Privacy and Data Protection Policy
1. General Principles (GDPR & EAA)
Conferora is operated in compliance with the General Data Protection Regulation (GDPR) and with the digital accessibility requirements of Directive (EU) 2019/882, the European Accessibility Act.
2. Data Collected, and Why
We collect only what running a conference requires:
- Account and authentication: name, email address and a password hash;
- Participant profile: institutional affiliation, biography, photograph and academic links, only where volunteered;
- Public committees: appointment to a scientific or organising committee is recorded publicly, so that the conference's academic record stays intact.
3. Subprocessors
Personal data may be processed by the entities below. The list names only subprocessors under an active contract. One that does not exist yet does not appear here, and appears when its contract begins:
- Hosting: DigitalOcean: application server, database and backups;
- Observability and diagnostics: Sentry: only when configured, and always with
send_default_pii=false; - Email notifications: a transactional email provider, for invitations and account notices, only when configured.
We do not process payments yet. When we do, the payment provider and the invoicing software join this list before any data reaches them.
4. Your Rights, and Backup Retention
If you have an account, you can exercise two of these rights yourself, under Privacy and data: download a copy of everything we hold about you (Articles 15 and 20) and delete your account (Article 17).
If you do not have an account (the case for most committee members and speakers, whose details were entered by the conference organisers) use the contact address in the footer of that conference's site, or write to us at [email protected] to access, correct or erase your data.
Deleting your account does not remove you from a conference's public site. A committee or speaker entry is a separate record, held by the organisers; deleting the account severs the link between the two, and removing that entry is asked of the organisers.
A note on backups: deletion does not propagate immediately to backups already taken. These are kept for 14 days so the system can be recovered after a serious failure, and are purged automatically at the end of that period.