Privacy policy

Draft pending legal review. This text must be reviewed by the legal department of the Universidad de Huelva, the controller, and its Data Protection Officer before final publication. The specific legal basis is set by the controller, not by whoever builds the platform.

Who processes your data

Controller	Universidad de Huelva · CIF Q7150008F
Address	C/ Dr. Cantero Cuadrado, 6 · 21071 Huelva (Spain)
Data Protection Officer	delegado.protecciondatos@uhu.es
Processor	Whoever develops and operates the platform, bound by the Article 28 GDPR contract

On what legal basis

This is the part most often forgotten and the first thing an inspection asks about. Processing without an identified legal basis is unlawful processing, however good the intention.

Processing	Legal basis	Provision
Account and submission of papers	Performance of a relationship at the person’s request	Art. 6(1)(b) GDPR
Running and publicising the congress	Task in the public interest: the dissemination of knowledge, a core function of the university (specific law: pending legal review)	Art. 6(1)(e) GDPR
Publication in the ISBN proceedings	Task in the public interest and legitimate interest in scientific dissemination	Art. 6(1)(e) GDPR
Congress registration and proof of payment	Performance of a relationship at the person’s request	Art. 6(1)(b) GDPR
Invoicing the registration, if an invoice is requested	Legal obligation of whoever issues it	Art. 6(1)(c) GDPR · RD 1619/2012
Participation statistics (profile and origin)	Compatible purpose with the registration, using aggregated data that identifies no one	Art. 6(4) and 89(1) GDPR
Accessibility requirements	Explicit consent	Art. 9(2)(a) GDPR
Dietary requirements	Explicit consent	Art. 9(2)(a) GDPR
Audit log and access control	Legal obligation of the controller	Art. 6(1)(c) GDPR
Rate-limiting sign-in attempts	Legitimate interest in system security	Art. 6(1)(f) GDPR

The two kinds of processing that rely on consent can be withdrawn at any time without giving reasons and without affecting anything else: if you withdraw consent for your accessibility requirements, your submission still stands. Withdrawal is not retroactive over what has already been processed, but it stops the processing from that point on.

What is collected and what for

If you create an account

Full name, email address and password. The password is not stored: only a cryptographic digest produced with argon2id is kept, and the original cannot be recovered from it. If you turn on two-factor authentication, an encrypted secret is also stored, used to validate the codes from your authenticator app.

Purpose: to identify you, let you submit and track your papers, and notify you about them.

If you submit a paper

The details of everyone listed as an author: full name, email, institution, academic qualifications and professional role. The content of the work and, if you attach it, the document.

Purpose: to manage the review, publication in the book of abstracts and the organisation of the programme.

Adding someone as a co-author means supplying their data. It is your responsibility to have informed them and to have their agreement. The platform emails them to say they are listed as an author, precisely so that nobody ends up in a publication without knowing.

If you register for the congress

Before choosing a rate and paying you are asked for: first name and surname, ID card or passport number, full address (street, postcode, town, state or province and country), phone number, and the capacity in which you attend (coach, player, referee, teacher, academic, student… or whatever you write if you choose “Other”). The email is your account email. Then the rate, the attendance mode (in person or online) and, if you pay by transfer, the proof of payment you upload.

Purpose: to process your registration, check the payment and issue the receipt or, if you ask for one, the invoice. Profile and origin are also used for the congress statistics, always aggregated: how many people come from each country or with each profile, never who.

These details are seen by the congress secretariat. The Scientific Committee does not see them: it does not need them to review. You can correct them from My area until your registration is confirmed; after that, by writing to the secretariat.

If you pre-register

In addition to the above, your participation category and, where applicable, accessibility requirements and dietary restrictions.

These last two are special category data under Article 9 GDPR and are handled separately:

• They are asked for only if you want to give them, in a separate, unticked box.
• They are passed only to whoever needs to act on them: the venue in one case, the caterer in the other. Not to the whole organisation.
• They are excluded from every general export and from the package the Scientific Committee receives.
• They are deleted when the congress ends, not when the edition ends.

What is NOT collected and NOT done

• No analytics, advertising or third-party cookies. There are only the session cookie and the one that tells the header you are signed in, both technically essential. There is no banner because there is nothing to consent to.
• No automated decision-making and no profiling. No submission is accepted or rejected by an algorithm: the Scientific Committee decides. Article 22 GDPR does not apply.
• Data is never sold or shared for commercial purposes. Never, to anyone.
• Fonts are served from this domain, not from an external service. Visiting the site does not disclose your IP address to any third party.
• IP addresses are recorded irreversibly hashed, solely to rate-limit automated sign-in attempts.

Who else sees your data

Who	What they see	Why
Congress office	Everything about your submission, and your registration and payment details	They handle intake and registrations
Scientific Committee	The work without authorship details	Review is blind
Proceedings publisher	Authorship and content of accepted work	To publish with an ISBN
Venue and caterer	Only accessibility or diet, and only their part	To be able to accommodate you
Processor	Technical access to operate and maintain	Article 28 contract
Email provider (Resend)	Your email address and the content of platform notices	Delivering your account emails
Address search (Photon, by komoot)	What you type in «Address» or «Postcode» and the chosen country, without your name, email or IP	Suggesting addresses as you type

One international transfer: email. The notices the platform sends you (confirming your account, resetting your password) go through Resend, the trade name of Plus Five Five, Inc., a United States company. They are sent from servers in Ireland, but Resend stores in the United States your email address, the content of the notice and its delivery log, for 30 days. The transfer relies on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Implementing Decision 2023/1795), under which Resend is certified, and additionally on the standard contractual clauses (Decision 2021/914) in its Article 28 processing agreement. No other data leaves the European Economic Area.

Addresses suggested when you register. While you type your address, or the postcode outside Spain and Portugal, the platform asks Photon, a search engine over OpenStreetMap data provided by komoot GmbH from Germany. The request is made by our server, not your browser: Photon only receives the text typed and the country, never your name, email, IP address or account. Answers are kept in the server’s memory for at most one day. If you prefer not to use it, type the full address without picking a suggestion: the form works the same.

For how long

Data	Retention
Account and personal details	While the account remains active
Published papers	Indefinitely: they are an ISBN publication
Rejected papers and drafts	One year after the congress
Audit log	Five years, required by the Spanish National Security Framework
Registration details and proofs of payment	As long as tax and accounting rules require
Accessibility and dietary requirements	Until the congress ends
Open sessions	Thirty days, or until you sign out
Log of emails sent, at the email provider	Thirty days

A published paper cannot be withdrawn from the proceedings: it is a scientific publication with an ISBN and its integrity is part of the academic record. An editorial note can be published alongside it. This is a real limit on the right to erasure, which is why it is stated here and not in the small print.

What happens if you do not provide them

Account and authorship details are essential: without them a submission cannot be processed or the work published. Not providing them means not being able to take part. The same goes for registration details: without them no one can be registered or their payment accounted for.

Accessibility and dietary details are voluntary. Not providing them prevents nothing: it means the organisers will not be able to plan for that particular need.

Your rights

You may exercise, free of charge and at any time:

• Access — to know what data about you is processed.
• Rectification — to correct anything inaccurate.
• Erasure — to have it deleted, subject to the proceedings limit above.
• Restriction — to have it kept but not used while something is resolved.
• Objection — to processing based on public or legitimate interest.
• Portability — to receive your data in a reusable format.
• Withdrawal of consent — for accessibility and diet, whenever you like.

Requests go to the Universidad de Huelva – Secretaría General (C/ Dr. Cantero Cuadrado, 6 · 21071 Huelva, Spain) through any of these channels:

• by email, to protecciondedatos@uhu.es;
• through the Electronic Registry of the university’s e-office (sede.uhu.es), after identifying yourself;
• in person, at the General Registry (C/ Dr. Cantero Cuadrado, 6) or the Auxiliary Registry on the El Carmen Campus.

The response time is one month, extendable to three if the request is complex.

If you believe your request was not properly handled, you can complain to the Spanish Data Protection Agency (aepd.es), without having to complain to the controller first.

Where your data is

On a server located in Spain, with regular backups. Transactional email is sent through Resend: it leaves from Ireland and its log is stored in the United States (see above).

The full record of this processing activity is held in the controller’s Record of Processing Activities, under Article 30 GDPR.