Controller: Stichting voor Internationale Medical Device Distributeurs, trading as IntMeDA. Boekanierlaan 27, 2132 TB Hoofddorp, Netherlands. Trade register (KvK) 77867823 · RSIN 861176868. Contact: info@intmeda.com. Last updated 7 September 2026.

Website visitors

We do not use advertising or analytics cookies. If you send us a message or book a call, we keep what you send us in order to reply and to arrange the call. Bookings are handled by Microsoft Bookings.

Membership applications

Applications are collected through a form hosted by Jotform. We keep the application and our assessment of it for as long as the application is live, and for the duration of membership if it is accepted.

Member company contacts

If you are a contact at an IntMeDA member company, we keep an internal record of our working relationship with you. This is the section most people are looking for, so it is set out in full.

Your rights

You can ask us to show you what we hold about you, correct it, delete it, or stop keeping it. Because we rely on legitimate interest, you have an unqualified right to object, and we will stop unless we have compelling grounds not to.

Write to info@intmeda.com. We answer within one month. If you are not satisfied you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Processors

We use a small number of suppliers who handle data on our behalf, each under a written agreement: our hosting provider, Microsoft (call bookings) and Jotform (membership applications). The website, the member platform and the recordings run on our own hosting, not on a third-party website builder. Data stays in the EU or EEA.

Changes

If we change how we use personal data in a way that affects you, we will update this page and, where the change is significant, tell members directly.

The full detail

This page is the summary. Our GDPR and data protection page carries the complete record of processing: every category of data, the lawful basis for each, the retention clock, the processors we use, the security measures in place and how to exercise each of your rights.

Stichting voor Internationale Medical Device Distributeurs, trading as IntMeDA. A stichting under Dutch law, with its seat in the municipality of Haarlemmermeer. Boekanierlaan 27, 2132 TB Hoofddorp, Netherlands.
Trade register (KvK) 77867823 · RSIN 861176868 · info@intmeda.com
Last updated 7 September 2026. Governed by Dutch law.

Membership

Membership is held by a company, not an individual. It runs for twelve months from the date of enrolment and does not renew automatically without notice. Fees are annual and stated on the membership page; the one-time joining fee is not refundable once access has been granted.

Membership is reviewed by the board. We may decline an application, and we may end a membership where a member breaches these terms, damages the network's standing, or misuses information obtained through it.

Fees

IntMeDA is a non-profit foundation. No VAT is charged on membership fees, the joining fee or the E-Fair fee, and the amounts shown on this site are the amounts invoiced. Invoices are issued in euro and payable within seven days.

What membership gives you

Access to the member directory, the events programme, the weekly intelligence briefing, and introductions arranged by IntMeDA. Seat numbers depend on the tier. We do not guarantee any commercial outcome: we make introductions, we do not make sales.

Confidentiality

Information shared inside the network, including member contact details, commercial intelligence and anything discussed in sessions, is for the member company's internal use only. It must not be resold, published, or passed to non-members. Exporting the member directory for any purpose other than your own business use is a breach.

Our role

IntMeDA is an association. We do not buy, sell, import, distribute or hold title to any product, and we are not party to any agreement between a member and a manufacturer or between two members. Any contract you enter through an IntMeDA introduction is yours.

Website

Content on this site is provided for information. We keep it accurate but do not warrant that it is complete or current. Logos and names of member companies and manufacturers remain the property of their owners and are shown with permission.

Liability

To the extent permitted by law, IntMeDA is not liable for indirect or consequential loss, lost profit, or loss arising from a commercial relationship formed through the network. Nothing here limits liability for fraud or anything else that cannot lawfully be limited.

Personal data

Member contact details in the directory are personal data. Using them for your own business relationships inside the network is what they are there for; exporting them into a mailing list or passing them outside your company is not, and is a breach of these terms as well as of data protection law. What we hold and what you may do with what we show you is set out on our GDPR page.

Changes and disputes

We may update these terms; material changes are notified to members. Disputes are subject to Dutch law and the courts of Amsterdam. Questions: info@intmeda.com.

Last updated 4 September 2026.

The short version

This site sets no advertising cookies and no analytics cookies. There is no consent banner because there is nothing to consent to. That is a deliberate choice, not an oversight.

Third parties you may reach from here

Two links take you off this site and those services set their own cookies under their own policies: the membership application form (Jotform) and call scheduling (Microsoft Bookings). Neither runs on this page.

Controlling cookies

You can block or delete cookies in your browser settings. Blocking the session cookie means the member platform cannot keep you signed in.

Questions: info@intmeda.com. See also our privacy page and the full GDPR and data protection page.

Data controller: Stichting voor Internationale Medical Device Distributeurs, trading as IntMeDA. A stichting under Dutch law, seat in the municipality of Haarlemmermeer. Boekanierlaan 27, 2132 TB Hoofddorp, Netherlands. Trade register (KvK) 77867823 · RSIN 861176868. Data protection contact: info@intmeda.com. Version 1.2, 7 September 2026. This page sits alongside our privacy notice and cookie statement and gives the full detail behind both.

The short version

Who this covers

Five groups of people, and the answer is different for each. Find yourself here and the rest of the page will make sense.

• Website visitors. You read the public pages. We do not know who you are and we make no attempt to find out.
• People who contact us. You send an email or book a call. We keep what you send in order to answer it.
• Membership applicants. You or your company apply to join. We keep the application and the board's assessment of it.
• Member company contacts. You work at a member company and have a seat on the member platform. This is the group with the most detail, and it is set out in full below.
• Manufacturers and suppliers who present. You presented your company at an E-Fair. We keep your company's listing, your presentation and the recording.

What we hold, why, and for how long

This is our record of processing in the form we would show a regulator, written in ordinary language. Every row is something the system actually stores.

Retention is a scheduled deletion rather than something a person has to remember. Notes and introductions carry an expiry date from the moment they are created, and a job running on the server removes them when that date passes. Nothing past its retention is served to anyone, including us.

The lawful bases we rely on, in plain terms

• Contract, Article 6(1)(b). We cannot run a membership your company has paid for without holding your company's record and your seat on the platform.
• Legitimate interest, Article 6(1)(f). Used for our working notes, our record of introductions, event attendance and security logging.
• Legal obligation, Article 6(1)(c). Invoices and accounting records, which Dutch law requires us to keep for seven years whatever anyone would prefer.
• Consent, Article 6(1)(a). Used only where it genuinely is a choice: appearing by name in a public case study or a photograph we publish. Consent can be withdrawn at any time and withdrawal costs you nothing.

Our legitimate interest assessment. Where we rely on legitimate interest we have asked three questions and written down the answers.

What we never do

• No special category data. Nothing about health, race, religion, politics, trade union membership, sex life or biometrics. We are a distributor network; none of it is any of our business.
• No profiling and no automated decision-making within the meaning of Article 22. No score is calculated about you and no system decides anything about you on its own.
• No sale, rental or exchange of data. Not to advertisers, not to data brokers, not to manufacturers. A manufacturer who presents to the network receives introductions to members who ask for them, never a list.
• No children's data. The site and the platform are for people acting in a professional capacity. We do not knowingly hold data about anyone under 16.
• No advertising or analytics cookies, no tracking pixels, no fingerprinting, no third-party scripts on the page. Fonts, images and video are served from our own servers, not from a network that could watch you.

Who else touches your data

A short list, each under a written data processing agreement, each doing one job.

These are the only third parties in the chain. There is no advertising network, no customer data platform and no analytics service. We do not use a third-party website builder: the site and the platform are our own code on our own hosting, which is the reason this list is as short as it is.

Transfers outside the EEA. Our normal position is that data does not leave the EU or EEA. If that ever has to change we will rely on an adequacy decision or on the European Commission's Standard Contractual Clauses, we will say so on this page, and members will be told directly.

How we protect it

Article 32 asks for measures appropriate to the risk. These are the ones actually in place, not a list of intentions.

• Passwords are never stored. Only a salted PBKDF2-SHA256 hash at 600,000 iterations. We cannot recover your password and neither could anyone who stole the database file.
• Everything travels over TLS. HTTPS is enforced site-wide with HSTS, so a browser will not fall back to an unencrypted connection.
• Session cookies are hardened. HttpOnly so no script can read them, SameSite=Strict so another site cannot use them, Secure over HTTPS, and a 12-hour life.
• Sign-in is throttled. Five failed attempts lock that account and that address for fifteen minutes, which makes password guessing impractical. A failed sign-in takes exactly as long whether the address has a seat or not, so nobody can work out who is a member by timing it.
• Resetting a password proves the mailbox first. A six-digit code, valid fifteen minutes, sent only to an address that already holds a seat. The reply is identical whether it does or not. Setting a new password signs out every other device and sends you a note saying it happened.
• Member material is never cached where others can reach it. Recordings, decks and the Sunday Briefing are marked private and no-store, so no shared cache keeps a copy and nothing is left in the browser after you sign out.
• Member material is gated at the server. Recordings, presentations and the Sunday Briefing are checked against your session before a single byte is sent. Knowing the address of a file is not enough to open it.
• Separation of the two sides. A member seat cannot reach the administrative system; the two use different sessions and different endpoints, and every administrative request is re-checked on the server rather than trusted from the browser.
• Browser-level hardening. A content security policy, framing denied, no-referrer, MIME sniffing off, and camera, microphone and location switched off for the page.
• An administrative log. Every change to the member database records who made it and when, which is what lets us answer the question "what happened to my data".
• Least access. One administrative account exists, restricted to our own email domain. Member data is never copied into a spreadsheet or a marketing tool.
• Backups. Encrypted, held in the EU, and covered by the same retention rules as the live database.

Your rights

All of them apply to you, whether you are a member, an applicant or someone who simply emailed us once.

Making a request

Write to info@intmeda.com. Say which right you are using, or simply describe what you want; you do not need to quote an article number and we will not send you a form to fill in.

• We answer within one month. If a request is genuinely complex we may take up to two further months, and if we do we will tell you why inside the first month.
• It is free. We will only charge for a request that is manifestly excessive or repetitive, and we would explain that before charging anything.
• We may check who you are, but proportionately: replying to the work address we already hold is usually the whole of it. We will not ask you for a passport to confirm an email address.
• Members can do much of it themselves. Your profile in the member platform shows what we hold about you and your company, and you can correct your own name and title there at any time.

If you are a member: your side of this

The member directory contains other people's personal data — their names, work emails and job titles. When you use it, you become a controller for what you then do with it, and the responsibility is yours, not ours.

• Use it for your own business relationships inside the network. That is what it is for.
• Do not export it into a marketing tool, a mailing list or a CRM you sell from.
• Do not pass it to anyone outside your company. Membership confidentiality in our terms says the same thing in contractual language.
• Keep your seats accurate. When a colleague leaves your company, close their seat — the primary contact can do this from the team panel in the platform.
• Bulk marketing to members is a breach of the terms as well as of their rights. An introduction is something we arrange; it is not a licence to mail everybody.

If something goes wrong

If personal data is lost or exposed, we will assess it immediately and, where there is a risk to the people involved, report it to the Dutch data protection authority within 72 hours of becoming aware. Where the risk is high, we will also tell the affected people directly and plainly: what happened, what data was involved, what we have done, and what you should do. We would rather send that message than not send it.

Questions and complaints

Ask us first, at info@intmeda.com. We are a small organisation and a real person reads it.

If you are not satisfied you have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in the EU country where you live or work.

Do we have a Data Protection Officer? No, and we are not required to have one. Article 37 requires a DPO of public authorities, of organisations whose core activity is large-scale monitoring, and of those processing special category data at scale. We are none of those. Data protection questions go to info@intmeda.com and are handled by the IntMeDA Manager.

Changes to this page

This is version 1.0, dated 4 September 2026. If we change how we use personal data in a way that affects you, we will update this page, change the version, and tell members directly where the change is significant.