Privacy, legal notice and accessibility

1. Who is the controller

The data controller is [COMPLETAR: legal name of the organisation], tax ID (NIF) [COMPLETAR], registered address [COMPLETAR: full address].

For any data protection matter and to exercise your rights: dpo@kawaruconsulting.com. For general questions about the event: info@iaton.cat.

[COMPLETAR: state whether dpo@kawaruconsulting.com is a data protection officer appointed and notified to the AEPD, or only a privacy contact channel, and Kawaru Consulting’s relationship with the controller].

2. What data we process

We only process the data you give us in the forms, the chat content if you use it and a minimum of technical data about the website. Fields marked * are required.

• All forms: full name*, email*, organisation*, job title* and acceptance of the privacy policy*. We automatically add the date and time received, the page language, the address of the page you sent it from and a reference code.
• Application: area*, project name*, short description*, in production since (month and year)*, measured impact, cost and timeline, what didn’t work*, the statement that the case meets the requirements* and, if you wish, attachments: up to 5 files, 5 MB per file and 12 MB in total, in PDF, DOC, DOCX, PPT, PPTX, XLS, XLSX, PNG, JPG, JPEG, WEBP or ZIP format.
• Registration: type of organisation*, profile*, accessibility, dietary or other needs (optional), afterwork attendance (optional), whether you join the waiting list and two separate optional consents: receiving the programme and the report by email, and the use of your image and voice in the photos, videos and live stream of the event.
• Sponsorship: type of organisation*, type of contribution* and message (optional).
• Chat (only if you open it): the messages you write, the files you attach and, if you turn on voice or the avatar, the audio you send. This content is processed by the chat service provider.
• Technical website data: as described in section 6. The IP address is only used in memory to estimate your approximate location and, to prevent abuse, it is stored as a hash with a salt that changes every day.
• Committee members and organisers (internal panel only): name, email, role, password stored as a hash, date of last access, scores and comments, and an activity log.

Health data: the optional accessibility or dietary needs field may reveal health information (for example, an allergy or a disability). Only use it if you need to; by filling it in you give us your explicit consent to process that information for the sole purpose of adapting the event. We do not ask for any other special category of data. In attachments, please avoid including personal data that is not needed to assess the case.

3. Purposes and legal basis

• Handling your request (application, registration or sponsorship), replying, sending you the confirmation and, for applications, having the committee assess them anonymised: your consent (Art. 6(1)(a) GDPR) and steps taken at your request before entering into an agreement (Art. 6(1)(b) GDPR). [COMPLETAR: confirm legal bases with legal advisers]
• Adapting the event to the accessibility or dietary needs you tell us about: your explicit consent (Art. 9(2)(a) GDPR).
• Sending you the programme and the IAton 2027 Report (2 emails at most), only if you tick the box: consent (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI), which you can withdraw at any time.
• Publishing photos, videos and the live stream of the event in which you may appear, only if you tick the box: consent (Art. 6(1)(a) GDPR and Spanish Organic Law 1/1982), which you can withdraw at any time. The “What didn’t work” session is neither recorded nor streamed.
• Assisting you via the chat, if you open it: your consent when you start it. [COMPLETAR: confirm legal basis and provider role]
• Aggregated website analytics, to understand what works and improve the content: legitimate interest (Art. 6(1)(f) GDPR). Nothing is stored on your device for this and you can object with the button on this page.
• Security and abuse prevention (attempt limits, anti-spam, panel activity log and backups): legitimate interest (Art. 6(1)(f) GDPR).

We do not build marketing profiles, we do not sell data and we do not make automated decisions with legal effects on you.

4. How long we keep it

• Requests and attachments: kept until the organisers delete them from the panel (deleting a request also deletes its files). Planned period: [COMPLETAR: for example, 12 months after the event]. There is currently no automatic deletion. The notification for each request (with attachments) is sent to the info@iaton.cat mailbox and kept there [COMPLETAR: mailbox retention].
• Optional consents (programme and report; image and voice): until you withdraw them or, at most, the period above. Images already published before withdrawal [COMPLETAR: policy for removing published material].
• Website analytics: 13 months; older events are deleted automatically. Because the IP salt changes every day, identifiers can only be linked within the same day.
• Login and submission attempts (to prevent abuse): 7 days.
• Panel activity log: the 300 most recent entries. Password recovery links: valid for 60 minutes and deleted once expired.
• Backups (database and attachments): 21 days.
• Email delivery error log (date, request code and address): until the issue is resolved. [COMPLETAR: period; it is not deleted automatically at present]
• Chat conversations: according to the provider’s policy [COMPLETAR]. Your browser keeps a local copy (see the cookie policy).

5. Who can access it

We do not share your data with third parties for their own purposes. The following may access it:

• Organising staff and the selection committee, with access limited to their role. The committee sees applications anonymised (without name, job title, email or organisation), but it does see attachments exactly as you send them.
• Web hosting and email: [COMPLETAR: hosting provider and server country]. The website, database, attachments and backups are stored with this host, and emails (notifications and confirmations) are sent through the same host’s mail service. [COMPLETAR: provider of the info@iaton.cat mailbox].
• Chat (Kawaru Channels / Nebomind), only if you open it: receives your IP address, your messages and, if you turn on voice or the avatar, the audio. [COMPLETAR: entity and location]. The avatar uses LiveAvatar technology (the api.liveavatar.com service, in the United States) and downloads its software from jsDelivr (cdn.jsdelivr.net); both receive your IP address.
• Accessibility widget (BeMyVega), only if you turn it on: receives your IP address and, when it loads, requests fonts from Google Fonts and CDNFonts and, if you choose the large cursor, from Nagich. It is configured with the provider’s analytics turned off.
• Google: only if you press “Load the interactive map” (Google Maps is embedded) or open the links to Google Maps or Google Calendar. The website loads no other Google resources: its fonts are hosted on our own server.
• Public authorities and courts, where there is a legal obligation.

International transfers: LiveAvatar (United States) and Google may process data outside the European Economic Area. This only happens if you use the avatar chat or the Google services mentioned. [COMPLETAR: safeguards for each provider, for example the EU-US Data Privacy Framework or standard contractual clauses].

6. Analytics and local storage

This website uses its own analytics, hosted on our server. It uses no cookies and stores no identifier in your browser, and it does not track you across other sites.

How we count visitors without identifying you: the server computes a hash of the IP address with a secret salt that changes every day and, from that hash and the browser (user agent), a visitor identifier that can only be compared within the same day. The session (30 minutes of inactivity) is also derived on the server. The IP address is never stored in clear.

What we measure: pages and sections viewed, clicks on buttons and links, form submissions (without their content), language, device type, browser family and major version, operating system, approximate screen size, connection type, referring domain, campaign (utm) parameters in the URL, time zone, reading depth, active time, performance indicators (LCP, INP, CLS, TTFB and load time) and technical JavaScript errors. From the IP address (in memory) or the time zone we estimate the approximate country, region, province and municipality, with coordinates rounded to about 1 km. Geolocation uses a local database (DB-IP) or the CDN’s headers; the IP address is not sent to any third party.

We respect Do Not Track and Global Privacy Control: if they are on, nothing is counted. You can also turn analytics off in this browser with the button below (this stores the iaton-metrica-off key).

Third-party services (chat, accessibility and Google Maps) are not loaded until you ask for them. The keys that may be stored in your browser are listed in the cookie policy.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent (including the optional ones for communications and image) at any time, without affecting earlier processing, by emailing dpo@kawaruconsulting.com. We will reply within one month. We will need to be able to identify you reasonably in order to protect your data.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan, 6, 28001 Madrid · www.aepd.es) or with the supervisory authority in your country.

8. Security

We apply proportionate technical and organisational measures: HTTPS, hashed passwords, two-factor authentication for the organiser account, role-based access control, attempt limits per IP and per account, anti-spam protection on forms, checks on the real type of attached files, attachments stored outside public access with unguessable names, pseudonymised IP addresses, backups and an activity log. No system is infallible; if we detect a relevant security breach, we will act according to the organisation’s protocol and notify it where required.

9. Accessibility

We want IAton 2027 to be usable by everyone. The site is built with semantic HTML, keyboard navigation, alternative text, sufficient contrast and support for prefers-reduced-motion.

If you find an accessibility barrier, email info@iaton.cat with the page and the problem. [COMPLETAR: if the organisation is in the public sector, add the conformity statement under Royal Decree 1112/2018 and the complaints procedure].

The accessibility button (bottom left) loads the BeMyVega widget only when you press it. From then on, the widget stores your preferences (contrast, text size, etc.) in your browser and the website remembers that you turned it on so that they apply on later visits.

10. Legal notice

In accordance with Article 10 of Spanish Law 34/2002 (LSSI), this website is owned by [COMPLETAR: legal name], tax ID (NIF) [COMPLETAR], registered address [COMPLETAR], email info@iaton.cat. [COMPLETAR: company register details, if applicable].

The content of this site is for information purposes. IAton 2027 may change the programme, speakers, dates or participation conditions for organisational reasons, with prior notice whenever possible.

Texts, trademarks, images and graphic elements belong to the organisers or are used with permission. They may not be reproduced for commercial purposes without permission. External links are provided for convenience and do not imply responsibility for their content.

The relationship with users is governed by Spanish law. For any dispute, the parties submit to the courts that have legal jurisdiction. [COMPLETAR: applicable jurisdiction if needed].