The following provisions aim at informing participants about personal data processing in connection with our events in accordance with the requirements of the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), especially with due regard to the information obligation according to Art 12-14 GDPR, as well as to information on the rights of the parties concerned according to Art 15-22 and Art 34 GDPR.

SIA Social Impact Award gemeinnützige GmbH (hereinafter referred to as either “we” or “Social Impact Award”) made an effort to present the following information precisely, transparently and comprehensively in a clear and easy language.

Application

This statement applies to all personal data of participants that is collected by Social Impact Award or made available to Social Impact Award in connection with an event we organize, including events we co-host with a licensee, wherever they take place, and in any format, including electronically, on paper or verbally.

Definition

The following definition applies to the purposes of this statement:

• “Personal data” refers to all information about a (natural) person who can be identified either directly from the provided data or from the data combined with other information.

Processing your personal data as a participant

Registration for our events

When you register for one of our events, we process your name and email address and, if the event is ticketed, your ticket and order details. We use this data to organize the event and to communicate with you about it. We do this on the legal basis of the necessity to perform a contract or to take pre-contractual measures (Art 6 (1) lit b GDPR).

You are not obliged to provide us with your personal data. Nevertheless, it is not possible to register you for an event if you do not do so.

Participants under 18

For some events, such as events with accommodation, participants under 18 need the consent of a parent or legal guardian to attend. For this purpose, we process the name, phone number, email address, address and signature of the parent or legal guardian as stated on the parental consent form. We do this in order to document the consent and to be able to reach the parent or legal guardian if necessary, on the legal basis of the necessity to perform a contract (Art 6 (1) lit b GDPR) and of our legitimate interest in documenting the consent (Art 6 (1) lit f GDPR).

Participants aged 14 to 17 can give their consent for photos and video recordings themselves.

Photos and video recordings

We document our events with photos and video recordings. They are taken by our team, by photographers we hire, and sometimes by other participants who share their photos with us. If you consent, we use images in which you can be identified to document the event, to publish them on our website, on social media, in our newsletter, in print and in the press, and in our reports to funders and partners. We do this on the legal basis of your consent (Art 6 (1) lit a GDPR).

Giving your consent is optional, and saying no does not affect your participation. If you do not consent, we note this at sign-in, and when we select photos for use, we leave out or crop those in which you can be identified. Photos shared with us by other participants are published only with the permission of the person who took them, and we credit them.

Photos that other participants take and share privately are their own responsibility, not that of Social Impact Award. If you find yourself in such a photo, please contact the person who took it.

Processing your personal data at events with extended registration

For some events, such as summits or retreats, we use an extended registration form. Such events often involve travel, shared accommodation and several days together. The form shows which of the following data we ask for and which fields are required to register.

Contact details and organization

To organize the event and to reach you during it, we may ask for your phone number, your organization and your role in it. We process this data on the legal basis of the necessity to perform a contract (Art 6 (1) lit b GDPR).

Date of birth

We ask for your date of birth to know which participants are under 18 at the start of the event. We process it on the legal basis of the necessity to perform a contract (Art 6 (1) lit b GDPR).

Travel and accommodation

If the event involves travel and accommodation, we ask for your arrival and departure dates, your accommodation needs, whether you need a visa, and, if you request an invitation letter for your visa application, the details needed for it. We process this data on the legal basis of the necessity to perform a contract (Art 6 (1) lit b GDPR).

Gender

If you tell us your gender, we use it only to allocate rooms where we arrange shared accommodation. We process it on the legal basis of your consent (Art 6 (1) lit a GDPR).

Profile photo

If you upload a profile photo, we show it on the People’s Wall and in the Sugarcubes, the space where participants leave each other kind messages and capture their memories of the event. Both are displayed only in the event room, where other participants can see them. We process it on the legal basis of your consent (Art 6 (1) lit a GDPR).

Dietary preferences and accessibility requirements

If you share dietary preferences or accessibility requirements, we use them so that the catering and the venue work for you. Because such information can reveal details about your health or your religious beliefs, it belongs to the special categories of personal data, and we process it only on the legal basis of your explicit consent (Art 9 (2) lit a GDPR).

Emergency contact

We ask you to name an emergency contact, so that we can reach someone on your behalf should something happen during the event. We process their name, email address and phone number on the legal basis of our legitimate interest in your safety (Art 6 (1) lit f GDPR). Please let this person know that you have given us their details.

Where we store your data

Registration data is collected through Eventbrite or Airtable and stored in Airtable and Google Workspace. These providers process your data on our behalf. Eventbrite additionally processes some data for its own purposes, for example to manage your Eventbrite account, and does so as a separate controller under its own privacy policy.

Access is limited to the people organizing the event. Beyond that, your data is shared only where the organization of the event requires it: if we book accommodation for you, the hotel receives the details needed for the booking, and for co-hosted events, the licensee receives only the data needed for logistics. Event photos may appear in our reports to funders and partners. Published photos are visible to anyone and, once online, can be copied by others beyond our control.

Airtable Inc. and Eventbrite are based in the United States. Where your data is transferred there, we rely on appropriate safeguards, such as Standard Contractual Clauses, as required under Art 46 GDPR. Some of our events take place outside the European Union. For those, hotels and co-hosts in the host country receive the data needed to organize your participation and stay; these transfers are necessary to perform our agreement with you (Art 49 (1) lit b GDPR).

Saving your personal data

Generally, your registration, travel and accommodation data, as well as parental consent forms and the parent’s or legal guardian’s details, are kept for three years from the end of the event, as long as potential legal claims can be raised, unless a legal retention period prescribes longer (for example, for accounting records). After this period, we also remove the event from our Eventbrite account. Data that Eventbrite keeps as a separate controller, for example for your Eventbrite account or for its financial records, is subject to Eventbrite’s own privacy policy.

Your gender, dietary preferences, accessibility requirements, emergency contact and profile photo are only needed for the event itself and are deleted one month after it ends.

A selection of published photos and video recordings is kept as part of the event history of Social Impact Award. All other photos and recordings are deleted two years after the event.

We may keep aggregated figures, such as the number of participants per country, without time limit. Such statistics no longer identify you and are therefore not personal data.

Safety

Social Impact Award makes the necessary arrangements in compliance with the applicable data protection laws in order to protect the personal data in our possession from loss, misuse, unauthorized access, publication, modification or deletion.

Your rights concerning personal data

You are inter alia entitled to (i) verify if and what personal data about you we process and to receive copies of this data, (ii) to request the revision, the supplementation or the deletion of your personal data, as long as it is false or not in conformity with the law, (iii) to make a request at us to limit your data processing, (iv) under certain circumstances to object to your data processing or to revoke your consent to data processing, whereby a revocation does not affect the legality of the processing prior to the revocation, (v) to request data portability, (vi) to know the identity of third parties to whom your personal data is transmitted and (vii) to lodge a complaint with the Data Protection Authority.

You can revoke your consent at any time by writing to privacy@socialimpactaward.net. If you revoke your consent for photos and video recordings, we will not use your images in new publications and will remove or blur you in existing online ones where possible.

For all other requests, write to privacy@socialimpactaward.net.

More information concerning your data

This statement is detailing the management of personal data of participants in Social Impact Award events, for example a summit, a retreat or a workshop.

• Our general Privacy Policy statement, including expanded rights and the Data Protection Officer contact information;
• Our Imprint, including contact details.