Privacy policy
What data is collected, on what legal basis, for how long, and what you can do about it.
This translation has not yet been reviewed by a native speaker. In case of discrepancy, the Spanish version prevails.
Draft pending legal review. This text must be reviewed by the legal department of the Diputación Provincial de Huelva and its Data Protection Officer before final publication. The contact details and the specific legal basis are set by the controller, not by whoever builds the platform.
Who processes your data
| Controller | Diputación Provincial de Huelva · Tax ID P2100000B |
| Address | Av. Martín Alonso Pinzón, 11 · 21003 Huelva, Spain |
| Data Protection Officer | (to be completed by the controller) |
| Processor | Whoever develops and operates the platform, bound by the Article 28 GDPR contract |
On what legal basis
This is the part most often forgotten and the first thing an inspection asks about. Processing without an identified legal basis is unlawful processing, however good the intention.
| Processing | Legal basis | Provision |
|---|---|---|
| Account and submission of papers | Performance of a relationship at the person’s request | Art. 6(1)(b) GDPR |
| Running and publicising the congress | Task in the public interest — promoting sport and culture is a provincial competence | Art. 6(1)(e) GDPR |
| Publication in the ISBN proceedings | Task in the public interest and legitimate interest in scientific dissemination | Art. 6(1)(e) GDPR |
| Accessibility requirements | Explicit consent | Art. 9(2)(a) GDPR |
| Dietary requirements | Explicit consent | Art. 9(2)(a) GDPR |
| Audit log and access control | Legal obligation of the controller | Art. 6(1)(c) GDPR |
| Rate-limiting sign-in attempts | Legitimate interest in system security | Art. 6(1)(f) GDPR |
The two kinds of processing that rely on consent can be withdrawn at any time without giving reasons and without affecting anything else: if you withdraw consent for your accessibility requirements, your submission still stands. Withdrawal is not retroactive over what has already been processed, but it stops the processing from that point on.
What is collected and what for
If you create an account
Full name, email address and password. The password is not stored: only a cryptographic digest produced with argon2id is kept, and the original cannot be recovered from it. If you turn on two-factor authentication, an encrypted secret is also stored, used to validate the codes from your authenticator app.
Purpose: to identify you, let you submit and track your papers, and notify you about them.
If you submit a paper
The details of everyone listed as an author: full name, email, institution, academic qualifications and professional role. The content of the work and, if you attach it, the document.
Purpose: to manage the review, publication in the book of abstracts and the organisation of the programme.
Adding someone as a co-author means supplying their data. It is your responsibility to have informed them and to have their agreement. The platform emails them to say they are listed as an author, precisely so that nobody ends up in a publication without knowing.
If you pre-register
In addition to the above, your participation category and, where applicable, accessibility requirements and dietary restrictions.
These last two are special category data under Article 9 GDPR and are handled separately:
- They are asked for only if you want to give them, in a separate, unticked box.
- They are passed only to whoever needs to act on them: the venue in one case, the caterer in the other. Not to the whole organisation.
- They are excluded from every general export and from the package the Scientific Committee receives.
- They are deleted when the congress ends, not when the edition ends.
What is NOT collected and NOT done
- No analytics, advertising or third-party cookies. The only cookie is the session cookie, which is technically essential. There is no banner because there is nothing to consent to.
- No automated decision-making and no profiling. No submission is accepted or rejected by an algorithm: the Scientific Committee decides. Article 22 GDPR does not apply.
- Data is never sold or shared for commercial purposes. Never, to anyone.
- Fonts are served from this domain, not from an external service. Visiting the site does not disclose your IP address to any third party.
- IP addresses are recorded irreversibly hashed, solely to rate-limit automated sign-in attempts.
Who else sees your data
| Who | What they see | Why |
|---|---|---|
| Congress office | Everything about your submission | They handle intake |
| Scientific Committee | The work without authorship details | Review is blind |
| Proceedings publisher | Authorship and content of accepted work | To publish with an ISBN |
| Venue and caterer | Only accessibility or diet, and only their part | To be able to accommodate you |
| Processor | Technical access to operate and maintain | Article 28 contract |
There are no international data transfers. Not to the United Kingdom, not to the United States, not to any third country.
For how long
| Data | Retention |
|---|---|
| Account and personal details | While the account remains active |
| Published papers | Indefinitely: they are an ISBN publication |
| Rejected papers and drafts | One year after the congress |
| Audit log | Five years, required by the Spanish National Security Framework |
| Accessibility and dietary requirements | Until the congress ends |
| Open sessions | Thirty days, or until you sign out |
A published paper cannot be withdrawn from the proceedings: it is a scientific publication with an ISBN and its integrity is part of the academic record. An editorial note can be published alongside it. This is a real limit on the right to erasure, which is why it is stated here and not in the small print.
What happens if you do not provide them
Account and authorship details are essential: without them a submission cannot be processed or the work published. Not providing them means not being able to take part.
Accessibility and dietary details are voluntary. Not providing them prevents nothing: it means the organisers will not be able to plan for that particular need.
Your rights
You may exercise, free of charge and at any time:
- Access — to know what data about you is processed.
- Rectification — to correct anything inaccurate.
- Erasure — to have it deleted, subject to the proceedings limit above.
- Restriction — to have it kept but not used while something is resolved.
- Objection — to processing based on public or legitimate interest.
- Portability — to receive your data in a reusable format.
- Withdrawal of consent — for accessibility and diet, whenever you like.
Requests go to the controller through the channels provided by the Diputación Provincial de Huelva. The response time is one month, extendable to three if the request is complex.
If you believe your request was not properly handled, you can complain to the Spanish Data Protection Agency (aepd.es), without having to complain to the controller first.
Where your data is
On a server located in Spain. Backups are encrypted before leaving the server, so holding them gives no access to the content. Transactional email is sent through a provider located in the European Union.
The full record of this processing activity is held in the Diputación’s Record of Processing Activities, under Article 30 GDPR.
Última actualización: