Data Protection and Image Rights Clause for Event Registration
Key information and full terms and conditions
Data controller: Global LegalTech Hub Association (GLTH), with registered office at C/ Berlín 38–48, 1º, 08029 Barcelona, Spain, and tax identification number G67603605, acting as organiser and producer of legaltech events and initiatives worldwide (hereinafter, the “Organiser” or “GLTH”), info@hublegaltech.com
Purposes of processing: management of registration, sale and issuance of tickets, access control, customer service for registered participants, administrative, accounting and tax management of the event, operational communications related to registration, compliance with legal obligations, incident management, security, production and dissemination of audiovisual material from the event, third-party sponsorship and, where applicable, the conducting, recording, editing and dissemination of interviews, statements or testimonials collected during the event.
Legal basis: performance of the pre-contractual or contractual relationship arising from registration; compliance with legal obligations; the data controller’s legitimate interest for the purposes of organisation, security, fraud prevention, sponsorship, certification of the event’s successful staging and general documentation thereof; and, where required, the data subject’s express consent.
Recipients: suppliers necessary for the management of the event and the ticketing or registration platform, technology hosting, payment gateway, IT support, audiovisual services, security and other data processors; sponsors, public authorities, courts and tribunals where there is a legal obligation; and third parties other than those listed above only where there is a valid legal basis. Data will be disclosed to sponsors or partners.
International transfers: these may occur when using suppliers located outside the European Economic Area or with remote access from third countries, in which case the safeguards required by Regulation (EU) 2016/679 and applicable legislation will be adopted.
Retention periods: data will be retained for as long as necessary to manage registration and attendance at the event, for the duration of the applicable legal time limits, and, in a restricted form, for the duration of the limitation periods for liability. Images, videos and interviews may be retained for as long as they retain informational, promotional, historical, documentary or corporate value, unless there is an objection or withdrawal where this is legally applicable and there is no other basis legitimising their processing or retention.
Rights: access, rectification, erasure, objection, restriction of processing, data portability and withdrawal of consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal. A complaint may also be lodged with the Spanish Data Protection Agency.
Recommended contractual/informative text for websites or ticketing systems
FIRST. Identity of the data controller and scope of the processing
By completing and submitting this registration form, as well as by purchasing tickets or passes for the GLTHDAY event, the user consents to the processing of the personal data provided by GLTH, as the data controller, for the purposes and under the terms set out in this clause.
The user declares that the data provided is accurate, up to date and truthful, and undertakes to notify GLTH of any changes necessary for its proper management. In the event of providing data relating to third parties, the user declares that they have sufficient authorisation to do so and undertakes to provide those third parties, in advance, with the information contained in this clause, thereby exempting GLTH from any liability arising from a breach of this obligation.
SECOND. – Main purposes and legal basis
Personal data will be processed for the following purposes, with a clear distinction made between the respective legal bases:
1. To manage registration, booking, purchase, ticket issuance, accreditation, access to and attendance at the event, including necessary communications before, during and after the event, handling enquiries, incidents, changes to timetables and venues, cancellations, invoicing and payment processing. Legal basis: performance of a pre-contractual and/or contractual relationship.
2. To comply with legal, sponsorship, tax, accounting, security and cooperation obligations with the competent authorities. Legal basis: compliance with legal obligations.
3. To ensure the safety of people, facilities, systems and the organisation of the event; to prevent unauthorised access, fraud, misuse of tickets, complaints or incidents; and to demonstrate that the event has been properly organised and held. Legal basis: the data controller’s legitimate interest, weighed against applicable regulations.
4. To capture and disseminate general images of the event atmosphere through photographs or audiovisual recordings in which attendees may appear incidentally, panoramically or contextually, for the purposes of information, corporate communication, archiving, recording of activities and legitimate promotion of the event or related activities of the organising body. Legal basis: legitimate interest, without prejudice to the rights of the data subject and the application of Organic Law 1/1982 of 5 May where applicable.
5. To record, reproduce, edit, publicly communicate and disseminate interviews, statements, testimonies or individual contributions from attendees, speakers, participants or guests, as well as to use their name, voice, image and, where applicable, their position, profession or the organisation to which they belong, on the website, social media, promotional material, press releases, corporate media, streaming services, on-demand recordings, reports and informational materials produced by the data controller. Legal basis: the data subject’s express, specific, informed and unambiguous consent, unless another clearly applicable legal basis exists in accordance with the specific case.
6. To send our own commercial communications regarding future activities, events or initiatives of the organising body and sponsors via electronic or non-electronic means. Legal basis: express consent or, where legally applicable, legitimate interest within the terms permitted by applicable regulations.
Failure to provide the data strictly necessary for the purposes set out in paragraphs 1 and 2 may prevent the registration from being completed or the provision of services associated with the event.
THIRD.- Data processed and source
In general, the following data may be processed: identification and contact details, billing and payment details, professional details, details relating to organisational or logistical preferences provided by the data subject, data derived from attendance at and participation in the event, images, voice recordings and the content of interviews. The data will be obtained directly from the data subject, their representative, the organisation on whose behalf they are acting, or from duly authorised third-party sales or registration intermediaries.
Unless expressly stated otherwise and there is a sufficient legal basis, the data controller does not request special categories of data. Users are requested not to provide information of this nature via the form or during interviews. If, in exceptional circumstances, it is necessary to process data subject to special protection due to accessibility, health or specific assistance requirements, such processing will be limited to what is strictly necessary, with enhanced confidentiality measures and on the legal basis applicable in each case.
FOURTH. – Interviews, individual recordings and the transfer of image, voice and speech rights
Where the registered person voluntarily participates in an interview, statement, testimony, recorded speech or any individual recording of their image or voice, they authorise, by ticking the relevant box or via a separate acceptance mechanism, the data controller to capture, record, reproduce, distribute, publicly communicate, make available, edit and carry out any technical modifications necessary to adapt their image, voice, name and the content of their contribution to formats or channels, and to disseminate them, for the purpose of informing, documenting, archiving and promoting the event, the organising body’s activities and its related initiatives.
This authorisation shall cover the use of the materials on websites, social media, video platforms, streaming services, printed or digital materials, press releases, reports, dossiers, newsletters, corporate presentations and any other communication media owned by the data controller, with national and international scope, given the online accessibility of certain channels, and for a period of 3 years or, if a broader formulation is preferred, for as long as the material retains informational, promotional, documentary or historical value in relation to the activity, without prejudice to the legally applicable rights of revocation and objection.
This authorisation is non-exclusive and free of charge, unless otherwise agreed in writing, and does not entitle the interviewee to any financial compensation for the mere recording or broadcasting of their image, voice or remarks, unless otherwise expressly agreed.
The data controller undertakes not to use the material in a humiliating, denigrating or seriously harmful manner taken out of context, or in a manner contrary to the law, morality, public order or the dignity of the individual, and to respect, in all cases, the limits arising from data protection regulations and Organic Law 1/1982 of 5 May.
The withdrawal of consent for interviews or individualised uses of image and voice shall not have retroactive effect with regard to processing already carried out lawfully, nor shall it necessarily oblige the removal of material already incorporated into archives, printed publications, historical recordings, reports already disseminated or content for which there is another legitimate basis for retention, without prejudice to the controller’s assessment of each request in accordance with applicable regulations.
FIFTH. General footage of the event and visible notice
The event may be the subject of general photographic and/or audiovisual coverage. By attending the venue or taking part in the scheduled activities, attendees acknowledge that they have been informed that their image or voice may appear incidentally or in the background in general shots of the audience or the event atmosphere, for legitimate purposes of information, promotion, archiving and recording of activities.
SIXTH. Recipients, data processors and prohibition of indiscriminate disclosure
Data may be disclosed to or made accessible to, exclusively to the extent necessary, suppliers providing services to the data controller in their capacity as data processors or, where applicable, as independent data controllers where the nature of the service so requires, such as ticketing or registration platforms, hosting and storage services, payment gateways, technical support, emailing tools, security, audiovisual production companies, photographers, streaming providers, insurers, legal, tax or accounting advisors, and other collaborators essential to the running of the event.
Such third parties shall process the data in accordance with the instructions of the data controller or their own legal status, subject to the contracts and guarantees required by Regulation (EU) 2016/679 and by Organic Law 3/2018 of 5 December.
Personal data will be transferred to sponsors, partners, exhibitors or third parties for their own purposes of marketing, commercial prospecting or independent use of databases, unless the data subject has previously refused to give specific, separate and unambiguous consent, or there is another valid legal basis of which they have been duly informed.
SEVENTH. International data transfers
Where service providers located outside the European Economic Area are used for the provision of services, or where such provision involves remote access from third countries, the data controller shall adopt the appropriate safeguards required by the regulations, including, where applicable, adequacy decisions, standard contractual clauses, binding corporate rules or other valid mechanisms, and shall inform the data subject thereof where required.
EIGHT. Data Retention
Personal data will be retained for as long as necessary to process the registration, provide the services associated with the event, and fulfil the purposes described. Thereafter, it may be retained in a securely restricted format for the duration of the statutory limitation periods for legal actions and administrative, civil, commercial or criminal liabilities.
Financial and billing data will be retained for the periods required by tax and accounting regulations. General images of the event may be retained for as long as they remain reasonably useful for informational, historical, archival or corporate memory purposes. Individual interviews and recordings based on consent will be retained until such consent is withdrawn or for as long as the purpose justifying their collection and dissemination remains valid, without prejudice to the retention necessary to prove consent has been given, to deal with complaints or to defend the legitimate interests of the data controller.
SECTION 9. Rights of data subjects
Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw any consent given at any time, by sending a request to info@hublegaltech.com, providing proof of their identity and specifying the right they wish to exercise.
Where processing is based on legitimate interests, the data subject may object to such processing on grounds relating to their particular situation. Where processing is based on consent, the withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.
If the data subject considers that their rights have not been duly respected, they may lodge a complaint with the Spanish Data Protection Agency.
TENTH.- Minors
The registration of minors and their participation in the event is prohibited; furthermore, the recording and dissemination of their image, voice or interviews will require the involvement and authorisation of the person holding parental authority or legal guardianship, in accordance with the terms set out in the applicable regulations. In the case of minors, it is recommended that specific, express and verifiable authorisation be obtained for any interview or individual use of their image or voice.
ELEVENTH.- Security and confidentiality
The data controller shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, restricting access to the data to authorised personnel and strictly necessary third parties, who are subject to confidentiality obligations.
TWELFTH. – Recommended checkboxes and terms of acceptance for the form
In order to ensure a more legally robust registration process, it is recommended that the following distinct checkboxes be included on the website or in the ticketing system:
Data controller: Global Legaltech Hub / GLTH. Purpose: to manage your registration, entry and attendance at the event, to deal with incidents, to comply with legal and sponsorship obligations and, where applicable, to manage images, recordings and interviews. Legal basis: performance of the contractual relationship, compliance with legal obligations, legitimate interest in the organisation and security of the event, and express consent for promotional purposes, particularly interviews, commercial communications and any transfers to third parties. Recipients: Sponsors, suppliers necessary for the management of the event and authorities where applicable. Data will be transferred to sponsors. Rights: access, rectification, erasure, objection, restriction, portability and withdrawal of consent at info@hutblagaltech.com. Further information in the Privacy Policy