Privacy Policy — CEA Digital Law ®

1. Data controller

Entity	Euro-American Committee of Digital Law - CEA Digital Law ®
Type	Company Limited by Guarantee (CLG), not-for-profit
CRO	698529 (Companies Registration Office, Ireland)
Registered office	1A Aldemere View, Clonsilla, Dublin, D15 W2XT, Ireland
Privacy	dataprotection@ceadigilaw.org

CEA Digital Law ® is an entity with its own independent legal personality. META Channel Corporation Ltd. is a legally separate entity with its own registration number; it operates independently.

2. Processing principles

We process your data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability (Art. 5 GDPR).

3. Processing operations carried out

3.1 Contact form (/contact/)

Data	Full name, email address, country and message
Purpose	To respond to enquiries and manage institutional or pre-contractual relations
Legal basis	Art. 6.1.b GDPR (pre-contractual measures) / Art. 6.1.f GDPR (legitimate interest in follow-up)
Recipients	Authorised staff. Processors: Google Workspace (Gmail), IONOS SE (SMTP), WPMU DEV (hosting)
Transfers	Google LLC (USA) — EU-US Data Privacy Framework. IONOS and WPMU DEV: EU
Retention	1 year where no formal relationship arises; if it is formalised, for the duration of the relationship and 6 years thereafter

3.2 “Write for us” form (/join-us/collaborate/)

Data	Full name, email address, country and message
Purpose	To assess the profiles of collaborators and authors for CEA Digital Law ® content
Legal basis	Art. 6.1.b GDPR — pre-contractual measures at the request of the data subject
Recipients	Authorised staff. Processors: Google Workspace, IONOS SE, WPMU DEV
Transfers	Google LLC (USA) — EU-US Data Privacy Framework
Retention	1 year if it does not proceed; if it is formalised, for the duration of the collaboration and 6 years thereafter

3.3 Publication of the profiles of members and officers

Data	Full name, position, organisation, country, professional photograph
Purpose	Dissemination of the organisational and representative structure of CEA Digital Law ®
Legal basis	Art. 6.1.f GDPR — legitimate interest. The persons listed hold representative positions in an organisation in which they participate voluntarily
Recipients	General public, through the website
Retention	For as long as the association with CEA Digital Law remains active, or until removal is requested
Special right	Immediate removal upon request to dataprotection@ceadigilaw.org

3.4 Photographs of institutional events

Data	Photographic images of participants in CEA Digital Law ® events
Purpose	Documentation and dissemination of institutional activities
Legal basis	Art. 6.1.f GDPR — legitimate interest in documenting the activities of a not-for-profit organisation
Recipients	General public
Retention	For as long as they remain relevant for historical documentation purposes, or until removal
Special right	Immediate removal upon request to dataprotection@ceadigilaw.org

3.5 Newsletter

Data	Name and email address
Purpose	Sending informative communications about CEA Digital Law ® activities and events
Legal basis	Art. 6.1.a GDPR — consent, confirmed by double opt-in
Recipients	Authorised staff. Email provider: IONOS SE (EU)
Transfers	No transfers outside the EEA
Retention	Until consent is withdrawn or the subscription is actively cancelled

3.6 Publication of events submitted by third parties (“Submit your event” form)

Data	From the sender: name, email address, WhatsApp phone number, IP address and time of submission; technical connection and browser data (approximate country, network and internet provider derived from the IP address using our own database, indication of VPN or server use, browser, language and time zone) and the page from which they arrived (domain and path only); the promotion commitment chosen and, where applicable, the link to their mention. From the event: title, description, dates, time zone, venue, city, country, registration link, organising institution, poster and attached documents. From the speakers: first name and last name, position, institution or company, title of the talk and its description
Purpose	Review the proposal, contact the sender and, if approved, publish the event page on ceadigilaw.org. In addition, the poster is analysed with artificial intelligence to check whether it includes the CEA Digital Law logo and, if the sender asks for it, to add it without changing anything else. If the event is published, its texts are translated with artificial intelligence into the other languages of the website. If the sender chooses “I want CEA Digital Law to create my poster”, the poster is created with artificial intelligence from the event text In addition, to verify the authenticity of proposals, prevent impersonation and abuse, and keep a record of the acceptances given and of the agreed promotion.
Legal basis	Art. 6.1.a GDPR — consent of the sender, given through the form checkbox. Art. 6.1.f GDPR — legitimate interest in disseminating academic and professional activities of the sector. Whoever submits the event declares that they are entitled to provide the speakers’ data and the poster, and that they have informed the people concerned Art. 6.1.f GDPR — legitimate interest in the security of the form and in verifying the authenticity of proposals, for the technical connection and browser data. Art. 6.1.b GDPR — publication conditions accepted, for the promotion commitment.
Recipients	Authorised staff during the review. If the event is published, the event and speaker data become publicly accessible. Processors: WPMU DEV (hosting), Google Workspace (Gmail), IONOS SE (SMTP), Anthropic PBC — Claude (analysis of the poster and translation of the event texts with artificial intelligence: it only receives the poster image and the event texts, and does not use them to train its models), Google LLC — Gemini (creation of the poster with artificial intelligence when “I want CEA Digital Law to create my poster” is chosen: it only receives the event text and the chosen style, not the logos)
Transfers	Google LLC (USA), also for Gemini — EU-US Data Privacy Framework. Cloudflare, Inc. (USA) for anti-spam verification. Anthropic PBC (USA) for the analysis of the poster and the translation of the event texts — European Commission standard contractual clauses
Retention	Proposals not published: 1 year. Published events: as long as they remain of informative interest or until a removal request
Special right	Immediate removal of the event or of a speaker’s data upon request to dataprotection@ceadigilaw.org

3.7 Anti-spam verification of the forms (Cloudflare Turnstile)

Data	IP address, technical browser data and a verification token
Purpose	Check that form submissions are not automated and prevent abuse
Legal basis	Art. 6.1.f GDPR — legitimate interest in the security of the website
Recipients	Cloudflare, Inc., as data processor
Transfers	Cloudflare, Inc. (USA) — European Commission standard contractual clauses
Retention	Short periods set by the provider; CEA Digital Law ® does not keep this data

3.8 Visit measurement (cookieless)

Data	Page visited, referrer, device type and browser, as aggregated figures
Purpose	To know how many people visit the site and what they read, in order to improve it
Legal basis	Art. 6.1.f GDPR — legitimate interest in basic, cookieless measurement
Recipients	WPMU DEV (Incsub, LLC), hosting provider, with its Matomo statistics tool configured without cookies. See Cookie Policy
Retention	Only aggregated figures are kept

3.9 “Become a speaker” form (/join-us/become-a-speaker/)

Data	Full name, email address, country and message
Purpose	To assess speaker proposals and contact the sender
Legal basis	Art. 6.1.b GDPR — pre-contractual measures at the request of the data subject
Recipients	Authorised staff. Processors: Google Workspace, IONOS SE, WPMU DEV
Transfers	Google LLC (USA) — EU-US Data Privacy Framework
Retention	1 year if the proposal does not proceed; if it is accepted, for the duration of the collaboration and 6 years thereafter

3.10 “Request a node” form (/join-us/request-a-node/)

Data	Full name, email address, country, organisation or institution, and message
Purpose	To assess the application to set up or join a Node and contact the applicant
Legal basis	Art. 6.1.b GDPR — pre-contractual measures at the request of the data subject
Recipients	Authorised staff. Processors: Google Workspace, IONOS SE, WPMU DEV
Transfers	Google LLC (USA) — EU-US Data Privacy Framework
Retention	1 year if the application does not proceed; if it is accepted, for the duration of the association with CEA Digital Law and 6 years thereafter

The fields marked with an asterisk are required to deal with your request; if they are not provided, we will not be able to process it.

4. Your rights

Under the GDPR, you have the right to:

• Access: to know what data of yours we process and how
• Rectification: to have inaccurate or incomplete data corrected
• Erasure: to have your data deleted when it is no longer necessary or when you withdraw consent
• Restriction: to temporarily suspend processing in the cases provided for by law
• Portability: to receive your data in a structured format where applicable
• Objection: to object to processing based on legitimate interest
• Withdrawal of consent: at any time, without retroactive effect

If you consider that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). In Ireland, this is the Data Protection Commission (see section 5).

5. Supervisory authorities

DPC — Ireland (lead supervisory authority)	Data Protection Commission · dataprotection.ie · info@dataprotection.ie
AEPD — Spain	Agencia Española de Protección de Datos · aepd.es

6. Security and minors

CEA Digital Law ® has adopted the technical and organisational measures necessary to guarantee the security of personal data (HTTPS/TLS encryption, access control, confidentiality agreements). The services are aimed at professionals and at persons over 16 years of age.

7. Updates

This policy may be updated to reflect changes in practices or in the applicable legislation. The date of the last update appears at the beginning of the document. Substantial changes will be communicated proactively to the data subjects concerned.