Skip to content
ConfCert

Privacy policy

This policy explains which personal data ConfCert processes, for whom, why, for how long, with which providers, and how to exercise your rights.

1. Who is responsible for what

ConfCert processes data in two situations, with different roles under the General Data Protection Regulation (GDPR).

  • Accounts, the contact form and the security of the service: the publisher of ConfCert is the controller. Its identity and contact details are given in the Legal notice.
  • Event data (participants, co-authors, signatories, attendance, certificates): the event organiser is the controller. It imports or enters the data itself and decides how it is used. ConfCert acts as a processor, only on its instructions, under the data processing agreement.

If you are a participant, contact the event organiser first: it is your main point of contact. We help it respond to you.

2. Data subjects and sources of data

The data processed concerns the following people:

  • account holders (organisers and team members): data they provide themselves, at sign-up and in “My account”;
  • people invited to join a team: email address and role, provided by the organiser who invites them;
  • event participants: data provided by the organiser, by file import or manual entry;
  • co-authors and presenters of a paper: names provided by the organiser with the paper;
  • certificate signatories: name, position and signature image, provided by the organiser;
  • people who send a message through the contact form: the data they enter themselves;
  • visitors to public pages (certificate verification, badge page, forms): technical data collected automatically.

Where data is not collected from you (Article 14 GDPR), it comes from the event organiser. The organiser is responsible for informing you of this processing; this policy helps it do so.

3. Data we process

Depending on your situation, the following categories are processed.

  • Account: name, email address, password (stored as an irreversible hash), language, roles, login sessions, creation and verification dates, and proof of acceptance of the terms (version, date, truncated IP address, browser).
  • Invitation: email address, proposed role, date and status of the invitation.
  • Participants: first name, last name, email address and, depending on the event, phone number, organisation, country, reference, roles, papers (title, reference, abstract, co-authors), status, badge number.
  • Attendance: check-in date and time, check-in method (badge, daily attendance, manual entry) and the author of any manual entry or cancellation.
  • Certificates: printed name, type, dates, status (valid or revoked), number, verification token and version history. Signatories: name, position and signature image.
  • Transactional emails: recipient address, email type (access code, certificate, verification, invitation), delivery status and last error. Message content is not kept.
  • Payment: transaction references, amount, tier, invoice links, and the answer to the request for immediate performance with its date and the version of the terms. Card details are entered and stored by Stripe, never by ConfCert. When Link, a Stripe brand, sells the payment as reseller, it processes billing data under its own terms and issues the invoice.
  • Contact form: name, email address, subject and message. The message is sent to us by email; it is not stored in the service.
  • Technical and security data: IP address and browser for rate limiting and bot protection, audit log (without passwords or tokens), public verification log (truncated IP address, browser), error logs scrubbed of personal data.

4. Purposes and legal bases

  • Creating and managing your account, securing access and sending you service emails: performance of the contract (terms of use).
  • Providing the service to the organiser (participants, badges, attendance, certificates, exports): performance of the contract with the organiser. For participants, the legal basis is chosen by the organiser (for example legitimate interest, contract or consent).
  • Enabling public verification of a certificate: legitimate interest of the organiser and of the holder in proving that the certificate is genuine.
  • Invoicing and collecting payments: performance of the contract and accounting and tax obligations.
  • Keeping proof of acceptance of the terms: the publisher's legitimate interest in being able to prove the contract.
  • Protecting the sign-up, login, forgotten password, verification email resend and contact forms against bots (Cloudflare Turnstile): the publisher's legitimate interest in securing the service.
  • Ensuring security, preventing fraud and abuse, keeping an audit log, tracking technical errors: legitimate interest of the publisher and of the organiser.
  • Answering messages sent through the contact form: the publisher's legitimate interest in answering requests, or pre-contractual steps taken at your request.
  • Complying with our legal obligations and responding to requests from authorities: legal obligation.

We do not use your data for advertising and we do not sell it.

5. Retention periods

Participant data. The organiser sets the retention period of each event: 24 months after the end of the event by default, adjustable from 1 to 120 months.

Automatic anonymisation at the end of that period is on by default for new events, and the organiser can turn it off. When it is on, a daily task anonymises participants whose period has ended. When it is off, only the email history is purged automatically when the period ends, and the organiser is responsible for erasing its participants' data itself. Whether automatic anonymisation is on or off, the owners of the organisation receive an email reminder 30 days, then 7 days, before the period ends, except for a draft event or a suspended organisation.

Other periods:

  • import files not applied: deleted after 30 days of inactivity; applied import files: deleted as soon as they are applied, together with their rows;
  • email history: 365 days, or earlier when the event's retention period ends;
  • public verification log (truncated IP address, browser): 365 days;
  • attendance QR tokens: deleted 24 hours after they expire;
  • badge and export files: available for 1 hour;
  • password reset link: valid for 1 hour; email change link: valid for 24 hours; these tokens are deleted after 7 days;
  • email verification link: valid for 24 hours; login session: 8 hours;
  • account: for as long as it is used; closure, done from the account, is immediate and erases the email address, name and password at once; participants of the organisations closed with the account are anonymised 30 days after closure;
  • proof of acceptance of the terms: 5 years after the account is closed;
  • audit log: for as long as the organisation exists, then deleted 30 days after it is closed, once its participants have been anonymised, except billing entries, kept for 10 years; a participant's personal data is removed from it upon anonymisation;
  • payments, invoices and accounting records: 10 years (Article L123-22 of the French Commercial Code), including after the account is closed;
  • contact form messages: they are not stored in the service; they stay in the publisher's mailbox for as long as needed to handle the request.

The retention periods for proof of acceptance and for accounting records are commitments that the publisher applies itself. Any backups are encrypted and hosted in the European Union; deleted data is cleared from them as they rotate.

6. Anonymisation

The organiser can anonymise a participant at any time, giving a reason. Automatic anonymisation at the end of the retention period is on by default for new events, and the organiser can turn it off. Anonymisation is an irreversible erasure of identity data: name, email address, phone number, organisation, country, reference, import data, participant account, email recipient, free-text reasons, paper abstracts and personal data in the audit log.

So that certificates already issued remain verifiable, anonymisation keeps a cryptographic fingerprint (HMAC) of the printed name, the certificate number, and the title and type of the deactivated papers; their abstract is erased. The fingerprint cannot be used to recover the name, only to confirm a name typed in. It is still pseudonymised data, and therefore personal data.

7. Recipients and processors

Your data is only accessible to authorised people: the organiser and its team according to their roles, and the publisher for operations and support, as far as necessary.

ConfCert uses the following providers, bound by data protection commitments:

  • application and database hosting: a hosting provider established in the European Union (OVH SAS, France, or Hetzner Online GmbH, Germany), identified in the Legal notice;
  • file storage (logos, signatures, imports, badges, certificates, exports): Cloudflare, Inc. (United States), R2 service;
  • bot protection on forms: Cloudflare, Inc. (United States), Turnstile service, which receives the IP address and technical browser information;
  • delivery of transactional emails and contact form messages: Amazon Web Services (Amazon SES, European Union region);
  • online payment: Stripe Payments Europe Ltd (Ireland), for organisers who buy a tier; when Link, a Stripe brand, sells the payment as reseller, it acts under its own terms;
  • error tracking, when enabled: Functional Software, Inc. (Sentry, United States), with personal data scrubbed.

We may disclose data to authorities where the law requires it. We do not pass it on to any other third party for commercial purposes.

8. Transfers outside the European Union

We favour processing within the European Union. Some providers may, however, access data from the United States. These transfers rely on the adequacy decision for the EU-US Data Privacy Framework for certified companies or, failing that, on the standard contractual clauses adopted by the European Commission:

  • application hosting provider: no transfer, data kept in the European Union;
  • Cloudflare, Inc. (R2 storage and Turnstile): Data Privacy Framework, or standard contractual clauses;
  • Amazon Web Services (Amazon SES): delivery from a European Union region; Data Privacy Framework, or standard contractual clauses, for any access from the United States;
  • Stripe Payments Europe Ltd: possible transfers to Stripe, Inc. in the United States; Data Privacy Framework, or standard contractual clauses;
  • Functional Software, Inc. (Sentry): Data Privacy Framework, or standard contractual clauses.

9. What is publicly visible

Two pages can be viewed without an account, from a link or a QR code:

  • the certificate verification page: validity (valid or revoked), event, dates and certificate type. As long as the participant has not been anonymised and the certificate has not been revoked, it also shows the holder's name in full and lets visitors download the certificate PDF. After anonymisation, the name is no longer shown;
  • the page shown when a badge is scanned: the public profile chosen by the organiser, off by default. Email addresses and phone numbers are never public.

On the verification page, visitors can check a name by typing it in. The number of attempts is limited and the name never appears in the page address. Links cannot be guessed and the pages are not indexed by search engines.

This verification relies on the legitimate interest of the organiser and of the holder in proving that the certificate is genuine. If you object to it, contact the organiser, who can revoke the certificate. If the event's organisation has been closed, contact ConfCert.

10. Your rights

You have the rights of access, rectification, erasure, objection, restriction of processing and portability, the right to withdraw your consent where processing is based on it, and the right to give instructions on what happens to your data after your death.

  • Account: use the contact form or the contact details given in the Legal notice. You can also correct your profile, sign out your sessions and close your account (erasure) from “My account”.
  • Participant: send your request to the event organiser. It can produce an individual export of a participant's data (access and portability) and anonymise a participant (erasure). If you cannot reach the organiser, write to us and we will forward your request.

We respond within one month, which may be extended in the cases provided for by law. We may ask for proof of identity if we have reasonable doubts about it.

No decision producing legal effects concerning you is based solely on automated processing (Article 22 GDPR).

11. Cookies and local storage

ConfCert sets no cookies and uses no audience measurement tool. The browser only keeps items that are strictly necessary for the service you request.

In the browser’s local storage (localStorage):

  • confcert_access_token: your session token, replaced at each login and removed when you sign out;
  • confcert_user: your profile (name, email address, roles), removed when you sign out;
  • confcert_locale: your language choice;
  • confcert_sidebar: your sidebar display preference (collapsed or expanded).

In the browser’s session storage (sessionStorage), cleared when the tab is closed:

  • confcert_pending_invitation and confcert_login_hint (email address): to resume an invitation after login, for 30 minutes at most;
  • confcert_chunk_reload: a technical flag that prevents a reload loop after an update.

On the sign-up, login, forgotten password, verification email resend and contact pages, the Cloudflare Turnstile bot protection service is loaded from challenges.cloudflare.com. It analyses technical browser information to tell humans from bots.

These items are strictly necessary and are therefore exempt from consent (Article 82 of the French Data Protection Act). You can clear them in your browser settings, which signs you out.

12. Security

We protect data with appropriate measures: encrypted connections, passwords stored as irreversible hashes, role-based access rights, separation of data by organisation, rate limiting and login attempt limits, bot protection, an audit log, and masking of email addresses and phone numbers in logs. Any backups are encrypted.

13. Data breaches

  • Account data: the publisher, as controller, notifies the breach to the CNIL (French data protection authority) within 72 hours where it poses a risk, and informs you directly if the risk is high.
  • Participant data: ConfCert, as processor, informs the organiser without undue delay and no later than 48 hours. The organiser, as controller, notifies the supervisory authority and, where required, the people concerned.

14. Minors

Accounts are reserved for adults and we do not knowingly create an account for a minor. If an organiser registers minors as participants, it is responsible for doing so (legal basis, consent of legal guardians where required).

15. Changes to this policy

We may update this policy. The version date appears at the top of the page. In the event of a significant change, we notify users by email before it takes effect.

16. Contact and complaints

For any question about your data, use the contact form or the contact details given in the Legal notice. No data protection officer (DPO) has been appointed, as ConfCert is not required to appoint one.

You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr) or with the data protection authority of your country of residence.

See also

Legal notice