Data processing terms

Last updated: 2026-11-06

These terms apply when you, the organiser of an event ("the controller"), use the Service and we ("the processor") process personal data for you. They are part of the terms of service and meet the requirements of Article 28 of the General Data Protection Regulation (GDPR).

My Conference
Portugal
E-mail: info@my-conference.net

1. Subject, nature and purpose

We host the event you create and process the data entered in it (by you, your team and your participants) only to provide the Service to you: storing it, showing it to the people you allow, sending the e-mails that you or the event send, generating the documents you ask for, applying the limits of your plan, and making it available for export.

2. Duration

For as long as the event exists, including the period in which it is read-only, and until its deletion as described in the terms of service. A copy kept after deletion is removed after 30 days.

3. Data subjects and data

• People: participants, authors, co-authors, reviewers, speakers, members of your organising team and visitors of the event pages.
• Data: identification and contact data, institution and profession, choices made in registration forms, abstracts, submissions and files, reviews and comments, payment and invoicing details as you configure them, communication records.
• You must not collect special categories of data (for example health data) unless it is necessary and you have a legal basis for it.

4. What we do

• We process the data only on your documented instructions, which are these terms, the terms of service and your use of the settings of the event. If we think an instruction breaks the law we tell you.
• Everyone who has access on our side is bound by confidentiality.
• We apply the security measures in section 6.
• We help you, within reason, to respond to the requests of data subjects. The event has tools to export, correct and delete what it holds, and we can help if you cannot reach something.
• We tell you without undue delay after becoming aware of a personal data breach that affects your event, with what we know, to help you meet your own duties.
• We help you with impact assessments and consultations with the authority when they concern the Service, if you ask.
• At the end, you can export your data (also while the event is read-only) and then it is deleted as described above.
• We give you the information needed to show that we comply with these terms, and allow reasonable audits, with notice, that do not put other customers' data at risk.

5. Sub-processors and transfers

• Contabo GmbH (Germany): hosting of the servers, in the European Union.
• The services you connect to your event (a card or reference payment gateway, an invoicing service, an external e-mail account) are not our sub-processors: you choose them and have your own agreement with them.
• We do not move the content of your events outside the European Economic Area. We will tell you before adding or replacing a sub-processor, by e-mail, at least 30 days ahead, so that you can object or close the event.

6. Security measures

• Each event has its own database, files and system user, isolated from the others.
• Encrypted connections (HTTPS); passwords stored only as hashes.
• Access to the administration of the platform is restricted and logged.
• Limits on registration, sign-in and sending, and a check against bots, to reduce abuse.
• Software updates and monitoring as part of running the service.

These measures may change as long as the level of protection is not lowered.

7. Your duties as controller

You are responsible for the lawfulness of the processing, for informing participants (privacy notice of your event), for the legal basis, for the retention you choose, and for the accuracy of what you enter.

8. Contact

info@my-conference.net