Privacy notice for structuralheartdiseasecoalition.eu
1. Controller and contact
This website is operated by RPP Group SRL, Rue Guimard 10, 1040 Brussels, Belgium, which acts as secretariat of the EU Structural Heart Disease Coalition (SHD Coalition). RPP Group SRL is the controller within the meaning of Article 4(7) of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). For any question about personal data on this website, contact Francesco Santarossa, RPP Group, at f.santarossa(at)rpp-group.com. The general provisions on how RPP Group handles personal data, including the full list of your rights and how to complain, are set out in the RPP Group privacy policy at rpp-group.com/privacy-policy. This notice covers what is specific to this website, in line with Article 13 GDPR.
2. Data processed when you visit the site
When you open a page, the server and Cloudflare, which protects and speeds up the site, record technical data: your IP address, browser type, the pages requested and the time of the request. Security software also records the IP addresses of blocked requests and of failed login attempts. We process this data to run the site securely and to defend it against attacks and abuse, on the basis of Article 6(1)(f) GDPR (legitimate interest). Server logs are kept for up to 90 days; Cloudflare security logs for 31 days and Wordfence security logs for 30 days, unless needed to investigate a security incident.
3. Cookies
The site sets one cookie of its own, which stores your cookie choices for twelve months. Cloudflare may set a short-lived security cookie (__cf_bm, 30 minutes) that is needed to protect the site. No advertising or social media cookies are set. Statistics cookies are set only if you accept them; see section 4. You can change your choices at any time through “Change privacy settings” at the bottom of every page. The cookie banner (Real Cookie Banner) keeps a record of your consent on our server so that we can demonstrate it, as Article 7(1) GDPR requires. If you accept the map on the Contact page, Google may set its own cookies inside the map; see section 5.
4. Statistics
With your consent (Article 6(1)(a) GDPR) we use Google Analytics 4 to measure how the site is used: pages visited, approximate location, device and browser type. It runs only after you accept statistics in the cookie banner and sets the cookies _ga and _ga_*, which last 24 months. Reports are aggregated and do not identify you. Google Analytics is provided by Google Ireland Limited; Google may transfer data to the United States under the EU-US Data Privacy Framework. You can withdraw your consent at any time through “Change privacy settings”.
5. Content from other providers
The site’s typefaces are loaded from Adobe Fonts. When your browser fetches them, Adobe receives your IP address. We rely on Article 6(1)(f) GDPR, our legitimate interest in displaying the site in its typeface; Adobe Fonts is provided by Adobe Systems Software Ireland Limited, and Adobe may transfer data to the United States under the EU-US Data Privacy Framework. The map on the Contact page comes from Google Maps and loads only after you accept it in the cookie banner (Article 6(1)(a) GDPR, consent). The newsletter page links to past issues hosted by Mailchimp; those pages are outside this website and subject to Mailchimp’s own privacy notice.
6. When you contact us
If you write to [email protected], we use your name, email address and message to answer you, on the basis of Article 6(1)(f) GDPR or, where you ask us to take steps, Article 6(1)(b). Apart from the newsletter sign-up form described in section 6.1, the site has no forms and no user accounts.
6.1 Newsletter sign-up
If you sign up to the SHD Coalition newsletter using the form on this website, we collect your email address and, if you provide them, your name and organisation, together with the date and time of your request and a record that you ticked the consent box.
We use this information only to add you to the newsletter mailing list and to send you the newsletter. The legal basis is your consent (Article 6(1)(a) GDPR).
Your request is stored on this website’s server and sent by email to the SHD Coalition Secretariat at RPP Group, which then adds you to the mailing list manually. You will receive an email confirming your request.
The newsletter is sent using Mailchimp, a service of The Rocket Science Group LLC (Intuit Inc.), United States, which acts as our processor under Article 28 GDPR. Mailchimp may transfer data to the United States under the EU-US Data Privacy Framework.
We delete your request from this website once you have been added to the mailing list, and at the latest after 90 days. Your details remain on the mailing list until you unsubscribe. We keep a record of your consent for as long as you are subscribed, so that we can show that you agreed.
You can withdraw your consent at any time by using the unsubscribe link in every newsletter, or by writing to the contact address in section 1. Withdrawing your consent does not affect newsletters sent before you withdrew it.
7. Where data is stored and who receives it
The website is hosted on a server in Germany, within the European Union, managed by RPP Group’s IT team. Cloudflare Inc. processes traffic as a processor under Article 28 GDPR, on its data processing terms for EU customers. The companies that are members of the SHD Coalition do not receive personal data from this website. Google Analytics and the map on the Contact page are provided by Google Ireland Limited, and the typefaces by Adobe, as described in sections 4 and 5.
Newsletter sign-ups are stored on this website’s server and sent to the Secretariat’s mailbox at RPP Group. Subscribers’ details are held in Mailchimp (see section 6.1).
8. Your rights
Under Articles 15 to 21 GDPR you may ask for access to your data, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time (Article 7(3)). To exercise these rights, write to f.santarossa(at)rpp-group.com. You may also lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be), as provided by Article 77 GDPR.
Version 2, October 2026.