Data processing agreement

1. Purpose and relationship with the terms of use

This agreement applies to the personal data that the organiser imports, enters or has processed in ConfCert for its events. For this data, the organiser is the controller and the publisher of ConfCert, identified in the Legal notice, is the processor.

This agreement forms part of the terms of use. It is accepted together with them, when the account is created and with each new version. It bears the same version as the terms of use.

If this agreement and the terms of use conflict on the protection of participant data, this agreement prevails. For everything else, including liability, governing law and disputes, the terms of use apply.

Account data (organisers and team members) is outside the scope of this agreement: ConfCert processes it as controller, as described in the privacy policy.

2. Term

This agreement applies for as long as the organiser uses the service. It continues after the end of the contract or the closure of the organisation, until the data is deleted or anonymised, as set out in the section “End of the contract”.

3. Nature and purpose of processing, data subjects and data

Nature of the processing: hosting, recording, organisation, consultation, making available, generation of documents (badges, certificates), sending emails, export, erasure and anonymisation.

Purpose: enabling the organiser to manage its scientific events, namely participants, papers, badges, attendance, certificates and their public verification.

Categories of data subjects:

• event participants (authors, speakers, reviewers, attendees, etc.);
• co-authors and presenters of papers;
• certificate signatories;
• members of the organiser's team, for the records of their actions on the event;
• visitors to the public verification and badge pages.

Categories of personal data:

• identity and contact details: first name, last name, email address and, depending on the event, phone number, organisation, country, reference;
• participation: roles, papers (title, reference, abstract, co-authors), status, badge number, attendance (date, time, check-in method);
• certificates: printed name, type, dates, status, number and verification token;
• signatories: name, position and signature image;
• emails: recipient, type, delivery status and last error;
• technical data: truncated IP address and browser of visitors to the verification page, audit log.

The organiser does not import any special categories of data within the meaning of Article 9 GDPR (health, opinions, origin, etc.), nor any data relating to criminal convictions.

4. Documented instructions

ConfCert processes the data only on the organiser's documented instructions. These instructions are the terms of use, this agreement, the organiser's settings and the actions it takes in the interface (import, sending, generation, export, anonymisation, deletion).

ConfCert does not use the data for its own purposes, does not sell it and does not use it for advertising.

If ConfCert considers that an instruction infringes the GDPR or other data protection rules, it informs the organiser immediately. It may then suspend that instruction until the organiser confirms or amends it.

If Union or Member State law requires ConfCert to process the data, ConfCert informs the organiser before processing, unless that law prohibits it.

5. Confidentiality

Only the persons who need access to operate the service, provide support or ensure security have access to the data. They are bound by a contractual or statutory duty of confidentiality.

6. Security of processing

ConfCert implements technical and organisational measures appropriate to the risk, within the meaning of Article 32 GDPR, including:

• encryption of traffic between the browser and the service (HTTPS);
• passwords stored as irreversible hashes;
• separation of data by organisation, and role-based access rights (Owner, Staff);
• rate limiting of requests and of login attempts, bot protection on sensitive forms;
• an audit log of significant actions, without passwords or tokens;
• masking of email addresses and phone numbers in technical logs;
• unguessable verification and badge links, public pages excluded from search engines;
• badge and export files available for one hour only;
• any backups encrypted and hosted in the European Union.

ConfCert updates these measures in line with the state of the art. It does not materially reduce them without informing the organiser.

7. Sub-processors

The organiser gives ConfCert a general authorisation to engage the following sub-processors:

• application and database hosting: a hosting provider established in the European Union (OVH SAS, France, or Hetzner Online GmbH, Germany), identified in the Legal notice;
• file storage (logos, signatures, imports, badges, certificates, exports): Cloudflare, Inc. (United States), R2 service;
• bot protection on forms: Cloudflare, Inc. (United States), Turnstile service;
• email delivery: Amazon Web Services (Amazon SES, European Union region);
• error tracking, when enabled: Functional Software, Inc. (Sentry, United States), with personal data scrubbed.

ConfCert informs the organiser, by email or in the service, at least 30 days before adding or replacing a sub-processor. The organiser may object on legitimate grounds within that period. If no solution is found, the organiser may terminate without charge and export its data.

ConfCert imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement. ConfCert remains liable to the organiser for their performance.

8. Transfers outside the European Union

ConfCert favours processing within the European Union. Where a sub-processor may access the data from a third country, in particular the United States, the transfer relies on the adequacy decision for the EU-US Data Privacy Framework for certified companies or, failing that, on the standard contractual clauses adopted by the European Commission.

9. Assistance to the organiser

Data subject rights. The service gives the organiser tools to answer its participants' requests: individual export of a participant's data (access and portability), editing of data (rectification), and irreversible erasure of a participant's identity data (anonymisation). If a person contacts ConfCert directly, ConfCert forwards the request to the organiser and does not answer it itself, unless instructed otherwise.

Impact assessments and prior consultation. On request, ConfCert provides the information it holds to help the organiser carry out a data protection impact assessment (DPIA) and, where relevant, consult the supervisory authority.

Retention. The organiser sets the retention period of each event: 24 months after the end of the event by default, adjustable from 1 to 120 months. Automatic anonymisation at the end of that period is on by default for new events, and the organiser can turn it off. If it does, it is responsible for erasing the data itself when the period ends; only the email history is then purged automatically. The owners of the organisation receive an email reminder 30 days, then 7 days, before the period ends, except for a draft event or a suspended organisation.

Anonymisation keeps a cryptographic fingerprint (HMAC) of the printed name, the certificate number, and the title and type of the deactivated papers, so that certificates remain verifiable; the abstract of those papers is erased. This fingerprint is still pseudonymised data.

10. Personal data breaches

ConfCert notifies the organiser of any personal data breach without undue delay after becoming aware of it, and no later than 48 hours.

The notification includes, as far as possible: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Any missing information is provided as soon as it becomes available.

The organiser, as controller, is responsible for notifying the supervisory authority within 72 hours and, where required, the data subjects. ConfCert assists it in doing so.

11. End of the contract: return and deletion

The organiser exports its data from the service before closing its organisation. Closure goes with the closure of its owner's account: it is immediate and irreversible, and access ends at once. If ConfCert terminates the contract, the organiser may, for 30 days, ask ConfCert for an export of its data, which ConfCert provides.

Participants of the events of a closed organisation are anonymised 30 days after closure, which constitutes deletion within the meaning of Article 28(3)(g) GDPR, except for the printed-name fingerprint and certificate data, kept for the public verification of certificates already issued. The organisation's audit log is then deleted, except billing entries, kept for 10 years. Certificates already issued remain publicly verifiable, with the printed-name check. Other data is deleted or anonymised, unless Union or Member State law requires it to be kept. Any encrypted backups are cleared of it as they rotate. ConfCert confirms the deletion in writing on request.

12. Information and audits

On request, ConfCert makes available to the organiser the information needed to demonstrate compliance with this agreement.

The organiser may have an audit carried out at most once a year, with 30 days' written notice. The audit is at the organiser's expense. It is performed by an independent auditor bound by professional secrecy or a confidentiality undertaking, without disrupting the service and without access to other customers' data. An additional audit is possible after a data breach or at the request of a supervisory authority.

13. The organiser's obligations

The organiser warrants that it has a legal basis for each processing operation it entrusts to ConfCert. It informs data subjects as required by Articles 13 and 14 GDPR, including of ConfCert acting as processor and of the public verification of certificates.

It keeps its record of processing activities, carries out an impact assessment where required, and holds the right to use the signatures and logos it uploads.

It gives its instructions through the service or in writing, and chooses a retention period suited to its needs.