained to meet a legal obligation.

To exercise your rights, contact info@digital-interaction.com.

We may request proportionate information to verify your identity where necessary. We do not request more information than is needed for that purpose.

We respond without undue delay and normally within one calendar month, subject to the applicable rules on calculating that period.

Where legally permitted because of the complexity or number of requests, we may extend the response period by up to two further months. We will notify you within the initial period and explain the reason.

Requests are generally free of charge. A fee or refusal is possible only where the applicable legal conditions permit it.

15. Automated processing

Routine booking confirmations, access emails and certificate delivery may involve automated administrative processes.

Such automation does not, by itself, constitute a decision producing legal or similarly significant effects.

Payment providers may use automated fraud-detection and authentication systems under their own responsibilities and privacy notices.

Where an activity involves a solely automated decision subject to specific legal protections, the responsible controller must provide the required information and safeguards, including human intervention where applicable.

You can contact us if you believe an automated process has incorrectly affected your booking or access.

16. Security

We use technical and organisational measures appropriate to the risks of the processing.

These measures are intended to protect personal data against unauthorised access, unlawful disclosure, accidental loss, alteration or destruction.

Access is limited to personnel and service providers who need the information for their authorised responsibilities.

No transmission method or storage system can guarantee absolute security. Where a personal data breach occurs, we assess it and notify the competent authority and affected individuals where required by law.

17. Complaints and supervisory authorities

You can raise a privacy concern with us at info@digital-interaction.com.

You also have the right to complain to a competent supervisory authority.

In Romania, the authority is the National Supervisory Authority for Personal Data Processing — ANSPDCP:

www.dataprotection.ro

If you are in Germany or Poland, you may also contact the competent supervisory authority in your country, including:

Germany: the competent German federal or state data protection authority, depending on its jurisdiction.
Poland: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO), uodo.gov.pl/en.

Where UK data protection law applies, you may contact the Information Commissioner’s Office.

Your rights to seek a judicial remedy remain unaffected.

18. Changes to this Policy

We may update this Policy to reflect changes in webinar administration, service providers, processing activities or legal requirements.

The current version will be made available with its update date.

Where a material change affects how your personal data will be used, we will provide the additional information required by law before introducing that use.

Publication of an updated Policy does not, by itself, provide consent for a new processing activity that requires consent.

19. Contact

For questions about this Policy, information about our processing or requests concerning your personal data, contact: