The data controller responsible for processing your personal data is CMS PEOPLE EUROPE, S.L., with registered office at Aribau 253, Local 1 — 08021 Barcelona, Spain.
You can contact our data protection team at pdp@cmspeople.com for any query regarding this policy or to exercise your rights.
CMS People is a group with entities in Europe, Latin America, and Brazil that jointly organize financial industry conferences and share a single participant database. The three entities act as joint data controllers and have entered into an agreement allocating their respective obligations. Regardless of this allocation, you may exercise your rights against any of them using the contact details provided above.
This policy applies to websites, conference platforms, mobile applications, and registration forms operated by CMS People, specifically including: app.cmseventos.com, cmseventos.com, cmspeople.com, cmseurope.eu, premiobestperformance.com, openhubnews.com, and innovationfieldtrip.com.
Each event may have its own dedicated site; this same policy applies to all of them.
In most cases, because you provided it to us when registering for one of our events, requesting information, or participating as a speaker, moderator, or sponsor.
It is also possible that a third party registered you: your employer, a colleague, or a sponsor's secretary. When this occurs, we send you a registration confirmation together with this privacy policy and the option to object to the processing before the event takes place.
We never acquire third-party databases or obtain your data from unknown sources.
* Identification and professional data: full name, professional email address, company name, and job title. These are the only mandatory details required for registration.
* Additional contact details: personal email address and mobile phone number, provided strictly on a voluntary basis.
* Participation details: events attended, sessions, and your role as an attendee, speaker, moderator, or sponsor.
* Billing data: details required for invoice issuance and payment processing for paid events.
* Image and voice: if you attend an in-person event where photography or video recordings take place, pursuant to section 5.
* Technical data: IP address, session identifier, and browsing data, according to our Cookie Policy.
We do not process special categories of data. If you need to inform us of a medical condition, food allergy, or accessibility requirement to attend an event, such information will be processed solely for that purpose, retained until the end of the event, and securely deleted thereafter.
Each processing purpose relies on a specific legal base and retention period. Purposes marked as optional require your consent, which you may withdraw at any time without affecting your event participation.
| Purpose | Legal Base | Nature | Retention Period |
|---|---|---|---|
| Managing your registration: badge issuance, digital badge, access credentials, logistics communications, and program update notices | Execution of the contractual relationship arising from your registration | Mandatory for participation | Event duration + 3 years |
| Issuing invoices and complying with accounting and tax obligations | Legal obligation | Mandatory for paid events | Applicable statutory tax period |
| Sending information about upcoming conferences and industry insights | Your consent | Optional | Until consent withdrawal or 3 years without interaction |
| Transferring your name, company, job title, and professional email to event sponsors | Your specific consent | Optional | Until consent withdrawal |
| Allowing a sponsor to collect your contact details by scanning your badge at their booth | Your consent, expressed by voluntarily presenting your badge | Optional, your choice at each booth | Until consent withdrawal |
| Communicating with you via WhatsApp virtual assistant before and during the event | Your consent | Optional | Event duration + 6 months |
| Photographing and recording the event for promotional use and future edition marketing | Your consent for individual close-ups; legitimate interest for general room shots | Optional for individual close-ups | 5 years |
| Inviting you to participate as a speaker, moderator, or sponsor | Legitimate interest in business development | Action not required | Until you object |
| Ensuring platform security and preventing unauthorized access | Legitimate interest and, where applicable, legal obligation | Mandatory | Access logs: 12 months |
When relying on legitimate interest, we have conducted a balancing test between our interests and your rights, the results of which you may request at pdp@cmspeople.com. You may object to such processing activities at any time.
Service providers processing data on our behalf, bound by contract and prohibited from using your data for their own purposes:
| Provider | Service |
|---|---|
| Amazon Web Services | Database and platform hosting |
| Eventtia | Event management and attendee registration |
| Bitrix24 | Commercial customer relationship management |
| Intuit Mailchimp | Email marketing distribution |
| Google Ireland Ltd. | Corporate email, office suite, and web analytics |
| WhatsApp Ireland Ltd. (Meta) | Event virtual assistant |
| Metricool | Social media analytics |
Event sponsors: strictly upon your express consent. Transferred data is limited to full name, company, job title, and professional email address. The complete list of receiving sponsors appears on the registration form prior to your consent decision. Each sponsor becomes an independent controller and must provide you with its own privacy policy.
Other speakers and event management team, if participating as a speaker, solely to coordinate event logistics.
Public authorities, whenever legally required.
We do not sell your personal data or share it with third parties not listed in this section.
Our database is hosted on servers located in Spain, within the European Union. Your data does not leave the European Economic Area except for the providers specified in section 6.
Certain service providers process data in the United States. Such transfers take place under applicable adequacy frameworks or standard contractual clauses. Copies of these safeguards can be requested at pdp@cmspeople.com.
Specific retention timelines appear in the table in section 5. As a general rule, we retain your data for the duration of our relationship and for three years following your last interaction with us (such as event registration, opening an email, or sending a response). Upon expiration, your data is permanently erased or irreversibly anonymized.
Invoicing data is stored for statutory tax periods regardless of erasure requests.
Proof of consent and consent revocation is retained during processing and for three years thereafter solely to demonstrate compliance with your choices.
You may exercise the following rights at any time and free of charge:
To exercise your rights, email pdp@cmspeople.com or write to the postal address in section 1. We will respond within one month, extendable by up to two additional months for complex requests upon notice.
Identity verification: writing from your registered email address is sufficient. Identity documents will only be requested if reasonable doubts arise regarding the requester's identity, explaining the reasons. Identity copies are destroyed immediately after resolving the request.
If you believe your rights were not properly addressed, you may lodge a complaint with the competent supervisory authority:
| Country | Authority |
|---|---|
| Spain and rest of the European Union | Spanish Data Protection Agency (AEPD) — aepd.es — or the supervisory authority of your Member State |
For more information regarding your data protection rights, you can download the "Citizen's Guide" from the Spanish Data Protection Agency at aepd.es.
We implement technical and organizational measures appropriate to the risk: end-to-end encryption in transit and at rest, role-based access controls based on least privilege, multi-factor authentication for staff, access logging, encrypted backups, and periodic restoration tests.
In case of a security breach involving high risks to your rights, we will notify you without undue delay and inform competent supervisory authorities within statutory deadlines.
This is version 2.0, published in August 2026. We maintain historical versions and log which policy version was effective at the time of each registration.
