Privacy Policy
This policy explains what personal data ESSPD collects, why, and what rights you have. It applies to visitors to www.esspd.eu, to our members and nominees, to newsletter subscribers, to people who take part in our events, and to everyone who submits a profile or a project to our Research Collaboration Initiative.
If you are considering submitting an Expert by Experience profile, please read section 5 in particular. It explains what becomes public and what does not.
1. Who is responsible for your data
The controller is the European Society for the Study of Personality Disorders (ESSPD), an association established under Dutch law, registered with the Netherlands Chamber of Commerce under number 28102535, with its registered office at Da Costakade 45, 3521 VS Utrecht. Post can be sent to c/o Kenniscentrum Persoonlijkheidsstoornissen, Postbox 725, 3500 AS Utrecht, The Netherlands.
Please contact us on any data protection matter at info@esspd.eu.
ESSPD has not appointed a Data Protection Officer, as it is not required to do so. Enquiries are handled by the Board.
2. Visiting this website
Hosting and server logs. This website is built and maintained for us by an external web design company, which acts as our processor under a written agreement. Hosting is provided by Webba, Kapitein Nemostraat 20, 7821 AC Emmen (Chamber of Commerce number 55289762), as a subprocessor bound by the same obligations. The servers are in the Netherlands.
Each time a page is requested the server records your IP address, the page requested, the date and time, and your browser type. These logs keep the site running and secure, are kept for one month, and are not used to identify you or build a profile. Legal basis: legitimate interest in operating a secure and functioning website (Art. 6(1)(f) GDPR).
Fonts. Typefaces come from Bunny Fonts, operated by BunnyWay d.o.o. in Slovenia. It sets no cookies and states that it does not log or track visitors. No data leaves the EU for this purpose. Legal basis: legitimate interest in presenting the site correctly (Art. 6(1)(f) GDPR).
Embedded content. Some pages include content from other companies: videos from YouTube (Google Ireland Limited) on our Video Resources and Webinars pages, and our Bluesky feed (Bluesky Social PBC, United States) on the home page. Nothing is requested from either until you accept. If you do, they receive your IP address and can see which page you are viewing, and YouTube may set cookies. If you refuse, you see a placeholder instead. Legal basis: your consent (Art. 6(1)(a) GDPR).
Cookies and analytics. We use only what is needed to run the site and to remember your cookie choice, unless you consent to more. We use no analytics, no visitor tracking and no advertising. Full detail is in our Cookie Policy.
3. Members and nominees
What we hold. Your name, email address, postal or institutional address, work affiliation, professional interests and expertise in the field of personality disorders, and publicly available information about your publications and professional web pages. We also record the dates of your membership and, where applicable, why it ended.
Where it comes from. From you, when you apply or update your details; from the member who nominated you; and from public professional sources, used only to verify what we were given.
What we use it for. Administering your membership and ESSPD elections; sending you society communications about events, collaborations, appeals and newsletters; processing nominations; awarding prizes; and meeting the legal obligations of a Dutch association.
Legal basis. Administering your membership is necessary to perform the membership agreement (Art. 6(1)(b) GDPR). Keeping association and financial records is a legal obligation under Dutch law, including Articles 2:26 to 2:52 of the Dutch Civil Code (Art. 6(1)(c) GDPR). Communications about our scientific and educational objectives, as set out in our Articles of Association, rest on our legitimate interest as a scientific society (Art. 6(1)(f) GDPR). You can object to these communications at any time.
4. Newsletter
Sending. We use Smaily, operated by Sendsmaily OÜ in Estonia, which processes subscriber names and email addresses on our instructions under a data processing agreement. It records whether an email was delivered and opened and whether links were clicked, which tells us whether the newsletter is being read. Smaily is certified to ISO 27001 and hosts its sending infrastructure in the EU. Its subprocessor list is published at smaily.com/subprocessors; some of those companies are incorporated outside the EU even where the data stays in the EU.
Reading. Each issue is published as a Microsoft Sway page and the email links to it. Clicking that link opens a page hosted by Microsoft, which then decides for itself what it collects, under the Microsoft Privacy Statement. We receive only aggregate view counts. If you would rather not open a Microsoft-hosted page, past issues are available as PDFs in our Newsletter Archive.
Subscribing. Members receive the newsletter as part of membership. Anyone else is subscribed only on request. Either way you can unsubscribe at any time using the link in every issue or by writing to info@esspd.eu, and withdrawal does not affect anything sent beforehand.
Legal basis: performance of the membership agreement for members (Art. 6(1)(b) GDPR); consent for everyone else (Art. 6(1)(a) GDPR).
5. Research Collaboration Initiative
Please read this before submitting a profile.
Experts by Experience
Through our Expert by Experience form you give us your name or chosen identifier, an email address, your country of residence, your area of lived experience, your perspective, the areas you can contribute to, and your research interests.
Your area of lived experience is information about your health. Under Article 9 GDPR that is a special category of personal data with additional protection, and we process it only on the basis of your explicit consent, given on the submission form (Art. 9(2)(a) GDPR).
- Your identifier, lived experience, perspective, contribution areas and research interests are published on the public Experts by Experience dashboard after moderation, where anyone can read them and search engines may index them.
- Your email address is never published. It is stored on our server and used only by the ESSPD team to contact you about collaboration.
Because the profile is public you may use a pseudonym, and we encourage you to think carefully about how much detail to include. A published profile may be copied or cached by others beyond our control, and we cannot guarantee its removal from third-party archives after deletion.
You may withdraw consent at any time by emailing info@esspd.eu. We will remove your profile and delete your record. Withdrawal does not affect what was lawful beforehand. We review the dashboard periodically and will ask you to confirm you still wish to be listed.
Researchers submitting projects
Through the research project submission form we process your name, institutional details, email address and project description. The project is published on the public research dashboard so that Experts by Experience can contact you. Your email address is handled as you indicate on the form. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time by writing to info@esspd.eu.
Both forms are hosted on our own website and submissions are stored in our own database, not routed through an external form service. They set no tracking cookies.
6. Events, workshops and congresses
Some events, including the Borderline Congress, are organised with partner organisations or professional congress organisers. Where a partner runs registration, they handle your data under their own privacy policy.
Where ESSPD handles participation directly, we process your name, contact details, affiliation and anything you tell us about dietary or accessibility needs, in order to run the event. Where our members are entitled to reduced fees at an event we do not organise, we share only the minimum needed to confirm eligibility.
Photography and recording. We take photographs at our events, and sometimes record sessions, to report on them in our newsletter, on this website and on our social media accounts. We tell you before the event and again when you arrive, and set out the practical arrangements for each event.
If you would prefer not to be photographed, tell us when you register or at the registration desk. You can also ask us at any time to remove a published photograph of you, and we will. Speakers are told in advance if their session will be photographed or recorded.
Where a photograph could identify someone as having lived experience of a personality disorder, we ask that person individually beforehand. That consent is explicit and can be withdrawn (Art. 9(2)(a) GDPR).
Separately from the GDPR, Dutch portrait law may also give you a right to object to publication of a recognisable image of you.
Legal basis: performance of a contract or of the membership agreement (Art. 6(1)(b) GDPR), and our legitimate interest in running and documenting scientific meetings (Art. 6(1)(f) GDPR), except where explicit consent is required as above.
7. Correspondence
If you write to us we keep your message and our reply. Retention depends on the kind of correspondence and is set out in section 10. Legal basis: legitimate interest in handling enquiries and keeping proper records of the association (Art. 6(1)(f) GDPR), and legal obligation where the law requires retention (Art. 6(1)(c) GDPR).
8. Who we share data with
We share as little as possible, and only with:
- the company that builds and maintains this website, and Webba as its hosting subprocessor
- Sendsmaily OÜ, trading as Smaily, which sends the newsletter
- Microsoft, which hosts each newsletter issue as a Sway page. Microsoft is an independent controller for what it collects from readers, not our processor
- congress and event partners, who receive contact details in order to inform participants about those events
- organisers of third-party events, only where ESSPD members are eligible for reduced fees
- professional advisers and authorities, where we are legally required to disclose
All act as our processors under written agreements, except where they are independent controllers, in which case we say so. We do not sell personal data and we do not share it for advertising. If we ever decide to share your data in a way not described here, we will tell you or ask your consent first.
9. Transfers outside the EEA
We aim to keep data within the European Economic Area, and our two main providers, Webba and Smaily, both operate from within the EU. Where data does reach a country outside the EEA we rely on a European Commission adequacy decision or on Standard Contractual Clauses. This arises when you accept a YouTube video or our Bluesky feed, when you open a newsletter issue hosted by Microsoft, and through some of Smaily’s subprocessors.
You can ask us for details of the safeguards in place at any time.
10. How long we keep data
| Data | Kept for |
|---|---|
| Server logs | 1 month |
| Membership records, full | The duration of your membership |
| Name, dates of membership and reason for ending it | As long as ESSPD exists, as part of the society’s record |
| Financial and administrative records | 7 years, as required by Dutch law |
| Newsletter subscription, non-members | Until you unsubscribe |
| Expert by Experience profile | Until you withdraw consent, or the Initiative ends |
| Research project submission | Until you ask us to remove it, or the project concludes |
| Event photographs and recordings | While they remain relevant to the society’s record, and removed on request |
| Correspondence, general enquiries | Up to 2 years after the matter is closed |
| Correspondence forming part of the society’s records | As long as ESSPD exists |
| Correspondence with financial or tax significance | 7 years |
| Cookie consent record | See the Cookie Policy |
11. Your rights
Under the GDPR you have the right to access the data we hold about you and receive a copy, rectify anything inaccurate, erase data we no longer have a valid reason to keep, restrict processing while a dispute is resolved, object to processing based on legitimate interest, including any use for communications, which we will always stop on request, receive your data in a portable form, and withdraw consent at any time where processing rests on consent.
Write to info@esspd.eu to exercise any of these. We respond within one month and may first ask you to confirm your identity. This is free of charge.
We do not make decisions about you by automated means and we do not carry out profiling.
Please tell us when your affiliation or contact details change.
12. Security
Access to member data is limited to Board members who need it for their role, and the website is served over an encrypted connection. The company that maintains the website, and its hosting provider, have technical access, but are required to keep the data confidential, secure it appropriately, and use it only on our instructions.
13. Complaints
If you are unhappy with how we handle your data, please contact us first at info@esspd.eu so we can try to put it right.
You also have the right to complain to a supervisory authority. Ours is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. You may also complain to the authority in the EU country where you live or work.
14. Changes to this policy
We review this policy when our processing changes and at least every two years. Material changes are announced in the newsletter.
Last updated: 1 August 2026