Questex: Appropriate Policy Document (APD) for the Processing of Special Category Data

For purposes of the International Hospitality Investment Forum

This Policy Document explains Questex’s processing of special category personal data (SC) and its policies with regard to the retention and erasure of personal data processed in reliance on these conditions.

It satisfies the requirement of the Data Protection Act 2018 (DPA 18) Part 4 for a Data Controller (that is Questex) to have in place an ‘appropriate policy document’. This should be read in conjunction with Questex’s privacy policy.

This Policy covers all processing carried out by Questex for the International Hospitality Investment Forum (IHIF)

  • Which is subject to General Data Protection Regulation (GDPR) Articles 9
  • In reliance of the conditions set out in the Data Protection Act 2018, Schedule 1: special categories of personal data, in particular:
    • Part 1 Conditions relating to employment, health and research etc.
    • Part 2 Substantial public interest conditions


When Questex carries out the processing of special categories of personal data a condition under GDPR Article 9 must be satisfied. Questex will do so with reference to one of the following:

  • Paragraph 2(a) – the data subject has given explicit consent for one or more specified purposes
  • Paragraph 2(b) – the processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
  • Paragraph 2(g) – the processing is necessary for reasons of substantial public interest
  • Paragraph 2(j) – the processing is necessary for archiving purposes in the public interest, scientific or historical research or statistical purposes in accordance with GDPR Article 89 (1)

Irrespective of whether the Policy is applicable, Questex must also be compliant with the principles relating to the processing of personal data. This Policy will complement our Privacy Policy.

Description of data processed

Personal data processed under this category includes:

Data concerning health, specifically

  • First and last name
  • Telephone number
  • The district or municipality where domiciled or permanent resident
  • Full address and email address
  • Time and duration individual is present at event
  • Covid tests and results (if applicable)
  • Vaccination information in relation to Corona Virus (Covid-19)
  • If necessary supplemented by other necessary data

The data shall be provided exclusively to the public health authorities. Questex data processing partners and as required by venues.

Schedule 1 condition for processing

Data Protection Act Schedule 1 Part 1

Conditions relating to Employment, Social Security and Health etc:

  • For the purpose of carrying out our obligations to the Berlin Government
  • Processing necessary health / social care purposes per The Governing Mayor of Berlin – Senate Chancellery, Corona Virus Information: Measures against Corona Virus, specifically relating to public and private events

Procedures for ensuring compliance with the principles

All data collection at Questex is submitted through a secure platform to ensure privacy compliance. The processes and access to that system is used to ensure data is protected. In addition, we have specific policies and processes for managing GDPR compliance based on article 6. For purposes of collection of Special Category (SC) data for the IHIF event, the legal processing falls under GDPR Article 6(1)

  1. The data subject has given consent to the processing of his or her personal data for one or more specific purposes;
  2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
  3. Processing is necessary for compliance with a legal obligation to which the controller is subject;
  4. Processing is necessary in order to protect the vital interests of the data subject or of another natural person;
  5. Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
  6. Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party

Our privacy policy may be viewed at https://questex.com/privacy-policy.


Principle (a): lawfulness, fairness and transparency

  • Processing necessary health / social care purposes per The Governing Mayor of Berlin – Senate Chancellery, Corona Virus Information: Measures against Corona Virus, specifically relating to public and private events
  • Use of the collected of SC data will be provided to individuals upon collection of data


Principle (b): purpose limitation

  • SC data will be provided exclusively to the public health authorities.


Principle (c): data minimisation

  • SC data collected will be limited to requirements of the The Governing Mayor of Berlin – Senate Chancellery, Corona Virus Information: Measures against Corona Virus, specifically relating to public and private events


Principle (d): accuracy

  • Source of individual data will be provided by
    • Individual self-reported data collected during registration/online check-in for the event
    • Majero Ltd who provides bluetooth data of individual’s attendance at the event, including arrival time and duration per day
  • Collection of this data is to adhere to requirements to hold the IHIF event in Berlin on September 1-3, 2021. There will be no need to update the information once the event has completed.


Principle (e): storage limitation

  • To ensure compliance with Berlin’s requirements, SC data will be maintained for 180 days on Questex systems for public interest archiving.


Principle (f): integrity and confidentiality (security)

  • SC data will be provided to Berlin health authorities upon collection.
  • SC data will be securely stored on Questex systems, with access available only to authorized personnel.

Retention and erasure policies

All SC data, specific to the “Measures against corona virus” required by Berlin, will be removed from Questex systems in February 2022.