Cookies Policy

Conseil Européen pour les Professionnels et les Thérapies Intégratives – CEPTI

European Council for Integrative Professionals and Therapies – CEPTI

Original effective date: 1 August 2025
Last updated: 22 September 2026
Website: https://cepti.eu

1. Introduction

This Privacy and Data Protection Policy explains how Conseil Européen pour les Professionnels et les Thérapies Intégratives – CEPTI, a Belgian non-profit association (ASBL), collects, uses, stores, transfers and protects personal data in connection with its website, membership activities, accreditation procedures, institutional communications, events, professional programmes, donations and other organisational activities.

CEPTI is committed to processing personal data lawfully, fairly, transparently and proportionately, in accordance with Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR) and applicable European and Belgian data protection legislation.

This Policy applies to:

• visitors to the CEPTI website;
• individuals who contact CEPTI;
• applicants and CEPTI members;
• applicants for individual or institutional      accreditation;
• representatives of member or partner      organisations;
• participants in CEPTI events, meetings,      conferences or programmes;
• donors and supporters;
• subscribers to CEPTI communications;
• professionals, collaborators and other      individuals who interact with CEPTI.

2. Data Controller

The controller of personal data is:

Conseil Européen pour les Professionnels et les Thérapies Intégratives – CEPTI
Legal form: ASBL
Registration number: 1025842504
Registered office: Square de Meeûs 35, 1000 Brussels, Belgium
Website: https://cepti.eu
Email: contact@cepti.eu
Telephone: +32 465 75 84 84

For questions relating to data protection:

Data Protection Contact:
Cătălin Costache
Vice-President for External Relations
Email: contact@cepti.eu

3. Data Protection Officer

As of the date of this version, CEPTI has not appointed a Data Protection Officer (DPO).

Questions concerning data protection and the exercise of rights under the GDPR may be addressed to CEPTI using the contact details provided in this Policy.

If CEPTI appoints a DPO in the future, this Policy will be updated accordingly.

4. Categories of Personal Data Processed

Depending on the individual’s relationship with CEPTI, the following categories of personal data may be processed:

a. Identification data
first name, surname and other information required for identification;

b. Contact data
email address, telephone number, postal address, city and country;

c. Professional data
professional title, occupation, profession, organisation or institution, qualifications, diplomas, certificates, professional experience and other information relevant to professional activity;

d. Identity verification data
data or copies of identity documents, only where strictly necessary for a membership, accreditation, certification, verification or compliance procedure;

e. Membership and accreditation data
applications, forms, supporting documents, evaluations, membership status, accreditation status, decisions, accreditation numbers and institutional correspondence;

f. Communication data
messages submitted through the website, forms, email or other communication channels;

g. Event and programme data
registration details, attendance, participation, certificates, photographs, audio-video recordings and related communications;

h. Financial and administrative data
payment confirmations, payment references, invoices, billing details and accounting records;

i. Donation data
information required to administer donations and voluntary contributions;

j. Newsletter and communication data
email address, subscription status, communication preferences, proof of consent and unsubscribe status;

k. Technical website usage data
IP address, browser, device type, operating system, cookies, online identifiers, security information and website usage data.

CEPTI applies the principle of data minimisation and aims to collect only the information necessary for the stated purposes.

Where a copy of an identity document is requested, CEPTI may recommend masking information that is not necessary for the verification purpose.

5. Sources of Personal Data

In most cases, CEPTI receives personal data directly from the data subject.

In certain situations, personal data may also be received from:

• member or partner organisations;
• employers or organisations represented by      the individual;
• persons who nominate, recommend or confirm      the professional status of an applicant;
• payment service providers;
• event organisers;
• professional or institutional registers;
• competent authorities;
• public professional sources, such as      institutional websites or public registers;
• other legitimate sources where necessary      for a CEPTI procedure.

Where personal data are not obtained directly from the data subject, CEPTI provides the information required under Article 14 GDPR where that obligation applies.

6. Purposes and Legal Bases for Processing

6.1. Contact and General Enquiries

CEPTI processes the data necessary to respond to messages, requests and enquiries submitted through the website, by email, through forms or via other communication channels.

Legal basis: CEPTI’s legitimate interest in responding to enquiries and managing institutional communication or, where applicable, taking steps requested by the individual prior to entering into a contract.

Voluntarily submitting a form does not, in itself, constitute GDPR consent for other purposes.

6.2. Membership Applications and Member Administration

Personal data are processed for:

• assessing membership applications;
• verifying eligibility requirements;
• administering membership status;
• communicating with members;
• managing rights and obligations associated      with membership;
• maintaining institutional records.

Legal basis: pre-contractual measures, performance of the membership or contractual relationship, legitimate interests and, where applicable, legal obligations.

6.3. Accreditation Procedures

CEPTI may process professional data, documents, diplomas, certificates, experience, evaluations and other information necessary for assessing and administering applications for individual or institutional accreditation.

Legal basis: pre-contractual or contractual measures, CEPTI’s legitimate interest in maintaining professional standards and institutional records and, for certain optional information, the individual’s consent where required.

6.4. Institutional Communications

CEPTI may use contact details for communications directly related to the individual’s relationship with the organisation, including:

• membership information;
• accreditation matters;
• changes to procedures;
• CEPTI events and activities;
• administrative communications;
• information relevant to affiliated      organisations and professionals.

Legal basis: legitimate interest or performance of the relationship with the individual concerned.

6.5. Newsletters and Marketing Communications

CEPTI may send newsletters, public announcements, information about programmes, events and other professional communications.

Where consent is required by law, such communications will be sent only after valid consent has been obtained.

The individual may unsubscribe at any time.

Legal basis: consent or, where permitted by law, legitimate interest in communicating with members and individuals who already have a relevant professional relationship with CEPTI.

6.6. Events, Conferences, Meetings and Professional Programmes

CEPTI may process personal data for organising and administering events, conferences, meetings, educational activities and professional programmes.

Data may include registration, attendance, certification of participation and related communications.

Legal basis: performance of a contract or pre-contractual measures, legitimate interests and, where required, consent.

6.7. Payments, Invoices and Donations

CEPTI processes the data necessary for:

• membership fees;
• accreditation fees;
• fees relating to events or programmes;
• donations and voluntary contributions;
• invoicing;
• accounting and financial records.

CEPTI may use payment providers such as Stripe, PayPal and Revolut.

CEPTI does not directly store full payment card details.

Legal basis: performance of a contract, legal obligation and legitimate interest in financial administration.

6.8. Legal, Accounting and Administrative Obligations

CEPTI may process personal data where necessary to comply with legal, tax, accounting, administrative, governance or reporting obligations.

Legal basis: legal obligation and, where relevant, legitimate interest.

6.9. Website Security and Administration

Technical data may be processed for:

• operating the website;
• maintaining system security;
• preventing fraud and abuse;
• identifying incidents;
• protecting digital infrastructure;
• improving website functionality.

Legal basis: CEPTI’s legitimate interest in maintaining a secure and functional website and information systems.

6.10. Cookies, Analytics and Promotional Technologies

CEPTI may use technologies such as:

• Google Analytics;
• Meta Pixel;
• Google Ads;
• LinkedIn Insight Tag;
• other similar tools transparently      disclosed on the website.

Non-essential cookies and technologies are used only on the basis of valid consent where such consent is legally required.

Cookies that are strictly necessary for website functionality and security do not require consent where applicable law permits their use without consent.

7. Special Categories of Personal Data

CEPTI does not ordinarily request through its website data relating to:

• health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade union membership;
• genetic data;
• biometric data used for unique      identification;
• sex life or sexual orientation.

Individuals are asked not to submit such information unless it is strictly necessary for a CEPTI procedure.

If, in an exceptional situation, the processing of special category data is necessary, CEPTI will only process such data where both an appropriate legal basis under Article 6 GDPR and one of the conditions under Article 9 GDPR apply.

The mere fact that an individual voluntarily submits such data does not, in itself, constitute a sufficient legal basis for processing.

8. Mandatory and Optional Data

Depending on the service or procedure requested, certain information may be mandatory.

For example, data required for:

• identifying the applicant;
• verifying qualifications;
• processing a membership application;
• assessing an accreditation;
• issuing a document;
• processing a payment;
• complying with a legal obligation

may be necessary for CEPTI to provide the relevant service or assess the request.

If an individual refuses to provide data that are strictly necessary, CEPTI may be unable to process the application, grant the requested status, complete the accreditation or provide the relevant service.

Data indicated or communicated as optional may be omitted without affecting the procedure, unless CEPTI expressly states otherwise.

9. CEPTI’s Legitimate Interests

Where processing is based on legitimate interest, such interests may include:

• responding to enquiries;
• managing institutional relationships;
• administering members;
• administering accreditations;
• maintaining institutional history and      records;
• verifying qualifications and documents;
• developing professional standards;
• protecting CEPTI’s reputation and      integrity;
• preventing fraud and misuse;
• protecting the website and information      systems;
• developing institutional partnerships;
• defending CEPTI’s legal rights;
• ensuring organisational continuity.

CEPTI will not rely on legitimate interest where the fundamental rights, freedoms or interests of the data subject override CEPTI’s interests.

10. Recipients of Personal Data

Access to personal data may be granted only where necessary to the following categories of recipients:

• authorised members of the CEPTI Board of      Directors;
• authorised members of the Executive      Council;
• authorised administrative personnel or      collaborators;
• assessors and committees involved in      membership or accreditation procedures;
• website, hosting and domain providers,      including GoDaddy;
• email and cloud storage providers,      including Google;
• online form providers;
• newsletter providers, including      MailerLite;
• payment providers, including Stripe,      PayPal and Revolut;
• accountants, legal advisers and compliance      consultants;
• IT and security service providers;
• analytics and marketing providers where      valid consent exists;
• public authorities, courts or competent      bodies where disclosure is required by law.

Providers processing personal data on behalf of CEPTI are selected and used in accordance with applicable data protection obligations.

CEPTI does not sell personal data.

11. Public Registers and Professional Information

As part of its professional and institutional activities, CEPTI may publish information relating to individuals or organisations holding a CEPTI status, recognition or accreditation where this is necessary for public verification of professional status.

Such a register may include, where appropriate, only the information necessary for verification, such as:

• name;
• organisation;
• professional title or status;
• type of accreditation;
• accreditation number;
• validity period;
• current accreditation status.

CEPTI will not publish identity documents, private addresses, financial information or other data that are not necessary for verification of professional status.

The individual will be informed within the relevant procedure if certain data are to be included in a public register.

12. International Data Transfers

CEPTI is established in Belgium and seeks, wherever possible, to process data within the European Economic Area.

However, some digital services used by CEPTI may involve the storage of or access to personal data from outside the European Economic Area.

In such cases, CEPTI uses mechanisms permitted under the GDPR, as applicable, including:

• adequacy decisions adopted by the European      Commission;
• the EU-U.S. Data Privacy Framework, where      the relevant provider is eligible and certified;
• Standard Contractual Clauses approved by      the European Commission;
• supplementary contractual, technical and      organisational safeguards;
• other GDPR-compliant transfer mechanisms.

Data subjects may request further information regarding the applicable transfer mechanism and, where provided for by the GDPR, a copy of the relevant safeguards by contacting CEPTI at contact@cepti.eu.

13. Data Retention

CEPTI retains personal data only for as long as necessary for the purpose for which they were collected, to comply with legal obligations, protect CEPTI’s rights and maintain legitimate institutional records.

As a general rule:

• general enquiries and messages: up to 12 months after the last      communication;
• membership files: for the duration of membership and up to      5 years after membership ends;
• accreditation files: for the duration of the accreditation and      up to 5 years after expiry or termination;
• identity verification documents: only for as long as strictly necessary      for verification and subsequently deleted or reduced to the information      required, unless continued retention is legally justified;
• accounting records, invoices and payment      data: for the period      required by applicable accounting and tax legislation;
• event participation data: generally up to 3 years after the event;
• newsletter subscriber data: until unsubscribe or withdrawal of      consent;
• proof of consent: for as long as necessary to demonstrate      compliance;
• records of accreditations, certificates,      accreditation numbers and institutional decisions: may be retained long-term where necessary      to verify document authenticity, preserve institutional history or defend      legal rights.

CEPTI may anonymise data where the retention of statistical or historical information no longer requires the identification of an individual.

14. Rights of Data Subjects

Subject to the conditions set out in the GDPR, the data subject may have the following rights:

a. Right of access
the right to request information about the personal data being processed and obtain a copy;

b. Right to rectification
the right to request correction of inaccurate data or completion of incomplete data;

c. Right to erasure
the right to request deletion of personal data where the legal conditions are met;

d. Right to restriction of processing;

e. Right to object
in particular where processing is based on legitimate interest;

f. Right to data portability
where the conditions set out in the GDPR apply;

g. Right to withdraw consent
where processing is based on consent;

h. Right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects or similarly significant effects.

To exercise these rights:

contact@cepti.eu

CEPTI may request additional information strictly necessary to verify the identity of the person making the request.

Requests will be handled within the time limits provided by the GDPR.

15. Withdrawal of Consent and Objection to Direct Marketing

Where processing is based on consent, the individual may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

For newsletters and similar communications, individuals may unsubscribe by using the mechanism included in the message or by emailing:

contact@cepti.eu

The data subject has the right to object at any time to the processing of personal data for direct marketing purposes.

Following such an objection, CEPTI will no longer use the individual’s personal data for direct marketing.

For cookies and similar technologies, consent may be modified or withdrawn through the cookie management tool available on the website.

16. Right to Lodge a Complaint

If an individual believes that CEPTI processes personal data in breach of data protection law, the individual may first contact CEPTI in order to seek clarification.

The individual also has the right to lodge a complaint with a supervisory authority.

The competent authority for CEPTI in Belgium is:

Autorité de protection des données / Gegevensbeschermingsautoriteit
Rue de la Presse 35
1000 Brussels
Belgium

Website: https://www.dataprotectionauthority.be

An individual may also contact the supervisory authority in the Member State of habitual residence, place of work or place of the alleged infringement, in accordance with the GDPR.

17. Data Security

CEPTI applies appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• loss;
• disclosure;
• alteration;
• destruction;
• misuse.

Measures may include:

• access controls;
• limiting access to persons who require the      data;
• secure account management;
• appropriate passwords and authentication;
• confidentiality obligations;
• backup and technical security measures      provided by service providers;
• training and accountability of persons      working with personal data.

No online system can guarantee absolute security.

Individuals are encouraged not to submit sensitive or unnecessary information through public forms or unsecured communication channels.

18. Cookies and Similar Technologies

The CEPTI website uses cookies and similar technologies.

Some are strictly necessary for the functioning of the website, while others may be used for:

• preferences;
• statistics and analytics;
• embedded content;
• audience measurement;
• advertising;
• marketing.

Non-essential cookies and technologies will not be activated before consent is given where such consent is required by applicable law.

Users must be able to:

• accept non-essential cookies;
• refuse non-essential cookies;
• modify their selection;
• withdraw consent at a later time.

Refusing non-essential cookies must not prevent access to website functions that do not depend on those cookies.

Detailed information regarding each category of cookies, providers, purposes and storage periods is set out in the CEPTI Cookie Policy, available on the website.

19. Third-Party Links and Content

The CEPTI website may include:

• links to external websites;
• videos;
• maps;
• forms;
• payment tools;
• social media content;
• other content provided by third parties.

These services may apply their own privacy policies.

CEPTI does not control and is not responsible for the privacy practices of independent external websites.

Individuals are encouraged to review the privacy policies of the relevant providers.

20. Automated Decision-Making and Profiling

CEPTI does not use personal data collected through the website to make decisions based solely on automated processing that produce legal effects or similarly significant effects on an individual.

Decisions concerning membership, accreditation or professional status are subject to human and institutional assessment.

If this situation changes, this Policy will be updated and data subjects will receive the information required by the GDPR.

21. Children’s Data

The CEPTI website and services are not specifically directed at children.

CEPTI does not seek to collect children’s personal data through the website.

If CEPTI becomes aware that such data have been received without an appropriate legal basis, it will take reasonable steps to delete or protect the information.

22. Photographs, Video Recordings and Testimonials

During events, meetings, conferences and professional activities, CEPTI may take photographs or make audio-video recordings.

Where a photograph, recording or testimonial clearly identifies an individual and is intended for publication or promotional use, CEPTI will rely on an appropriate legal basis and obtain consent where required.

Individuals who have questions or objections concerning the use of their image, voice or testimonial may contact:

contact@cepti.eu

23. Updates to this Policy

CEPTI may amend this Privacy and Data Protection Policy where there are:

• legislative changes;
• changes to the organisation’s activities;
• new services;
• new technologies;
• new providers;
• changes to internal procedures.

The updated version will be published on this page.

For transparency, CEPTI keeps visible:

Original effective date: 1 August 2025
Last updated: 22 September 2026

In the event of significant changes, CEPTI may also notify data subjects through other appropriate means.

24. Contact

For questions regarding this Privacy and Data Protection Policy, data protection or the exercise of rights under the GDPR:

Conseil Européen pour les Professionnels et les Thérapies Intégratives – CEPTI

Square de Meeûs 35
1000 Brussels
Belgium

Email: contact@cepti.eu
Telephone: +32 465 75 84 84
Website: https://cepti.eu

Original effective date: 1 August 2025
Last updated: 22 September 2026