Privacy Policy

Party Responsible for Processing Data

The responsible party is the natural or legal person who jointly with others decides on the purposes and means of processing personal data, such as names and email addresses.

Collecting Information

We collect information from you when you register, purchase a ticket, submit a poster proposal, or fill out another form on this site. The fields collected depend on the service you use. Please do not submit personal information that you do not want us to process.

Visitor feedback

Toska Osuuskunta is the controller for the voluntary SDLCAI 2026 attendee survey. We use your ratings, choices and optional comments to evaluate this event and improve future events. The legal basis for any personal information in your answers is your consent (GDPR Article 6(1)(a)), recorded with the privacy-notice version. Taking part is optional and does not affect any other service.

We do not ask for your name, email, employer or ticket number, or connect your answers to registration, invitations or mailing lists. Please leave out contact details, sensitive information and information identifying other people. Free text can identify you if you include personal details, so we do not promise that every response is anonymous. Submitting does not subscribe you to emails or give permission to publish your comments.

Individual answers and consent records are encrypted in our Cloudflare D1 database and accessible only to authenticated organizers and anyone holding that response’s private link. We store a hash of a random private response code and an expiry time; the code is not an attendee identifier. Our feedback application does not store your IP address, browser details or referrer with your answers. Cloudflare processes technical request data for hosting and Turnstile abuse protection. Its infrastructure may process data outside the EEA; see the Cloudflare Data Processing Addendum, including transfer safeguards and Cloudflare privacy policy. We do not use Google Forms to collect responses to this survey.

Raw answers and the code hash expire 90 days after submission. Expired answers become inaccessible immediately and are removed by daily cleanup or an organizer’s results-page visit. Only independent, combined rating and choice counts remain; these contain no comments, identifiers, dates or combinations of an individual’s answers. We do not copy raw feedback to our R2 backup archive. Cloudflare D1 recovery history can contain encrypted deleted data for up to 30 additional days; it is restricted to disaster recovery and must not be restored into active use. Our recovery procedure clears restored raw feedback before reopening the service.

Save the private link shown after submission. During the 90-day period it lets you access and download your answers, or withdraw consent and delete your response, including its contribution to the totals. To correct answers, delete the response and submit again. Withdrawal does not affect processing that was lawful before withdrawal. After expiry, we cannot extract your contribution from the combined totals. Anyone with your private link can view or delete your response, so keep it private. We cannot recover a lost link or find a response by your email.

For access, correction, restriction, portability or erasure requests, contact info@futurefrontend.com. We will not ask for identity documents just to identify feedback; your private code helps locate it. You may lodge a complaint with Finland’s Office of the Data Protection Ombudsman. There is no automated decision-making or profiling using feedback. Notice version: 16 October 2026.

Poster Proposals

When you submit a poster proposal, we collect the designated presenter's name and email address, organization or affiliation, poster title and abstract, the submission time, review status, and the acknowledgements and privacy consent submitted with the form.

We use this information to review proposals as they arrive, contact presenters about questions and rolling acceptance decisions, and coordinate poster-session logistics. If a proposal is accepted, we also use the designated presenter's contact details to arrange the one event ticket included with that poster.

For an accepted proposal, the poster title and abstract may be published in the event program under the acknowledgement given on the proposal form. Acceptance does not guarantee that these details will be published. The designated presenter's name and contact details and private review information are not included in the public program. Earlier proposal records may also include separately listed author or presenter names, a supporting URL, and setup or accessibility notes. That legacy information is not published and remains subject to the retention review described below.

We retain poster proposal records through the event follow-up and will conduct a manual retention review by 31 January 2027. At that review, personal data for proposals that were not accepted will be deleted from the proposal database and its backups. For accepted proposals, contact details and operational notes are kept only as long as needed for event administration or legal obligations. If title or abstract details have been published in the event program, they may remain as part of that event record.

Registration and Badges

Organizers import attendee names, email addresses, optional company details, ticket codes and registration status from ticket and registration exports. We use this private list to verify registrations at the event, record arrival and prepare name badges. Email addresses and ticket codes are not printed on badges. The attendee roster and its database backups are encrypted.

We also use registration email addresses to send practical event information and follow-up about SDLCAI 2026. Each message includes an unsubscribe link that works without signing in. Unsubscribing does not cancel your registration. We keep a keyed address fingerprint and the unsubscribe time separately from imports so importing a registration again does not reset that choice. Message history records the copy, time, recipient fingerprints, provider acceptance or rejection, and provider message identifiers. Provider acceptance does not establish inbox delivery. Event email records are included in the manual retention review by 31 January 2027. Registration does not subscribe you to future promotions.

Named registration staff links allow staff to look up attendees and mark arrivals. A necessary sign-in cookie lasts 14 days. Links remain valid until revoked; revocation ends every associated browser session. Arrival history records the registration record identifier, staff account, action and time. Registration staff cannot access other private organizer tools.

SDLCAI news

SDLCAI news is a separate, optional email list for SDLCAI updates and future events. Signup is currently closed while we prepare our marketing email service. We do not add attendees or earlier registration interest contacts automatically.

When signup opens, we ask for your email address, your explicit agreement, and confirmation through an email link. We process this information on the basis of your consent. Addresses are encrypted in our Cloudflare database. We record the consent wording and version, request time, confirmation time, and withdrawal time. Cloudflare Turnstile protects the signup form; a keyed IP fingerprint is kept for up to 48 hours for rate limiting. Confirmation emails use Cloudflare Email Service. When marketing is enabled, confirmed email addresses are synchronized to our SDLCAI news group in Mailrelay (CPC Servicios Informaticos Aplicados a Nuevas Tecnologias S.L., Spain), which processes our list and campaign delivery and unsubscribe information. See Mailrelay's privacy policy and its data processing terms.

You can withdraw consent through an unsubscribe link without signing in, or by contacting info@sdlcai.org. We remove your address from the active list immediately. Unconfirmed requests are deleted after seven days. Local withdrawals also queue removal from the Mailrelay SDLCAI group. An encrypted recovery copy of the address is kept only while that removal is outstanding, then erased. Provider unsubscribes and complaints are reconciled back into our list; delivery blocks are respected. Mailrelay can retain suppression and campaign records under its processing terms. After unsubscribe, we retain a keyed address fingerprint and consent evidence for one year to record your choice, or until an outstanding provider removal has been resolved, then delete them. Active subscriptions remain until you unsubscribe and are reviewed annually. Private mailing snapshots expire after 30 days; recovery must preserve later unsubscribe choices.

Audience Questions

The Q&A service does not ask attendees for a name or contact details. It stores question text, submission time, moderation status, and votes for the selected event session. Your question is visible to you and moderators before approval. Approved questions are public and may appear on the event screen. Please keep personal details out of questions.

A necessary browser cookie lasts 18 hours and lets you see your own pending questions and prevents repeated votes from that browser. Room data uses a session-specific fingerprint instead of the cookie value. Rate limiting uses temporary fingerprints of browser identity and connecting IP address; raw IP addresses are not stored in Q&A room data. These cookies are not used for advertising or analytics.

Moderator and MC access links remain valid until an organizer revokes them. Their sign-in cookie lasts 14 days; revocation also ends all sessions created through the link. Organizers retain an action log identifying the staff link, action, question identifier, and time. Archiving a room preserves its questions and votes. Organizers can export or explicitly clear room contents after the event.

Speaker Workspace and Contact

For confirmed speakers, the organizer assigns an email address used for private workspace access and operational event announcements. The address is encrypted at rest and linked to the speaker’s stable internal identifier. A speaker can request a short-lived, single-use sign-in link from the public speaker login page. The page does not reveal whether an address is assigned. We store only keyed hashes of sign-in and session secrets.

To prevent sign-in email abuse, we use Cloudflare Turnstile and short-lived keyed fingerprints of the normalized email address and connecting IP address for rate limiting. We do not store the raw IP address in the speaker login-request table. Login request records are automatically removed after 24 hours.

The workspace lets a speaker propose changes to their public name, professional role, biography, website and social links, and the title and description of talks already assigned to them. Drafts and submitted revisions remain private until an organizer reviews them. Approved information may be published in the event programme, slides, and promotion graphics and may remain as part of the public event record. A proposed portrait is decoded, cropped, stripped of metadata, and re-encoded as a private 400x400 WebP for review; the original upload is not retained.

Operational email is limited to the speaker relationship, including access, programme review, deadlines, logistics, promotion material, and optional topic-video coordination. Optional promotional communication preferences are stored separately. Delivery records identify the speaker and outcome but do not contain the plaintext address. Replies sent to info@sdlcai.org are received in the organizer’s Google Workspace mailbox.

Speakers also record whether they will provide presentation material in advance or use their own laptop. For advance material, we collect the selected format—PowerPoint, PDF, or web presentation—and the HTTPS address of a web presentation. These private venue-logistics responses are encrypted at rest, available only to authorized organizers, and are not published.

Speakers can upload PDF and PowerPoint (.pptx) presentations for their assigned talks. Files are stored privately in Cloudflare R2 with the filename, talk, uploader, upload time, and publication preference. Authorized organizers and the talk’s speakers can download them. A PDF is published on the schedule only when its uploader allows public sharing and an organizer publishes it. PowerPoint files remain private. Replacing or removing a file withdraws its public link; a replacement PDF requires publication again. Published PDFs may remain as part of the public event record. We will review private presentation files for deletion by 31 January 2027. Contact info@sdlcai.org for removal after workspace access ends.

A speaker may optionally upload a one-to-two-minute topic video directly to Cloudflare Stream. We record the assigned talk, Stream identifier, processing and review state, duration, and the speaker’s explicit choices about captioning, cropping, excerpting, editing, and publication. The upload requires signed playback and remains private while it is processed and reviewed. Stream source videos are scheduled for deletion after 31 January 2027; permission evidence is retained as needed to document any approved promotional use.

Your organizer can save an optional secondary email for sign-in. Both email addresses are encrypted and follow the same retention policy. Sign-in links go to the address used to request them; operational and promotional updates use the primary address and its existing email preferences. A sign-in link expires after 24 hours, or when workspace access ends if sooner, and works once. Speaker access and sessions expire after 31 October 2026. We will review and delete private speaker contact details and presentation setup responses by 30 November 2026 unless they are still required for event follow-up or a legal obligation. A speaker can ask us to correct their address or presentation setup, suppress further email, or delete private details earlier by emailing info@sdlcai.org.

The private organizer activity log records the time, speaker or organizer account, and category of successful workspace changes and speaker sign-ins. It does not copy submitted content, email addresses, receipts, or sign-in tokens. We use it to coordinate speaker activity and investigate changes, and will review it for deletion by 31 January 2027.

Speaker Travel Receipts

If the organizer enables travel receipt uploads, you can submit receipt files, expense descriptions, dates, original amounts and currencies, and optional notes in your private speaker workspace. We associate each receipt with your speaker name and use it to review and process agreed travel expenses after the event. Please include only the information needed for the expense and do not enter bank or payment-card details in the form.

Receipt files and details are encrypted in storage. They are accessible to you and authorized organizers and are not published. Processing notes are visible to you. You can remove an unprocessed receipt while you have workspace access; contact info@sdlcai.org for corrections afterwards.

Receipts remain available to organizers after speaker workspace access expires and are not included in the automatic cleanup of dinner or presentation responses. Organizers retain them for reimbursement follow-up and remove them from this workspace when no longer needed, after saving any required accounting records separately. Deleting a receipt here does not remove copies already downloaded for accounting.

Speaker Dinner Responses

Speakers use their authenticated workspace to tell us whether they will attend the dinner on 12 October 2026. If someone attends, we collect a meal preference, food requirements, and whether cross-contamination is a concern. We process this information with the respondent’s express consent to plan the dinner safely. Older personal and shared unlisted forms remain temporarily available for responses created before the workspace flow; the shared form also collects the respondent’s name.

Responses are encrypted at rest. Access is limited to authorized event organizers. We share only the food information needed by the dinner caterer and do not include these records in our long-lived event backups. A speaker may update their response until the stated deadline or withdraw consent by contacting us.

Dinner invitation and response records are scheduled for deletion after 26 October 2026. Organizers can also delete all dinner data earlier from the protected admin area once it is no longer needed.

Using Your Information

We will use your personal information for the following purposes:

• Personalizing our website. We would like to create the best experience for you. By using your personal information, we are able to cater our site towards your needs.
• Improving our website. Through the information and feedback given, we are able to improve our site thanks to your insights.
• Improving customer service. Your information will allow us to create a more effective customer service experience by utilizing the data provided.

Revocation of Consent

Many data processing operations are only possible with your express consent. You may revoke your consent at any time with future effect. An informal email making this request is sufficient. The data processed before we receive your request may still be legally processed.

Information, Blocking, Deletion

As permitted by law, you have the right to be provided at any time with information free of charge about any of your personal data that is stored as well as its origin, the recipient and the purpose for which it has been processed. You also have the right to have this data corrected, blocked or deleted. You can contact us at any time using the address given in our legal notice if you have further questions on the topic of personal data.

Third Party Services

Depending on what features and services you use we store different data.

Questions and Feedback

We try to keep our privacy policy transparent and easy to understand. In case you have questions or do not understand parts of it, please let us know if we can improve it further: info <at> futurefrontend.com.

Changes

We reserve the right to update or modify this Privacy Policy from time to time without prior notice. Please review this document especially before you provide any information. Your continued use of the services after any changes or revisions to this Privacy Policy shall indicate your agreement with the terms of such revised Privacy Policy.

The last update to our Privacy Statement was posted on 16 October 2026.