DATA PROTECTION INFORMATION – Application and Exams

acc. with to Regulation (EU) 2016/679 GDPR) and applicable Austrian data protection law
Last updated: July 2026

1. General Information

Vereinigung zur Abhaltung der European Board Examination ORL-HNS(the “Association”) processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), the Austrian Data Protection Act (Datenschutzgesetz – “DSG”) and other applicable data protection legislation.

This Data Protection Information explains how the Association processes personal data in connection with applications for admission to its examination programme, registration for and participation in Part I and Part II examinations, examination administration, related organisational activities and the administration of Fellow status. The Association processes personal data in accordance with the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

2. Controller

The controller responsible for the processing of personal data is:

Vereinigung zur Abhaltung der European Board Examination ORL-HNS
c/o WMA GmbH, Alser Strasse 4
1090 Vienna, Austria
Email: ebeorl-hns@ebeorl-hns.org
Website: ebeorl-hns.org

Data Protection Officer: Simone Hager (WMA GmbH)

The Association has appointed:

Wiener Medizinische Akademie GmbH (WMA GmbH)
Alser Strasse 4, 1090 Vienna, Austria

to provide back-office, registration and administrative services on behalf of the Association.

Where the WMA GmbH processes personal data solely on behalf of and according to the documented instructions of the Association, the PCO acts as a processor pursuant to Art. 4(8) GDPR. The Association remains the controller for the relevant processing activities. The Association has concluded an appropriate data processing agreement with the WMA GmbH acc.  to Art. 28 GDPR. The WMA GmbH and its personnel may process personal data only to the extent necessary for the contracted administrative and organisational services and are subject to applicable confidentiality and data protection obligations. The WMA GmbH may not use personal data processed on behalf of the Association for its own purposes unless a separate legal basis exists for such processing.

3. Categories of Personal Data

Depending on the relevant processing activity, the Association may process the following categories of personal data:

  • name and contact details;
  • address and invoicing information;
  • professional and educational information;
  • documents and information submitted as part of the application;
  • admission and eligibility information;
  • examination registration information;
  • candidate identification numbers;
  • examination results;
  • information concerning participation in Part I and Part II;
  • waiting-list and place-allocation information;
  • payment and accounting information;
  • photographs and video recordings;
  • audio and video data generated during remote examination supervision;
  • technical and usage information required for online examination administration; and
  • information necessary to document Fellow status.

Special categories of personal data pursuant to Art. 9 GDPR will only be processed where this is necessary and where an applicable legal basis under Art. 9(2) GDPR exists. The Association aims to limit the collection and processing of personal data to what is necessary for the respective purpose.

4. Purposes of Processing and Legal Bases

4.1. Application and Admission

Personal data submitted in connection with an application are processed for:

  • receiving and administering the application;
  • assessing whether the applicable admission requirements are fulfilled;
  • documenting the admission decision;
  • communicating with the applicant; and
  • administering the applicant’s future eligibility to participate in Part I.

The legal basis is the applicable legal basis under Art. 6 GDPR, in particular Art. 6(1)(b) GDPR where processing is necessary in connection with the examination arrangement requested by the applicant, or Art. 6(1)(f) GDPR where processing is necessary for the Association’s legitimate interests in administering its examination programme.

The exact legal basis applied to each processing activity will be documented by the Association.

4.2. Examination Administration

Personal data are processed for the administration of Part I and Part II, including:

  • registration;
  • eligibility checks;
  • examination administration;
  • communication concerning examinations;
  • documentation of participation;
  • recording and documenting examination results; and
  • administration of subsequent eligibility.

The legal basis is Art. 6(1)(b) GDPR where applicable and/or Art. 6(1)(f) GDPR where necessary for the legitimate interests of the Association in administering, securing and documenting its examination programme.

4.3. Part I – UCAN and Remote Examination Supervision

Part I is conducted using the UCAN examination platform.

In addition, candidates participate in a Zoom video conference for examination supervision. Camera and microphone use are required during the examination in accordance with the Examination Regulations.

Candidates use their candidate identification number in the Zoom examination session.

The Association processes the candidate number, image, voice and related examination-supervision information for the purposes of:

  • verifying participation;
  • supervising the examination;
  • maintaining examination integrity;
  • documenting examination incidents; and
  • reviewing examination-related complaints or objections where applicable.

The identity of the candidate corresponding to a candidate number is maintained separately and is accessible only to authorised persons within the Association, in particular authorised members of the Board.

The examination process is therefore pseudonymised, but not anonymous in the strict legal sense.

4.4. Recording of the Part I Examination

The Zoom session used for Part I may be recorded locally by an authorised examination supervisor.

The Association does not intend to use Zoom cloud recording for this purpose.

The recording may contain:

  • the candidate identification number;
  • the candidate’s image;
  • the candidate’s voice;
  • communications with examination supervisors; and
  • information visible or audible during the examination.

The recording is used only where necessary for:

  • documentation of the examination procedure;
  • examination integrity;
  • investigation of suspected examination irregularities;
  • review of examination-related objections or complaints; and
  • establishment, exercise or defence of legal claims.

The recording is not used for marketing, advertising or unrelated purposes.

The legal basis for the recording will be the applicable legal basis under Art. 6 GDPR, in particular Art. 6(1)(f) GDPR where necessary for the legitimate interests of the Association in protecting examination integrity and documenting examination-related incidents.

Where special categories of personal data are incidentally captured in a recording, the Association will ensure that an applicable legal basis under Art. 9 GDPR exists where such processing is not avoidable.

4.5. Part II and Allocation of Examination Places

Personal data are processed for the administration of Part II, including eligibility checks and the allocation of examination places.

Because the number of available Part II places may be limited, eligible candidates may be placed on a waiting list and may receive a place in a subsequent examination year.

The Association therefore processes the information necessary to administer:

  • Part II eligibility;
  • registrations;
  • waiting lists;
  • allocation of available places; and
  • participation in subsequent examination sessions.

The legal basis is the applicable legal basis under Art. 6 GDPR, in particular Art. 6(1)(b) and/or Art. 6(1)(f) GDPR as applicable.

4.6. Accounting and Payments

The Association processes personal data for:

  • registration and examination fees;
  • invoicing;
  • payment processing;
  • accounting; and
  • compliance with statutory financial and tax obligations.

The legal basis is Art. 6(1)(c) GDPR where processing is necessary to comply with a legal obligation and/or another applicable legal basis under Art. 6 GDPR.

4.7. Communication

The Association processes contact details to communicate information necessary for the administration of applications, examinations and related activities.

Such communications may include:

  • application-related communications;
  • examination dates and deadlines;
  • organisational information;
  • examination results;
  • requests for additional information; and
  • other communications necessary for administration.

The legal basis depends on the specific communication and may be Art. 6(1)(b), Art. 6(1)(c) or Art. 6(1)(f) GDPR, as applicable.

4.8. Photographs

Photographs may be taken during Part II and related events for purposes such as:

  • event documentation;
  • reporting;
  • communication about Association activities; and
  • promotion of future related activities.

The Association will use an appropriate legal basis for the relevant photography and subsequent publication. Participants who do not wish to be identifiable in photographs or videos intended for publication may notify the Association in advance at: ebeorl-hns@ebeorl-hns.org

The Association will take reasonable steps, where practicable, to respect such requests when selecting material for publication. Where an individual is specifically selected or prominently featured for promotional purposes, the Association will ensure that an appropriate legal basis exists for such use.

4.9. Publication of Board Members

The Association may publish the names and functions of Board Members on its website for the purpose of providing transparent information about the Association and its governing bodies.

Where applicable, the Association may also publish photographs of Board Members.

The legal basis for publication will be determined according to the specific circumstances, including Art. 6(1)(f) GDPR where the legitimate-interest requirements are met or Art. 6(1)(a) GDPR where consent is used.

4.10. Publication of Fellows

Successful candidates may be granted Fellow status in accordance with the applicable Examination Regulations. Publication of a Fellow’s name and Fellow year on the Association’s website is a separate processing activity from examination administration.

The Association will therefore obtain separate and voluntary consent before publishing the person’s name and Fellow year.

Consent to publication is not a prerequisite for:

  • application;
  • admission;
  • participation in Part I;
  • participation in Part II;
  • examination success; or
  • obtaining Fellow status.

Consent may be withdrawn at any time. Following withdrawal of consent, the published information will be removed within a reasonable period, subject to applicable technical and legal limitations.

The internal record of Fellow status may nevertheless be retained where necessary for the administration and documentation of the Association’s examination programme or where another legal basis applies.

5. Recipients of Personal Data

Personal data are disclosed only where necessary for the respective purpose and where a valid legal basis exists. Depending on the processing activity, recipients may include:

  • authorised persons of the Association;
  • authorised members of the Board;
  • authorised examination personnel;
  • the WMA GmbH acting as processor;
  • UCAN, Zoom  and relevant technical service providers;
  • payment service providers and banks;
  • accountants, tax advisers and auditors;
  • competent public authorities where legally required; and
  • service providers acting on behalf of the Association.

Recipients receive only the data necessary for their respective task and do not receive the complete data record unless this is necessary and legally permitted.

6. Candidate Identification and Access Restrictions

The Association uses candidate identification numbers in the examination process.

The identity of a candidate and the corresponding candidate identification number are maintained separately. Access to the information linking a candidate’s identity to the candidate number is restricted to authorised persons of the Association, in particular authorised Board members, where necessary for examination administration.

The purpose of this separation is to minimise unnecessary access to identifying information and to support the integrity and impartiality of the examination process.

7. International Data Transfers

The Association itself does not intentionally transfer personal data outside the European Union/European Economic Area.

Where the Association or a service provider acting on its behalf transfers personal data to a third country, the requirements of Chapter V GDPR must be complied with.

Depending on the circumstances, transfers may be based on:

  • an adequacy decision pursuant to Art. 45 GDPR;
  • appropriate safeguards pursuant to Art. 46 GDPR; or
  • another applicable mechanism under Chapter V GDPR.

The Association will assess the relevant contractual and technical arrangements of external service providers used in the examination process.

8. Data Retention

Personal data are retained only for as long as necessary for the purposes for which they are processed, taking into account applicable statutory retention obligations and the requirements of the examination programme.

8.1. Application Documents

Supporting documents submitted as part of the initial application are retained only for the period necessary to assess and document the application and to address related queries, complaints or disputes. Unless a longer retention period is required by law, the original application documents will be deleted no later than 12 months after the admission decision has become final.

The Association will retain only the minimum information necessary to document the approved admission status and administer future eligibility for Part I.

If documents originally submitted with an application are required again at a later stage, the candidate may be asked to provide them again.

8.2. Admission Status

The Association may retain the minimum information necessary to document an approved admission status for as long as that status remains relevant to the administration of the examination programme.

This does not require retention of the original supporting documents.

8.3. Part I Examination Records

Information concerning Part I registration and examination results is retained for as long as necessary to document the examination history and administer subsequent eligibility.

The relevant Part I result must be available for the purpose of determining eligibility for Part II within the applicable five-year period.

8.4. Part II Registration and Waiting Lists

Information concerning Part II registration, eligibility and allocation of examination places is retained for as long as necessary to administer participation and waiting-list processes.

8.5. Examination Recordings

Part I examination recordings are retained only for as long as necessary for examination administration, examination review and the handling of examination-related objections, complaints or legal matters. The applicable examination objection procedure and deadline are governed by the Examination Regulations. The Association will establish a specific retention period for examination recordings in accordance with the principle of storage limitation under Art. 5(1)(e) GDPR.

Where an objection, investigation or legal matter is pending, the relevant recording may be retained for as long as necessary to resolve the matter and, where applicable, for the establishment, exercise or defence of legal claims.

Once the relevant purpose has ended and no legal or statutory retention requirement applies, the recording will be deleted without undue delay.

8.6. Accounting and Statutory Records

Personal data contained in accounting, invoicing and other records subject to statutory retention obligations are retained for the period required by applicable Austrian law.

Where applicable, statutory tax and accounting retention periods will be observed.

8.7. Photographs and Publications

Published photographs and other material are retained for as long as there is a valid legal basis for their publication.

Where publication is based solely on consent and consent is withdrawn, the Association will remove the relevant material within a reasonable period, subject to applicable legal and technical limitations.

9. Data Subject Rights

Subject to the applicable legal requirements and limitations, data subjects have the following rights under the GDPR:

  • right of access pursuant to Art. 15 GDPR;
  • right to rectification pursuant to Art. 16 GDPR;
  • right to erasure pursuant to Art. 17 GDPR;
  • right to restriction of processing pursuant to Art. 18 GDPR;
  • right to data portability pursuant to Art. 20 GDPR;
  • right to object pursuant to Art. 21 GDPR; and
  • rights concerning automated individual decision-making pursuant to Art. 22 GDPR, where applicable.

Requests concerning data protection rights may be submitted to:

Vereinigung zur Abhaltung der European Board Examination ORL-HNS

c/o WMA GMBH, Alser Strasse 4, 1090 Vienna, Austria
ebeorl-hns@ebeorl-hns.org

10.  Withdrawal of Consent

Where processing is based on consent, the data subject may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Withdrawal of consent shall be as easy as giving consent.

Where consent is withdrawn, processing based solely on that consent will cease and the relevant data will be deleted where there is no other legal basis or statutory obligation requiring continued processing.

11. Right to Object

Where personal data are processed on the basis of Art. 6(1)(e) or Art. 6(1)(f) GDPR, the data subject has the right to object to such processing in accordance with Art. 21 GDPR.

The Association will assess the objection in accordance with the applicable legal requirements.