Privacy policy 2026

SURF Privacy Statement - PIDfest 2026

SURF organizes the PIDfest 2026 conference in Leiden, together with DANS. SURF coordinates the event and the communications. When you register and during the organisation of the event, we process personal data. This statement sets out factually what SURF does with your data, why we are allowed to do so under the law, and what your rights are.

Note the distinction in responsibility. This statement describes the processing activities for which SURF is responsible. The PIDfest website itself is technically hosted and managed by another party (see section 5). Different arrangements apply to that part.

1. Controller

SURF B.V. is the controller for the processing activities described in this statement, namely registration for the event and the submission and review of contributions (call for proposals).

Contact details:
Kantoren Hoog Overborch
Moreelsepark 48,
3511 EP Utrecht
+31 88 787 30 00
avg@surf.nl

2. Security

We apply information security in accordance with the standards applicable within the Dutch government and education sectors (such as the SURF Security Baseline). This means we take technical and organisational measures to prevent data breaches, unauthorised access and loss of data. Despite these measures, no system is 100% secure.

Have you discovered a vulnerability or do you suspect a data breach? Report it immediately via responsible-disclosure@surf.nl.

3. Your Rights

The General Data Protection Regulation (GDPR) grants you specific rights. You can exercise these by submitting a request to avg@surf.nl.

Access & Rectification: You have the right to know which data we hold about you and to request that it be corrected if it is inaccurate.
Erasure: You have the right to request the erasure of your data (right to be forgotten).
Data portability: You have the right to receive your data in a structured, commonly used format in order to transfer it.
Objection & Restriction: You have the right to object to a processing activity or to request that the processing be temporarily restricted.

Complaints. If you are dissatisfied with how we handle your privacy, you can contact our independent Data Protection Officer via fg@surf.nl. If we are unable to resolve the matter together, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Specifications: PIDfest 2026

4. What data do we process and why?

For PIDfest we process the data set out below. We do not collect anything that is not strictly necessary for the organisation of the event.

5. Sharing with third parties

We do not share personal data with third parties unless this is necessary for the organisation of PIDfest.

Suppliers (Processors, acting on behalf of SURF):

Yellenge (the Netherlands): Provides registration and ticketing for the event. SURF determines which data is collected; this party processes it solely on SURF's instructions. The Yellenge privacy conditions apply.

Pretalx: The Pretalx server is maintained and hosted under the dutiful supervision of SURF, located within a Dutch SURF data center. Any information you provide within this system will be treated with utmost confidentiality. Furthermore, to comply with privacy regulations and ensure your personal security, all personal data will be completely removed from our system 90 days following the conclusion of the event.

By entering a submission through this CfP form you agree that:

The personal information associated with your submission will be visible to the programme committee members
In case your submission is chosen for the PIDfest 2026 programme your associated personal information, such as speaker name and affiliation, can be published as part of the programme.

Hosting of the PIDfest website (separate responsibility):

The website pidfest.org is hosted and technically managed by ARDC (Australian Research Data Commons, Australia). ARDC manages, among other things, the website environment, any analytics scripts and the overarching mailing list that is carried over between editions (2024, 2026, 2028).
ARDC is responsible for this part itself. SURF has no technical access to this environment and cannot modify these processes.
The ARDC hosts the PIDfest website and mailing list in accordance with the ARDC Privacy Policy

Transfers outside the EEA. ARDC is established in Australia. Where personal data is transferred to ARDC outside the European Economic Area (EEA), an appropriate transfer mechanism applies [NW3] (such as Standard Contractual Clauses, supported by a Transfer Impact Assessment).

6. Retention periods

We do not retain data for longer than necessary or required by law.

Registration data: Until the next edition of PIDfest, so that the organisers of the following event can contact participants.
Contributions (proposals): 3 months after the conclusion of the event.
Technical logs: 31 days (automatically deleted thereafter).
Newsletter: Until you unsubscribe.