Privacy Policy

This is a courtesy translation. The Polish version at /polityka-prywatnosci.html is the legally binding one.

This policy explains what personal data we process in connection with the operation of alphacon.pl and the organization of the Alphacon nano event, for what purposes and on what legal grounds we do so, and what rights you have under the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council).

§1. Data controller

The controller of your personal data is Alphasec sp. z o.o., with its registered seat in Kiełczów, address: ul. Parkowa 31, 55-093 Kiełczów, Poland, KRS 0000806684, NIP 8971871380, REGON 384532699 (hereinafter: the “Controller” or “we”). Alphacon is an event organized by the Controller.

§2. Contact on data matters

For any matters concerning personal data, you can reach us by email at alphacon@alphasec.pl or info@alphasec.pl, or in writing at the registered seat address given in §1.

The Controller has not appointed a Data Protection Officer (DPO), as it is not required to do so by law.

§3. Purposes, legal grounds and scope of data

We process only the data you provide us yourself in the sign-up form or in correspondence, plus basic technical data necessary for the secure operation of the site.

• Handling your event sign-up — getting in touch about participation, a talk, or a partnership, and notifying you when registration opens. Scope: full name, email address, type of participation, the content of the “additional info” field. Legal basis: Article 6(1)(a) GDPR — your consent, which you can withdraw at any time.
• Organizing the event — if you sign up for a talk or a partnership and arrangements proceed, we also process data under Article 6(1)(b) (steps taken prior to entering into a contract, and its performance) and Article 6(1)(f) (conducting correspondence).
• Security and anti-spam protection — verifying the form with the Cloudflare Turnstile mechanism, server logs, preventing abuse. Scope: IP address, technical browser data, verification result. Legal basis: Article 6(1)(f) — legitimate interest.
• Establishing, pursuing, or defending legal claims. Legal basis: Article 6(1)(f).

§4. Recipients of data

We do not sell your data and do not share it with third parties for their own marketing purposes. Your data may only reach:

• Cloudflare, Inc. — provider of the Turnstile anti-spam mechanism protecting the form, and of the cookie-free visit statistics of Cloudflare Web Analytics.
• OVH Sp. z o.o., with its registered seat in Wrocław (ul. Powstańców Śląskich 9, 53-332 Wrocław, Poland) — our hosting provider, on whose servers the site runs, and our email provider, through which we conduct correspondence.
• Google LLC — only if you yourself launch the directions map with the button in the “Venue” section, or click a link to maps. Without that action, we send Google nothing. Google acts here as a separate, independent controller, on its own terms — details in §9.
• Public authorities — only where an obligation to disclose data arises from the law.

We entrust data to processors acting on our behalf under data processing agreements compliant with Article 28 GDPR.

§5. Retention periods

• Event sign-ups — until consent is withdrawn, or, if consent is not withdrawn, no longer than 24 months from the last edition the sign-up concerned.
• Correspondence — for as long as the matter is being handled, and then until the statute of limitations for claims expires.
• Technical logs — for the period necessary to ensure security, usually no longer than 12 months.

§6. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, Poland.

§7. Voluntary provision of data

Providing your data is entirely voluntary, but without an email address we are not able to get back to you about your sign-up or notify you when registration opens.

§8. No profiling or automated decisions

We do not profile you and do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.

§9. Cookies, browser storage and external services

The site does not use analytics or marketing cookies and does not use Google Analytics. We do not embed advertising pixels and do not build visitor profiles. That's why the site does not show a cookie consent banner — the consent required under Article 173 of the Polish Telecommunications Law concerns storing information on your device, and we only do that for technical purposes.

• Cloudflare Web Analytics — visit statistics that store no cookies whatsoever, use no localStorage or other browser state, and apply no “fingerprinting” based on IP address, User-Agent header, or other data. The tool does not track individual people — it counts page views and visits from outside our domain.
• Cloudflare Turnstile — loaded on the page with the form; it may store technical data necessary to verify that a submission is being sent by a human. This mechanism is necessary to protect the form.
• Fonts — we serve them from our own server. We do not connect to Google Fonts, so your IP address never reaches Google.
• Sign-up counter — the “Sign up” section fetches, from the alphasec.pl server, only the number of people signed up for the next edition. We don't send any of your data there, and the server sees only what any server sees on an ordinary connection: your IP address and basic technical browser data. Both sites are operated by the same controller named in §1, so no external recipient is involved. The response contains no personal data and does not store any cookie in your browser.
• Maps — the Google map does not load automatically. In the “Venue” section you see a plain tile with a button, and the map only connects to Google's servers once you click it yourself. Until then, your IP address never reaches Google and no cookie from that service is stored. Clicking it counts as consent to connect to Google LLC, which can then store its own cookies in your browser and learn your IP address, on the terms described in Google's privacy policy. You withdraw consent by refreshing the page — the map returns to its inactive state. Next to the tile there is also a plain link to maps, which behaves the same way: it sends nothing until you click it.

§10. Data transfers outside the EEA

Using Cloudflare, Inc.'s services may involve transferring data outside the European Economic Area. This takes place on the basis of standard contractual clauses approved by the European Commission, or another mechanism provided for in Chapter V GDPR. If you launch the directions map, data will also reach Google LLC in the United States — the legal basis is then your consent expressed by clicking, and Google is listed among the entities certified under the Data Privacy Framework.

§11. Data security

We apply technical and organizational measures appropriate to the risk — among others, encrypted transmission (HTTPS), restricted access to data, and protection of the form against automated abuse.

§12. Changes to this privacy policy

We may update this policy, for example in connection with a change in the scope of our services or in the law. The current version is always available at this address, and the effective date is shown at the top of the document.

// Alphacon is a conference under the Alphasec umbrella. The privacy policy of alphasec.pl is a separate document.