privacy-policy

EuPMA - European Product Management Association

EuPMA is part of Open Innovation s.a.s.

For information or contacts: info@eupma.eu

European

Product

Management

Association

Governance

We drive the future of Product Management in Europe

Last updated: 2 August 2026

1. Introduction

The European Product Management Association (“EuPMA”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and protect personal data when you:

visit the EuPMA website;

submit a membership application;

subscribe to our newsletter or communications;

otherwise interact with EuPMA.

This Privacy Policy applies to the website www.eupma.eu and to the activities described below.

2. Data Controller

The data controller responsible for the processing of your personal data is:

Legal entity: Open Innovation s.a.s. di Scabbia Maurizio & C.
Registered office: via Marezzane 26a, 35027 Noventa Padovana (PD) - Italia
Tax or registration number: P.IVA 04288560289
Email: privacy@eupma.eu

At present, EuPMA has not appointed a Data Protection Officer.

3. Personal Data We May Collect

Depending on how you use the website and interact with EuPMA, we may collect the following categories of personal data.

3.1 Information provided through the membership form

This may include:

first and last name;
email address;
country;
job title or professional role;
company, organisation or university;
professional background;
involvement or interest in product management;
areas of interest within the EuPMA community;
LinkedIn profile or other professional profile, where voluntarily provided;
acceptance of the Membership Terms;
newsletter and communication preferences.

Please do not provide special categories of personal data, such as information concerning health, political opinions, religious beliefs, trade union membership, sexual orientation or biometric data.

3.2 Information provided when contacting us

When you contact EuPMA, we may process:

your name;
your email address;
the organisation you represent;
the content of your request;
any other information you voluntarily provide.

3.3 Event, laboratory and working-group information

When you register for or participate in EuPMA activities, we may collect:

registration and attendance information;
professional role and organisation;
areas of expertise or interest;
contributions, feedback and survey responses;
audio, video or images, but only where participants have been appropriately informed and where a valid legal basis exists.

3.4 Newsletter information

When you subscribe to our newsletter, we may process:

your name;
your email address;
subscription date and status;
evidence of consent;
communication preferences;
limited technical information concerning delivery or interaction with messages, where such features are enabled and legally permitted.

3.5 Technical and browsing information

When you visit the website, certain technical information may be collected automatically, including:

IP address;
device and browser information;
operating system;
date and time of access;
pages visited;
referring website;
technical logs;
cookie identifiers and similar technologies, where used.

Further information is provided in the section on cookies and tracking technologies.

4. Purposes and Legal Bases for Processing

We process personal data only where we have a valid legal basis.

4.1 Membership applications and membership management

We process the information submitted through the membership form in order to:

assess whether an applicant meets the EuPMA membership requirements;
review and respond to membership applications;
create and manage membership records;
communicate with members about their membership;
enable participation in community activities;
administer laboratories, working groups and other member initiatives.

The legal basis is the performance of measures taken at your request before entering into a membership relationship and the management of that relationship.

Certain processing may also be based on EuPMA’s legitimate interest in maintaining a relevant, professional and trustworthy product management community.

Providing the information identified as mandatory is necessary to process your application. If you do not provide it, we may be unable to assess or approve your membership request.

4.2 Responding to enquiries

We process personal data to answer requests submitted through contact forms, email or other communication channels.

The legal basis is taking steps at your request and, where applicable, our legitimate interest in responding to enquiries and managing EuPMA’s relationships with members, partners and other interested parties.

4.3 Organisation of laboratories, webinars, events and working groups

We may process personal data to:

manage registrations and attendance;
communicate organisational information;
provide access to online sessions;
facilitate collaboration between participants;
collect feedback;
prepare materials and follow-up activities.

The legal basis may be the performance of the membership relationship, taking steps at your request or EuPMA’s legitimate interest in organising and improving its activities.

Where participation is subject to separate terms, those terms may provide additional information.

4.4 Newsletter and promotional communications

We send newsletters, event invitations and promotional communications by email only where you have provided your consent or where another legal basis expressly permitted by law applies.

Subscription to the newsletter is optional and is not a condition of EuPMA membership.

You may withdraw your consent at any time by:

using the unsubscribe link included in each communication; or

contacting us at privacy@eupma.eu

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.5 Essential service communications

We may send members communications that are necessary to administer their membership, such as:

confirmation or rejection of an application;
changes to membership conditions;
security or privacy notices;
information required to participate in registered activities;
important administrative communications.

These messages are not promotional communications and may be necessary for the management of the membership relationship.

4.6 Professional recognition and member visibility

EuPMA may offer opportunities for members to be recognised as part of the product management community.

We will not publish your name, photograph, professional profile, company, biography or other personal information in a public member directory without first informing you and identifying an appropriate legal basis.

Where publication is optional, we will request your specific consent. You may withdraw that consent at any time, although removal from search engines or third-party websites may not be immediate.

4.7 Website security and administration

We may process technical data and logs to:

operate and maintain the website;
prevent fraud, misuse and unauthorised access;
diagnose technical problems;
maintain network and information security;
establish, exercise or defend legal claims.

The legal basis is our legitimate interest in ensuring the security, integrity and proper operation of the website and our services, as well as compliance with applicable legal obligations.

4.8 Compliance with legal obligations

We may process and retain personal data where necessary to:

comply with legal, accounting or regulatory obligations;
respond to lawful requests from public authorities;
establish, exercise or defend legal claims;
investigate possible breaches of our rules or applicable law.

The legal basis is compliance with a legal obligation or our legitimate interest in protecting EuPMA’s rights.

5. Legitimate Interests

Where processing is based on legitimate interests, we assess whether those interests are necessary and proportionate and whether they are overridden by your rights and freedoms.

Our legitimate interests may include:

operating and protecting the EuPMA website;
responding to professional enquiries;
maintaining a genuine and relevant professional community;
preventing misuse or fraudulent applications;
improving our activities and services;
managing relationships with members, contributors and partners;
protecting EuPMA’s legal rights.

You may object to processing based on legitimate interests in the circumstances described in Section 12.

6. How We Collect Personal Data

We may collect personal data:

directly from you when you complete a form, contact us or participate in an activity;
through the website and its technical infrastructure;
from service providers used to operate the website or organise activities;
from publicly available professional sources, such as a LinkedIn profile that you have provided to us, where verification is reasonably necessary for a membership application;
from another person or organisation that registers you for an activity, where legally permitted.

Where we receive your personal data indirectly, we will provide the information required by applicable law unless an exemption applies.

7. Membership Verification

EuPMA may review the information provided in a membership application to determine whether the applicant has a credible professional, educational or developmental connection with product management or with the definition, development or management of products and services.

Verification may include:

confirming the email address provided;
reviewing the professional role and organisation indicated in the form;
reviewing the applicant’s description of their involvement in product management;
consulting a professional profile voluntarily provided by the applicant;
requesting additional information where the application is incomplete or unclear.

EuPMA does not normally make membership decisions solely through automated processing. Applications are reviewed using human judgement.

8. Data Sharing and Recipients

Personal data may be accessed or processed by:

authorised EuPMA representatives and collaborators;
website hosting and technology providers;
Aruba S.p.A. or other providers involved in hosting and operating the website;
email and newsletter service providers;
video-conferencing and online-event providers;
cloud storage and collaboration providers;
IT support and cybersecurity providers;
professional advisers, such as legal or accounting advisers;
public authorities, courts or law-enforcement bodies where required by law.
Service providers that process personal data on our behalf are required to act according to our instructions, protect the information and comply with applicable data-protection requirements.

A complete and updated list of data processors may be requested by contacting privacy@eupma.eu.

We do not sell personal data.

9. International Data Transfers

Where possible, personal data is processed within the European Economic Area.

Some technology, email, cloud, analytics, event or communication providers may process personal data in countries outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, EuPMA will ensure that an appropriate transfer mechanism is in place, such as:

an adequacy decision adopted by the European Commission;
Standard Contractual Clauses approved by the European Commission;
additional technical and organisational safeguards, where required;
another transfer mechanism permitted by the GDPR.

Information about the applicable safeguards may be requested by contacting privacy@eupma.eu.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal requirements.

Unless a different period is necessary, we generally apply the following criteria:

unsuccessful or incomplete membership applications: retained for up to12 months after the final decision or last interaction;
approved membership records: retained for the duration of membership and for up to 10 years afterwards where necessary for administrative, legal or accounting purposes;
contact requests: retained for the time necessary to respond and normally for no longer than 24 months, unless a longer period is justified;
newsletter data: retained until consent is withdrawn or the subscription is otherwise terminated, with evidence of consent retained where necessary to demonstrate compliance;
event and laboratory registration data: retained for the duration of the activity and normally for up to 24 months, unless required for membership administration or legal purposes;
technical and security logs: retained for the period necessary to ensure security and investigate incidents, normally no longer than 12 months, unless a longer period is required following a security event;
accounting and legally required records: retained for the period required by applicable law.

At the end of the applicable retention period, personal data will be deleted, anonymised or securely archived where continued retention is legally required.

11. Cookies and Similar Technologies

The EuPMA website uses only technical cookies provided through the Aruba SuperSite platform.

These cookies are strictly necessary for the proper operation, security and delivery of the website and may be used to:

enable essential website functions;
maintain the security and stability of the website;
manage forms and user sessions;
remember technical preferences;
ensure the correct display and operation of website pages.

Technical cookies are not used for advertising, profiling or tracking users for marketing purposes.

Because these cookies are strictly necessary to provide the website and its services, information about their use is provided through this Privacy Policy.

The website does not use profiling or advertising analytics cookies.

Users may configure their browser to block or delete cookies. However, disabling technical cookies may prevent some parts of the website from functioning correctly.

Technical cookies may be placed and managed by Aruba S.p.A., which provides the hosting and SuperSite platform used to operate the EuPMA website. Further information about Aruba’s processing activities is available in Aruba’s own privacy and cookie information.

12. Your Data-Protection Rights

Subject to the conditions and limitations established by applicable law, you have the right to:

obtain confirmation as to whether we process your personal data;
access your personal data and receive a copy;
request correction of inaccurate or incomplete data;
request deletion of your personal data;
request restriction of processing;
object to processing based on legitimate interests;
object at any time to direct marketing;
receive personal data you provided in a structured, commonly used and machine-readable format, where the right to data portability applies;
withdraw consent at any time where processing is based on consent;
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where legally permitted;
lodge a complaint with a competent supervisory authority.

To exercise your rights, contact: privacy@eupma.eu

We may request information necessary to verify your identity before responding. We will respond within the period required by applicable law.

13. Right to Lodge a Complaint

You have the right to lodge a complaint with the data-protection supervisory authority in the EU or EEA country where you live, work or where the alleged infringement occurred.

EuPMA is established in Italy, the relevant supervisory authority is:

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Rome, Italy

You are encouraged to contact us first so that we can attempt to address your concerns, but doing so does not affect your right to contact the supervisory authority.

14. Security

We implement appropriate technical and organisational measures designed to protect personal data against:

unauthorised or unlawful access;
accidental loss;
alteration;
disclosure;
destruction;
misuse.

Measures may include access controls, authentication procedures, secure hosting, backups, software updates, encryption where appropriate and limitations on access to personal data.

No internet transmission or storage system can be guaranteed to be completely secure. Where a personal-data breach occurs, we will assess and manage it in accordance with applicable legal requirements.

15. Children’s Privacy

EuPMA’s website and professional community are not intended for children.

Membership is normally intended for persons aged 18 or over. Students under the age of 18 should not submit a membership application or provide personal data without appropriate authorisation from a parent, legal guardian or educational institution, where required by applicable law.

We do not knowingly collect personal data from children through the website. If you believe that a child has provided us with personal data inappropriately, please contact privacy@eupma.eu.

16. Photographs and Recordings

EuPMA activities may occasionally be photographed or recorded.

Before making identifiable photographs, audio recordings or video recordings, EuPMA will provide appropriate information about:

the purpose of the recording;
how the material will be used;
whether it will be published;
the applicable legal basis;
how participants may raise objections or avoid being recorded, where applicable.

Where consent is required, participation in unrelated EuPMA services will not be made conditional on unnecessary consent to promotional recording or publication.

17. Contributions to Working Groups

Participants in EuPMA working groups may contribute ideas, documents, comments or professional materials.

Participants should avoid including unnecessary personal data about themselves or third parties in shared documents or discussions.

Where EuPMA intends to publish a contribution together with the contributor’s name, professional profile or organisation, participants will be informed in advance and an appropriate legal basis will be identified.

18. External Links and Third-Party Services

The website may contain links to external websites or embedded services operated by third parties.

EuPMA is not responsible for the privacy practices of independent third parties. You should review their privacy information before providing personal data or using their services.

Where third-party content is embedded directly into the website and may collect data before user interaction, EuPMA will implement consent or blocking mechanisms where required.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

changes to our activities;
changes to the website or technology providers;
legal or regulatory developments;
changes to the way we process personal data.

The updated version will be published on this page with a revised “Last updated” date.

Where changes materially affect how we process personal data, we will provide additional notice where required.

20. Contact Us

For questions about this Privacy Policy or the processing of your personal data, please contact:

Open Innovation s.a.s. di Scabbia Maurizio e C.
Email: privacy@eupma.eu
Postal address: via Marezzane 26a, 35020 Noventa Padovana (PD) - Italia