Privacy Policy & Data Protection

Introduction and Scope

The International Conference on Environmental Research and Nuclear Sciences (“ERaNS NextGen Conference”, “we”, “us”, or “our”) is committed to protecting the privacy, confidentiality, and security of personal data collected through the conference platform and related services.

This Privacy Policy explains how personal data is collected, used, stored, and protected in connection with the ERaNS NextGen Conference, including the official conference website located at:

https://www.erans.org

The conference platform and related services are provided for purposes including conference registration, abstract submission, scientific review, participant communication, academic publication, and conference administration.

We are committed to ensuring that all personal data is processed lawfully, fairly, and transparently in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

When this Privacy Policy refers to “ERaNS NextGen Conference”, “we”, “us”, or “our”, it refers to the Data Controller responsible for processing your personal data in accordance with this Policy.

“Personal Data” means any information relating to an identified or identifiable natural person, as defined under the GDPR.

For questions about this Privacy Policy or requests concerning your personal data, please contact the Data Controller using the contact details in Sections 1 and 21.

1. Data Controller

The Data Controller responsible for the processing of personal data is:

Name:

Email: 

Location: Egyetem utca 10. 8200, Veszprém. Hungary.

For any questions regarding data protection, please contact the Data Controller at the email address above.

2. Data Protection Principles

Personal data is processed in accordance with the principles established under the General Data Protection Regulation (EU) 2016/679 (“GDPR”). We are committed to ensuring that personal data is:

• processed lawfully, fairly, and transparently;
• collected only for specified and legitimate purposes;
• limited to data that is necessary for conference-related activities;
• accurate and kept up to date where necessary;
• retained only for as long as required for the purposes described in this Policy; and
• protected through appropriate technical and organizational security measures.

Access to personal data is restricted to authorized individuals involved in conference administration, scientific review, technical operation, or legal compliance obligations.

3. Source of Personal Data

Personal data is collected directly from participants, authors, reviewers, and visitors through conference registration forms, abstract submission systems, email communications, uploaded materials, cookies, and interactions with the conference website or platform.

In limited cases, data may also be received from affiliated institutions, co-authors, payment processors, or technical service providers where necessary for conference administration.

4. Purpose of Data Collection and Processing

Data collected through this portal is used solely for the following academic and administrative purposes:

• Conference registration and participant management
• Abstract submission handling and peer review process
• Communication with registered participants and authors
• Organization and administration of the conference
• Issuance, secure storage and delivery of requested confirmations, supporting documents and certificates, including repeat downloads by authorized participants from authentication portal.
• Processing of payments, invoices, and financial documentation (If applicable)
• Ensuring technical operation and security of the System
• Preparing reports and supporting documentation for conference administration, technical operations, safety and funding accountability, including evidence of participation where required. Such records may include participants’ full names, affiliations and dates of attendance, limited to what is necessary for the relevant purpose.

The conference platform and services are intended primarily for academic researchers, professionals, and adult participants. Personal data of individuals under the age required by applicable law is not knowingly collected without appropriate authorization or legal basis.

Recording and documenting important actions performed through the Conference platform, including registration, submissions, acceptance of applicable Terms and Conditions, and other administrative actions, for record-keeping, security, audit, and legal purposes

5. Categories of Personal Data Collected

The portal collects and processes different types of personal data depending on how you interact with the System. Depending on the nature of the data and user interactions, this information may be stored securely, deleted immediately after processing, or made publicly available on the applicable legal basis described in this Policy.

The categories of data collected and the specific reasons for their processing include:

• Identity and Profile Information
  • Data Collected: Personal information contingent on your interaction with the system, such as full name, title, identification data, institutional affiliation, country, physical address, gender, photo, participant type, and research track.
  • Purpose: To manage account registration, perform affiliation checks, administer event participation, send announcements, process document issuance, publish authorized open-access materials, and support technical and operational conference processes.
• Contact and Communication Data
  • Data Collected: Email address and phone number.
  • Purpose: To facilitate user communications, send necessary system announcements, build secure login authentication systems, and support general technical operations.
• Professional and Academic Records
  • Data Collected: Professional and demographic information, CVs, resumes, and links to publicly accessible scholarly profiles or academic identifiers (e.g., ORCID).
  • Purpose: To evaluate research submissions, build speaker profiles, and verify academic backgrounds where applicable.
• Verification and Compliance Data
  • Data Collected: Supporting academic documents, including student-status evidence.
  • Purpose: To verify eligibility for discounted student registration fees or specialized participant tracks.
• Research and Submission Content
  • Data Collected: Research titles, descriptions, and any information shared voluntarily by the user for active participation (including uploaded abstracts, presentations, and acknowledgments).
  • Purpose: To manage peer review, coordinate presentation schedules, and publish official conference materials.
• Preferences and Event Logistics
  • Data Collected: Logistical and accessibility requirements.
  • Purpose: To accommodate physical or accessibility needs during event participation.
• Billing and Financial Data
  • Data Collected: Billing information, tax identifiers, and payment-related contact info.
  • Purpose: To issue official financial invoices and comply with legal, accounting, and tax regulations.
• Security and Account Authentication Data
  • Data Collected: Account identifiers and authentication credentials (passwords are stored strictly as secure hashes and are not recoverable in plaintext form).
  • Purpose: To secure user accounts, prevent unauthorized access, and manage user login sessions.
• Technical, Device, and Usage Logs
  • Data Collected: IP addresses, session cookies, authentication cookies, and device or browser information.
  • Purpose: To maintain security and administrative audit trails and, where applicable, demonstrate the specific agreement or consent recorded, including the relevant wording or version and timestamp. These help us to ensure platform security, maintain stable user sessions, troubleshoot technical errors, and optimize operational performance.
• Audit, Transaction, and Compliance Records
  • Data Collected: Detailed activity and transaction logs (which may combine relevant profile, contact, or technical data points), including the specific type of action performed, timestamps (date and time), and the version identifiers of the Terms, notices, or forms presented to you.
  • Purpose: To maintain legally verifiable records of user actions, track compliance, evidence active consent or acknowledgments, fulfill regulatory obligations, and support the overall transparency, security, technical, and operational integrity of the system.
• Temporary / Non-Stored Processing (Related to Confidential Document Generation)
  • Data Collected: We may collect your sensitive personal data such as passport numbers, dates of birth, and any specific identification details explicitly required for visa invitation letters or specialized official documentation.
  • Purpose: To generate automated official visa invitation letters or specific legal requests initiated by the user.
  • Storage Disclosure: This sensitive data is processed transiently (in memory) solely to generate the requested document. None of this highly confidential identification data is stored on our servers. It is permanently erased immediately after the document generation process is completed.

6. Submission of Sensitive Information

Participants (users) should avoid submitting sensitive personal data (such as health information, financial details, government identification numbers, or other confidential information) unless explicitly requested and strictly necessary for conference administration.

Participants (users) must avoid including or submitting other people’s personal contact details and/or sensitive personal data, unless it is necessary and appropriately authorized.

Required and optional information: Required fields are marked on the relevant form. Information necessary to create an account, verify eligibility, review a submission, or provide requested conference services must be supplied for that function to proceed. Optional information can be omitted. Please do not include unrelated personal information about yourself or others.

Health information and certain other categories receive additional protection under GDPR Article 9. Where an accessibility request reveals health information, we process only what is necessary and must identify an applicable Article 9 condition as well as an Article 6 basis. Where we rely on explicit consent, it must be requested separately and may be withdrawn. Financial details and identification numbers are not automatically Article 9 special-category data, but still require appropriate protection.

7. Legal Basis for Processing (GDPR Article 6)

The legal basis is determined for each specific processing purpose. Acceptance of Conference Terms or acknowledgment of this Privacy Policy does not, by itself, constitute consent to every use of personal data.

Personal data is processed on the following legal bases:

• Article 6(1)(b) – Contractual necessity: information objectively necessary to provide the account, registration, submission/review and document services you request, or to take steps at your request before entering into the relevant agreement. This basis does not extend to optional processing merely because it is mentioned in the Terms.
• Article 6(1)(a) – Consent: optional purposes for which we specifically request a freely given, informed and separate choice, such as newsletter subscriptions, optional third-party services requiring consent, and particular optional media or application-material uses identified when collected. Refusing an optional use does not prevent access to unrelated necessary services.
• Article 6(1)(c) – Legal obligation: processing required by applicable tax, accounting, invoicing or other identified legal requirements.
• Article 6(1)(f) – Legitimate interests: necessary conference administration, relevant communications not covered by the requested service, prevention of misuse, platform security, and proportionate evidence of administrative actions. The interests pursued are operating a reliable conference service and protecting participants and the Organizer. This basis is used only where a necessity and balancing assessment supports it and individual rights do not override those interests. Media and publicity uses are described in Sections 11 and 12.

Generating, delivering and retaining an issued documents for authorized repeat downloads relies on Article 6(1)(b) where objectively necessary to provide the agreed conference-document service. Retention for that service ends when the document is no longer needed for the requested service, as explained in Section 9. Any separate retention required by law or necessary for a specific legal claim must have its own applicable legal basis.

Where processing relies on consent, you may withdraw that consent at any time through the relevant control or by contacting us. Withdrawal does not affect earlier lawful processing. We stop the processing covered by that consent unless a separate, valid purpose and legal basis requires specific data to be retained. We do not retrospectively switch legal bases merely to avoid a withdrawal. Notices and bases applicable to existing records must be assessed before any changed processing is introduced.

Right to object: you may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop that processing unless we demonstrate compelling overriding grounds or it is necessary for legal claims. You may object to direct marketing at any time, and it will stop for that purpose.

8. Site Host, Data Storage and Processors

Personal data is stored and processed using secure infrastructure and trusted service providers acting as Data Processors under GDPR-compliant Data Processing Agreements (DPAs).

- This website is hosted by a GDPR-compliant hosting provider, Nethely Kft., located in Hungary (registered address: 1115 Budapest, Halmi utca 29.; tax number: 23358005-2-43), and Cloudflare as the proxy/CDN and security provider.
- Submitted personal data is stored securely in a protected and securely managed database with restricted access controls
- Uploaded documents are stored on the hosting provider’s servers or secure cloud storage services (e.g., Google Workspace), protected by appropriate safeguards
- Access to personal data and submitted materials is strictly limited to authorized personnel, including the conference administration team and designated peer/committee reviewers

All third-party service providers processing personal data on behalf of the conference act under GDPR-compliant contractual arrangements and are required to implement appropriate technical and organizational security measures. While we select reputable providers who are contractually obligated to implement appropriate technical and organizational security measures, the operational security of their respective infrastructures remains the sole responsibility of those third-party providers.

Where personal data is transferred outside the European Economic Area (EEA)—for example, to cloud services or international committee reviewers—appropriate safeguards are implemented in accordance with GDPR requirements, including the use of European Commission Standard Contractual Clauses (SCCs).

9. Data Retention

Personal data is retained only for as long as necessary for the purposes outlined in this Policy. Registered users may request the deletion of their account and associated personal data directly via their user dashboard after logging in. Non-registered users, or users unable to access their dashboard, can request data deletion by contacting us using the details provided in Section 1 and 21. All deletions are subject to ongoing legal, tax, or academic archiving obligations.

• Registration and account data: up to six months after the relevant conference, unless deleted earlier following an applicable request or retained for a separately justified legal requirement or claim.
• Issued documents & confirmations: stored issued documents and the associated records needed for authorized downloads are retained only while necessary to provide the participant’s requested document service. We keep personal data no longer than necessary for the purposes for which it is processed, in accordance with GDPR Article 5(1)(e). Retention for this service ends when the associated account is deleted, the document-download service for that account ends, or the document is otherwise no longer needed, whichever occurs first. Documents and associated download records are then deleted unless a specific applicable legal requirement or a particular legal claim justifies limited further retention. Any such exception is restricted to the necessary information, purpose and period.
• Certificates: issued certificate files and associated issuance records may be retained for up to two years after the relevant conference where necessary for certificate administration and replacement delivery. Certificate retention is assessed separately from acceptance-letter and account administration. Requests concerning certificate data are considered under the applicable GDPR conditions and exceptions.
• Abstracts and academic working submissions: up to 24 months, subject to earlier applicable erasure requests and separate retention of published material as explained in Section 13.
• Application records and CVs: while assessed; unsuccessful or withdrawn applications are deleted within six months after the decision or withdrawal, subject to applicable requests and necessary legal exceptions.
• Financial and invoicing records: for the period required by applicable law. Where the Hungarian Accounting Act applies, supporting accounting documents covered by Section 169(2) must generally be retained for at least eight years. Other applicable record types or legal requirements may have different periods. This does not create a general eight-year retention period for acceptance letters or the whole account.
• Technical and security logs may be retained for up to twelve months where necessary for security, with shorter retention where sufficient. Information needed to investigate a specific incident or legal claim is assessed separately and retained only as long as necessary for that purpose.
• Terms acceptance and Privacy Policy acknowledgment records: records evidencing acceptance of applicable Terms and Conditions and acknowledgment of the Privacy Policy may be retained for up to two years after the relevant conference. Where necessary for that evidential purpose, these records may include the participant’s full name, IP address, timestamp, participant type and affiliation, together with the version of the document presented and the action recorded. Following a documented review, retention may be extended once for up to a further two years where necessary and proportionate to establish, exercise or defend legal claims or demonstrate compliance with applicable obligations. Any extension must record its specific justification and revised deletion date. Records are deleted earlier where they are no longer necessary, subject to applicable legal requirements.
• Participant-status supporting documents: documents provided to verify participant status or eligibility, such as student cards or academic records, are retained only for as long as necessary for that verification. They are deleted when the associated account-deletion request is completed or, at the latest, two months after the relevant conference ends, whichever occurs first, unless a specific applicable legal requirement or legal claim necessitates limited retention.

What happens after deletion: Once stored records are deleted, they are no longer available for download, and lost data cannot be recovered from the Conference system. Participants must download and save copies of any information they wish to retain before completing account deletion or before the relevant document services end. Deletion from our system does not erase copies independently held or previously saved by the participant or other authorized recipients.

Limited legal and accountability records: account deletion does not necessarily erase financial records required by law, records necessary for a specific legal claim, or proportionate evidence of relevant terms and actions where justified. Any exception is assessed separately, restricted to its necessary purpose and period, and explained when responding to a relevant erasure request. A general reference to academic archiving is not itself a statutory obligation.

These rules also cover identifiable working copies and correspondence. Nethely’s published backup arrangements retain daily backup versions for 28 days and monthly versions for six months. Data deleted from the active system may therefore remain in an existing backup until that backup expires. Access to backup copies is restricted to authorized recovery purposes; they are not used for ordinary participant administration or document downloads. If a backup is restored, previously completed deletions must be reapplied before the restored personal data becomes available through the service.

After the applicable period ends, data is securely deleted or genuinely anonymized. Published academic material is treated separately under Section 13. The stated deadlines require an operational cleanup process; they are not extended merely because the website remains online.

10. Data Sharing and Issued Documents

We do not sell personal data or provide it to unrelated parties for their own commercial use. Disclosure must be necessary for a stated purpose and supported by an applicable legal basis; consent is obtained where required.

Where necessary for the relevant purpose and permitted by applicable law, data may be disclosed to:

• Authorized Conference organizers and administrative staff
• Scientific committee members and reviewers who need the information for their assigned work
• Publishers and publishing services for the relevant publication activities
• Hosting, delivery, email, storage, and other technical providers for the services actually used
• Public authorities and other recipients where required or otherwise lawfully justified
• Conference partners or service providers who need the information to carry out their assigned technical, operational, or safety-related activities for the Conference
• Funding bodies, host institute, and authorized project administrators or auditors, where necessary for project operation, reporting, verification of attendance, funding accountability or audit. Disclosures are limited to the information necessary for the relevant requirement, which may include participants’ full names, affiliations and dates of attendance.

For document authentication and fraud-prevention purposes, official documents issued by the ERaNS NextGen Conference may carry a unique, randomly generated alphanumeric reference number linked to the recipient in the Conference’s internal issuance records. Authorized Conference staff may check this reference against the recipient’s recorded name to confirm document authenticity, deter forgery, and investigate suspected unauthorized use. Such checks are conducted for internal audit purposes or in response to a legitimate request, where disclosure is necessary and supported by an applicable legal basis.

Requested acceptance letters and other non-confidential account-linked documents are delivered through secure downloads available to the authorized participant. Issued PNG files are stored in protected server storage. Access to each download requires server-side authentication and an ownership or authorization check. Repeat downloads provide the stored issued document. They do not create a new issuance or change the original issuance date. Participants are responsible for safeguarding the copies they download and deciding with whom to share them. They should protect their account credentials and avoid disclosing their documents to unintended recipients.

Documents designated for confidential, download-only delivery are provided exclusively through secure downloads to authorized participants. The generated document and any identification details collected solely to produce it are deleted from our active systems following the delivery process. We retain only a limited issuance record containing the reference number, recipient’s name, original issuance date, and document type for internal audit and document-authentication purposes, subject to the retention arrangements in Section 9. This does not delete information separately held for other purposes described in this Policy. Applicable backup arrangements are also explained in Section 9. Therefore, the responsibility for the custody, storage, and distribution of the digital asset transfers entirely to the recipient upon download. The ERaNS NextGen Conference is not liable for subsequent data exposure, leaks, or unauthorized access resulting from how the participant stores, shares, or manages their downloaded digital files. Participants bear sole responsibility for treating their digital documents as confidential credentials and should share them exclusively with parties they intend to authorize to verify their achievements.

Providers processing personal data on our behalf are subject to the applicable contractual instructions and confidentiality obligations. A recipient’s role as processor or independent controller depends on the actual activity; not every reviewer, publisher, or recipient is automatically our processor.

11.Conference Photography, Recording, and Media Use

The Conference may involve photography, filming, audio and video recording, livestreaming, screenshots, and other media capture for purposes including Conference documentation, public event reporting, academic communication, institutional communication, educational use, archival purposes, sponsor or funder reporting, website publication, social media communication, and promotion of the current and future editions of the Conference.

The legal basis for general event photography, public-session recordings, crowd images, group photographs, background footage, livestreams, screenshots, and similar Conference documentation is the Organizer’s legitimate interest in documenting, reporting, communicating, archiving, and promoting the Conference, subject to the rights and freedoms of Participants under applicable data protection law.

Where the Organizer captures or uses clearly identifiable individual media, such as interviews, testimonials, posed portraits, individual video statements, or similar close-up promotional materials, the legal basis may be the Participant’s consent or another applicable lawful basis, depending on the context. Where processing is based on consent, the Participant may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Participants may object to certain processing or request removal of media in accordance with applicable data protection law. The Organizer will consider such requests where legally required or where technically, legally, administratively, and operationally feasible, particularly before materials have been published, printed, archived, distributed, downloaded, shared, indexed, or otherwise made difficult or impracticable to withdraw.

12. Participant & Speaker Information and Conference Publicity

The Conference Organiser may publish professional information about confirmed speakers and participants with public programme roles, including their names, professional affiliations, job titles, biographies, professional photographs, participation roles and presentation titles. Publication takes place through the official Conference website and communication channels for the purposes described below.

13. Publication and Public Conference Materials

Conference materials, such as abstracts, accepted submissions, presentation materials, conference proceedings, author names, affiliations, and related academic information submitted through the System may be published or made publicly accessible in connection with the conference. Academic publications, conference proceedings, and publicly distributed conference materials may remain permanently accessible for scientific, archival, citation, and academic record purposes.

Such publication may include:

• Conference abstract books or proceedings
• Conference websites
• Digital repositories
• Program schedules
• Recorded presentations
• Photographs and videos taken during the conference
• Promotional or academic communication materials

Publication and preservation of accepted academic material are separate from temporary account administration and issued-document verification. The applicable submission and publication information identifies what is to be published and its legal basis. Authorship, affiliation and published contributions may remain available long term where continued publication has a valid basis.

By submitting materials to the conference, participants acknowledge and agree that certain academic and professional information (such as name, affiliation, title, and presentation materials) may remain publicly accessible on a long-term or permanent basis for academic, archival, and scientific communication purposes.

Participants should avoid submitting confidential, sensitive, or proprietary information unless explicitly required.

Requests concerning published material are assessed individually under the applicable law, including any relevant freedom-of-expression, research or public-interest archiving exceptions and their safeguards. Account deletion does not automatically remove a published abstract or proceedings entry. Where erasure is legally required, we take the steps required for our own copies and relevant recipients. We cannot guarantee withdrawal of every independently distributed copy, but this does not limit statutory rights.

14. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing
• Right to data portability (where applicable)
• Right to withdraw consent at any time
• Right to lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or your local supervisory authority

To exercise your rights, contact: . Rights apply subject to their GDPR conditions and exceptions. You do not need an active account to make a request. Where reasonably necessary, we may ask for proportionate information to verify identity; we do not request excessive identification.

We respond without undue delay and normally within one month of receiving a request. Where permitted because of its complexity or number of requests, this may be extended by up to two further months; we inform you within the first month and explain why. If we refuse all or part of a request, we explain the reasons and the rights to complain to a supervisory authority and seek a judicial remedy.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or another competent supervisory authority. Please see its official website for current contact and complaint information.

15. Data Security

Appropriate technical and organizational measures are implemented to ensure the security of personal data, including:

• Encrypted HTTPS communication
• Access restrictions to stored data. Role-based access control and authentication restrictions
• Secure storage systems with limited administrative access
• Regular monitoring of system activity and access logs
• Protection against unauthorized access, alteration, or loss of data
• Appropriate storage safeguards and safeguards for any international transfers, as described in Section 8
• Issued-document files are stored outside the publicly accessible website directory, or under equivalent access restrictions, and are delivered only after server-side authorization checks.

We employ reasonable and appropriate security measures designed to protect your data from unauthorized access, disclosure, alteration, or destruction. However, as no security system is impenetrable, we cannot guarantee the absolute security of our databases, nor can we guarantee that information you supply will not be intercepted while being transmitted to us.

In the event of any technical or security issue that may affect your personal data, we will promptly inform affected users in accordance with applicable laws and regulations. We will also take all reasonable and appropriate measures to minimize the impact of the incident, secure our systems, and prevent similar occurrences in the future.

16. Personal Data Breach Response Procedure

In the event of a personal data breach (such as unauthorized access, disclosure, loss, or accidental or unlawful destruction of personal data), the following steps will be taken:

• An immediate investigation will be conducted to determine the scope, content, cause of the breach and affected data.
• If the breach is caused by a service provider (e.g., hosting or cloud storage), all available efforts will be made to:
  • Gather accurate information from the provider,
  • Assist in securing any remaining data, and
  • Support affected users appropriately.
• If personal data is involved:
  • We assess the risks arising from a personal data breach. Where notification to affected individuals is required under GDPR Article 34, we notify them without undue delay, using clear and plain language. The notification describes the nature of the breach, its likely consequences, the measures taken or proposed to address it, and a contact point for further information, together with protective steps individuals should take where appropriate.
• The incident, including all actions taken and communications sent, will be documented.
• Where a personal data breach is not unlikely to result in a risk to individuals’ rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it. If notification is delayed, we will explain the reasons.
• Where the breach is likely to result in a high risk to individuals’ rights and freedoms, we will communicate it to affected individuals without undue delay, unless an applicable legal exception applies.
• We will document personal data breaches, their effects, and the remedial action taken.

17. Cookies and Browser Storage

The website uses cookies and similar browser-storage technologies for the purposes described below. Cookies and localStorage are different technologies: cookies may be sent to a server with relevant requests, while localStorage is accessed by scripts running on the relevant website origin. Storing information only in a browser does not, by itself, mean that consent requirements do not apply.

17.1. Authentication, sessions, and necessary functionality

The participant platform uses PHP session cookies to maintain account sessions and support authentication, security, and requested registration or submission functionality. The session cookie lifetime depends on its purpose and can be configured from one hour up to 30 days. Actual session availability may also be affected by logout, browser settings, server-side expiry, or security checks. Session identifiers are not passwords.

Storage that is strictly necessary to transmit communications or provide a service explicitly requested by the user does not require prior cookie consent where the applicable legal exemption applies. Information about that storage is nevertheless provided in this Policy.

17.2. Cloudflare delivery and security services

The website uses Cloudflare as a reverse proxy and content-delivery and security service in front of its hosting server. Requests to proxied pages pass through Cloudflare, which processes technical request information, such as IP addresses, as part of providing those services. This processing can occur even when no Cloudflare cookie is visible in the browser.

Depending on the enabled features and the requests made, Cloudflare may use cookies for security, challenge verification, or traffic management. We do not claim that every visitor receives every Cloudflare cookie. Any consent exemption depends on the actual purpose and necessity of the storage used.

Cloudflare describes its cookies and their durations in its cookie documentation. Information about its processing is available in the Cloudflare Privacy Policy.

17.3. Optional Cookies and Third-Party Services

Some pages on erans.org offer optional third-party services. Loading these services connects the visitor’s browser to the provider’s servers and discloses technical information, such as the visitor’s IP address. The services may also use cookies or similar technologies and process device or browser information.

Before an optional service that requires consent is loaded, the relevant page presents a consent notice identifying the provider and explaining the purposes of the service. Information about the relevant cookies or browser storage, their durations, and third-party access is provided in the notice or in clearly linked details available before acceptance. Visitors may accept the service or continue using the page without it.

For the current optional video service, the website records acceptance in localStorage, together with a version number and the time of acceptance. Acceptance is treated as valid for up to 365 days from the original acceptance and is not extended on each visit. During that period, subsequent visits to the relevant page may load the video service automatically. This preference applies to that service and does not automatically authorise other optional services.

The visitor or browser may remove the stored preference earlier. localStorage has no built-in expiry: the website code checks whether acceptance is still valid rather than relying on automatic browser deletion. The 365-day period applies to the website’s saved acceptance, not to cookies set by the third-party provider.

The “Preferences” link on the relevant page allows visitors to review their consent and modify it.

Withdrawal removes the saved acceptance and stops the page from continuing to use the service or automatically loading it again on the basis of that acceptance. It does not undo processing that occurred before withdrawal, delete cookies already set by the third-party provider on its own domains, or control processing on other websites or tabs. Those cookies can be managed through the relevant browser and provider controls.

17.4. Checklists saved on your device

Some pages currently use localStorage to remember checklist selections. The relevant scripts read saved selections when the page loads and save changes as the checklists are used. These scripts do not themselves send the saved checklist selections to the conference server.

Examples of saved checklist selections include:

• Author Checklist: stores selections for the abstract, presentation, and poster preparation checklists.
• Travel Checklist: stores selections for the travel checklist.
• Visa Checklist: stores selections for the visa and insurance checklist.

These checklist entries currently have no programmed expiry. They remain until removed or overwritten by the website, deleted by the visitor, or cleared by the browser. A checklist’s reset control clears its selected items but may retain an empty checklist entry in storage.

17.5. Managing cookies and browser storage

Visitors can use browser settings to inspect, block, or clear cookies and site storage. Browser settings may treat cookies and localStorage separately. Clearing the saved preference causes the consent notice to be asked again. Blocking necessary session cookies may prevent login or other requested account functions from working.

Where prior consent is required for non-essential storage or tracking, the relevant functionality must wait for that consent. Changes to services, purposes, or storage practices may require updated information and a renewed choice. For questions, please use the contact details in Section 1.

18. Communication Preferences / Email Communications

The conference may send participants and registered users administrative and informational communications related to conference activities, including registration confirmations, submission updates, review outcomes, schedule announcements, payment notifications, and important conference-related information.

Where users voluntarily subscribe to newsletters, announcements, or future conference updates, such communications will be sent based on user consent.

Users may withdraw consent or unsubscribe from non-essential communications at any time by:

• using the unsubscribe link included in email communications;
• adjusting communication preferences within their account settings (if available); or
• contacting the Data Controller directly.

Withdrawal of consent does not affect communications necessary for conference administration, legal obligations, security notifications, or active participation in conference-related activities.

19. Changes to This Policy

This Privacy Policy may be updated from time to time. Any changes will be published on this page with an updated “Last Updated” date.

20. Governing Language

The English version is the authoritative and legally prevailing version of this Privacy Policy. Users who obtain or prepare their own translations are responsible for the accuracy of those translations. Such translations are for personal reference only, are not legally binding on the Organizer, and do not replace the English version. In the event of any discrepancy, the English version shall prevail. This provision does not limit rights or obligations under applicable law.

21. Contact

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, please contact the Data Controller using the contact information provided in Section 1.:

Dr. Király Amin
📧