World Peace Assembly Croatia 2026
Event dates: 19 October – 2 November 2026
Event location: Hotel Medena, Seget Donji, Croatia
Effective date: 30 July 2026
Last updated: 30 July 2026
1. INTRODUCTION
This Privacy Notice explains how personal data are collected, used, disclosed, stored and otherwise processed in connection with registration for, participation in and accommodation during the World Peace Assembly Croatia 2026 (“Event”).
The Event will take place from 19 October to 2 November 2026 at Hotel Medena in Seget Donji, Croatia.
This Privacy Notice applies to adult participants who register for the Event through the Event website or otherwise provide personal data in connection with their registration, participation or accommodation.
Please read this Privacy Notice carefully before submitting the registration form.
2. DATA CONTROLLERS
Two organisations process personal data in connection with the Event for different purposes.
The Event Organiser and the Hotel generally act as separate and independent data controllers for their respective processing activities.
2.1 Event Organiser
Savez za Transcendentalnu meditaciju
Ul. Gaje Bulata 23
10000 Zagreb
Croatia
OIB: 13745098262
Telephone: +385 98 940 4017
Email: wpa@tm-savez.hr
Hereinafter referred to as the “Organiser”.
The Organiser is responsible for processing personal data for purposes connected with:
- Event registration;
- participant administration;
- Event communications;
- organisation of the Event programme;
- accommodation coordination;
- room allocation;
- arrival and departure coordination;
- Event logistics;
- transport coordination;
- meal arrangements;
- accessibility support;
- Event safety and security;
- invoicing for services provided by the Organiser;
- Event photography and video recording;
- responding to enquiries;
- handling complaints, incidents and legal claims.
Data Protection Officer
Data Protection Officer
Savez za Transcendentalnu meditaciju
Ul. Gaje Bulata 23
10000 Zagreb
Croatia
Telephone: +385 98 940 4017
Email: wpa@tm-savez.hr
2.2 Accommodation Provider
Hotel Medena d.d.
Ulica Hrvatskih žrtava 185
21218 Seget Donji
Croatia
Telephone: +385 21 880 588
Email: zop@hotelmedena.com
Hereinafter referred to as the “Hotel”.
The Hotel is responsible for processing personal data for purposes connected with:
- room reservation and allocation;
- provision of accommodation;
- guest check-in and check-out;
- legally required guest identification and registration;
- administration of tourist tax;
- provision of meals and other Hotel services;
- invoicing for services provided by the Hotel;
- processing Hotel payments and refunds;
- compliance with Croatian tourism, hospitality, taxation, accounting and security requirements;
- protection of Hotel guests, personnel, property and facilities;
- handling accommodation-related requests, complaints, incidents and legal claims.
Hotel Data Protection Officer
Data Protection Officer
Hotel Medena d.d.
Ulica Hrvatskih žrtava 185
21218 Seget Donji
Croatia
Telephone: +385 21 880 588
Email: zop@hotelmedena.com
2.3 Relationship between the Organiser and the Hotel
The Organiser and the Hotel generally act as separate data controllers.
The Organiser determines the purposes and means of processing personal data relating to Event registration, participant communication, Event organisation, rooming coordination and Event logistics.
The Hotel independently determines the purposes and means of processing personal data relating to accommodation, Hotel check-in, statutory guest registration, Hotel services, Hotel invoicing and compliance with legal obligations applicable to accommodation providers in Croatia.
The Organiser will provide the Hotel only with the personal data reasonably necessary to arrange and provide accommodation, room allocation, meals, accessibility support and related services.
The Hotel may collect additional information directly from participants during reservation, check-in or provision of Hotel services.
Questions concerning Event registration, Event participation and Event logistics should normally be directed to the Organiser.
Questions concerning Hotel accommodation, check-in, Hotel services, Hotel invoices or statutory guest records should normally be directed to the Hotel.
3. PERSONAL DATA COLLECTED
Depending on the participant’s registration, accommodation selection and requested services, the following categories of personal data may be processed.
3.1 Identification and registration data
The Organiser may collect:
- first name;
- surname;
- date of birth;
- gender for accommodation allocation;
- country of residence or country represented;
- organisation, association or delegation represented;
- participant or registration number;
- registration date;
- registration status;
- selected participation package;
- selected accommodation package;
- arrival and departure dates;
- attendance confirmation;
- registration-related correspondence;
- changes, cancellations or withdrawal information.
The Hotel may separately request nationality, identity document details and other information necessary for Hotel check-in, statutory guest registration and compliance with Croatian law.
3.2 Gender for shared-room allocation
Gender is a mandatory registration field because participants may be allocated to shared rooms under the Event accommodation plan , and for the allotment of flying foam. This information will be used only to arrange compatible shared-room accommodation and will not be used for advertising, profiling, eligibility decisions or unrelated purpose.
The Organiser will use gender only for:
- allocating participants to compatible shared rooms;
- administering room-sharing arrangements;
- communicating with participants about room allocation;
- resolving accommodation-related privacy or safety requirements.
Gender will not be used for:
- advertising or marketing;
- profiling;
- determining eligibility to participate in the Event;
- evaluating participants;
- making assumptions about a participant’s health, sexual orientation, religion or other protected characteristics;
- any purpose unrelated to accommodation and room allocation.
Where possible, the registration form should use the following field title:
Gender for shared-room allocation
Recommended options are:
- Female;
- Male;
- Another gender – please contact the Organiser regarding room allocation;
Participants who require a particular accommodation arrangement for privacy, personal, cultural, religious, health or safety reasons may contact the Organiser at:
Such requests will be handled confidentially and only by authorised personnel.
Gender information will normally be deleted together with the other Event registration and room-allocation data within 30 days after the Event ends.
3.3 Contact data
The Organiser may collect:
- email address;
- telephone or mobile telephone number;
- preferred language of communication;
- emergency contact information, where necessary;
- other contact information voluntarily provided by the participant.
Telephone numbers will be used primarily for urgent Event, accommodation, arrival, departure, transport or safety-related communication.
Telephone numbers and email addresses will not be used for unrelated promotional communications unless the participant has separately consented to such communication or another lawful basis applies.
3.4 Accommodation and logistics data
The Organiser and Hotel may process:
- accommodation dates;
- room category;
- room-sharing preferences;
- name of a requested roommate;
- arrival and departure dates and times;
- travel information voluntarily provided for Event coordination;
- transport requirements;
- accommodation-related requests;
- accessibility requirements;
- reservation status;
- arrival or non-arrival information;
- accommodation changes;
- cancellation information.
3.5 Dietary information
The Organiser may collect information concerning:
- standard dietary preferences;
- vegetarian or vegan meals;
- food exclusions;
- allergies;
- food intolerances;
- medically required diets;
- religious or philosophical dietary requirements.
A standard dietary preference does not necessarily constitute special-category personal data.
However, information concerning allergies, food intolerances, medically required diets or dietary requirements that reveal health information, religious beliefs or philosophical beliefs may constitute special-category personal data.
Participants should provide only the information necessary to safely provide the requested meal.
Participants should not provide full medical records, detailed diagnoses or unrelated health information.
3.6 Disability, accessibility and health-related information
Participants may voluntarily provide information concerning:
- disability;
- reduced mobility;
- accessibility requirements;
- accessible-room requirements;
- need for assistance during the Event;
- allergies;
- food intolerances;
- medically required diets;
- other information strictly necessary to arrange appropriate participation, accommodation, meals or safety measures.
This information may constitute special-category personal data under Article 9 GDPR.
Such information will normally be processed only on the basis of the participant’s separate and explicit consent.
The Organiser will not request a complete medical history or information unrelated to the requested accommodation, meal, accessibility or safety arrangement.
3.7 Payment and invoicing information
The Organiser and the Hotel issue separate invoices for the services each of them provides.
Each organisation therefore independently processes the payment and invoicing information required for its own services.
This may include:
- participant or customer name;
- billing address;
- OIB or other tax identification information, where required;
- invoice number;
- invoice details;
- description of services;
- amount payable;
- payment date;
- payment status;
- bank transaction reference;
- cancellation and refund information.
The Organiser will not receive or process Hotel payment information unless this is necessary for agreed accommodation coordination.
The Hotel will not receive or process payment information relating solely to services invoiced by the Organiser unless this is necessary for an agreed administrative purpose.
Complete payment card information should be processed only by the Hotel, bank or authorised payment service provider responsible for the relevant transaction.
3.8 Website and technical information
When the Event website or registration application is used, certain technical information may be processed automatically, including:
- IP address;
- date and time of access;
- browser type and version;
- device type;
- operating system;
- language settings;
- pages accessed;
- form submission time;
- application security logs;
- authentication logs, where applicable;
- application errors;
- consent records;
- version of the Privacy Notice displayed or accepted.
The Event website is based on WordPress and a custom registration application.
Strictly necessary cookies and similar technologies may be used to operate and secure the website and registration form.
Analytics, advertising, social media and other non-essential cookies will not be activated before the visitor has made the required choice through the website’s cookie consent mechanism.
Further information should be provided in a separate Cookie Notice.
4. PURPOSES AND LEGAL BASES FOR PROCESSING
4.1 Event registration and participation
Personal data may be processed to:
- receive and process Event registrations;
- confirm participation;
- administer participant records;
- issue registration confirmations;
- organise participation;
- communicate programme information;
- manage registration changes and cancellations;
- respond to participant enquiries.
The legal basis is Article 6(1)(b) GDPR, where processing is necessary to take steps at the participant’s request or to perform the arrangement concerning Event participation.
Certain administrative and security activities may also be based on Article 6(1)(f) GDPR, namely the legitimate interests of the Organiser in properly organising, administering and securing the Event.
4.2 Gender and room allocation
Gender information is processed because it is necessary to administer the Event’s shared-room accommodation arrangements.
The legal basis is Article 6(1)(b) GDPR, where the processing is necessary to provide and coordinate the accommodation selected or requested by the participant.
Where appropriate, limited room-allocation administration may also be based on Article 6(1)(f) GDPR, namely the Organiser’s legitimate interest in providing orderly, appropriate and privacy-conscious shared accommodation.
The Organiser will not use gender information beyond this accommodation-related purpose.
4.3 Accommodation and Hotel services
Accommodation-related personal data may be processed under:
- Article 6(1)(b) GDPR, where processing is necessary to arrange or provide the requested accommodation;
- Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
- Article 6(1)(f) GDPR, where processing is necessary for legitimate accommodation, administrative, fraud-prevention or security purposes.
The Hotel may request additional information during check-in where necessary under Croatian law or the Hotel’s lawful operating procedures.
4.4 Statutory guest registration
The Hotel processes identification and accommodation data where necessary to comply with Croatian legal obligations relating to:
- guest registration and deregistration;
- the eVisitor system;
- tourist tax;
- accommodation records;
- taxation;
- accounting;
- competent public authority requests.
The legal basis is Article 6(1)(c) GDPR.
4.5 Event communications
The Organiser may use contact details to send:
- registration confirmations;
- programme information;
- schedule changes;
- accommodation information;
- room-allocation information;
- payment information;
- arrival and departure instructions;
- transport information;
- security notices;
- emergency notices;
- other information necessary for participation.
These are operational and administrative communications necessary to organise the Event.
The legal basis is Article 6(1)(b) GDPR or, where appropriate, Article 6(1)(f) GDPR.
4.6 Invoicing, accounting and taxation
Payment and invoicing information may be processed under:
- Article 6(1)(b) GDPR, for the provision and payment of requested services;
- Article 6(1)(c) GDPR, for compliance with Croatian accounting, taxation and other legal obligations;
- Article 6(1)(f) GDPR, for financial administration, fraud prevention and the establishment or defence of legal claims.
4.7 Allergies, disability and health-related information
Allergy, disability, accessibility and other health-related information will normally be processed on the basis of the participant’s explicit consent under Article 9(2)(a) GDPR.
Providing this information is voluntary.
A participant may withdraw consent at any time by contacting:
Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
Following withdrawal, the Organiser or Hotel may no longer be able to provide the requested meal, accommodation, accessibility or safety arrangement.
In a genuine emergency, relevant health information may exceptionally be processed where necessary to protect the vital interests of the participant or another person and where the participant is physically or legally incapable of giving consent.
4.8 Safety, information security and legal claims
Personal data may be processed to:
- protect participants and Event personnel;
- secure the registration website and application;
- prevent unauthorised access and misuse;
- investigate security incidents;
- prevent or investigate fraud;
- manage complaints;
- establish, exercise or defend legal claims.
The legal basis is Article 6(1)(f) GDPR and, where applicable, Article 6(1)(c) GDPR.
In a genuine emergency, Article 6(1)(d) GDPR may also apply where processing is necessary to protect a person’s vital interests.
5. EVENT PHOTOGRAPHY AND VIDEO RECORDING
Photography and video recording will take place during the Event.
5.1 General Event photography
General photographs and recordings may show:
- Event premises;
- speakers;
- organised activities;
- groups of participants;
- audiences;
- the general atmosphere of the Event.
The Organiser may process general Event photographs and recordings for Event documentation and reporting on the basis of a documented legitimate interest under Article 6(1)(f) GDPR, provided that the interests, rights and freedoms of participants are not overridden.
Participants will be informed that photography and recording are taking place.
Participants may object to being individually photographed or recorded by:
- informing the photographer;
- informing Event staff;
- contacting the Organiser;
- using any no-photo badge, lanyard or other identification method provided by the Organiser.
The Organiser will take reasonable measures to respect such objections in future photography, recording and publication.
5.2 Individual and promotional photography
Separate, voluntary consent will be requested for:
- posed photographs;
- individual portraits;
- interviews;
- testimonials;
- close-up photographs;
- photographs or recordings where a participant is the primary subject;
- use of an identifiable participant in future promotional or advertising materials.
Refusal to provide photography or video consent will not affect Event registration, participation, accommodation or access to Event services.
Consent may be withdrawn for future use at any time by contacting:
Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Complete removal may not always be possible where material was lawfully printed, distributed, shared or published before the Organiser received the withdrawal request.
However, where consent was the applicable legal basis, the Organiser will take reasonable measures to stop new use of the relevant material.
6. MANDATORY AND OPTIONAL INFORMATION
Fields marked as mandatory are required to:
- process the Event registration;
- verify that the participant is an adult;
- confirm participation;
- arrange accommodation;
- allocate shared rooms;
- provide essential Event communications;
- issue applicable invoices;
- comply with legal obligations.
If mandatory information is not provided, the Organiser may be unable to complete the registration or provide the requested services.
Gender is mandatory solely because it is necessary for shared-room allocation and accommodation logistics.
Standard dietary preference information is optional unless the participant requests a particular meal.
Information concerning allergies, disability, accessibility and health-related requirements is voluntary.
However, without sufficient information, the Organiser or Hotel may be unable to safely provide a requested meal, accessible room, assistance or safety arrangement.
Consent for individual or promotional photography is optional and is not a condition of Event participation.
7. RECIPIENTS OF PERSONAL DATA
Personal data may be disclosed only where reasonably necessary for the stated purposes.
Recipients may include:
- authorised personnel of the Organiser;
- authorised Event volunteers;
- authorised Hotel personnel;
- Event registration personnel;
- accommodation and room-allocation coordinators;
- transport coordinators;
- catering personnel;
- Event photographers and video production personnel;
- accountants, auditors and professional advisers;
- banks and payment service providers;
- website hosting and IT service providers;
- WordPress and application support providers;
- email and communication service providers;
- security providers;
- insurance companies;
- medical and emergency personnel;
- public authorities, courts or law-enforcement bodies where disclosure is required or permitted by law;
- competent Croatian tourism and tax authorities;
- authorised users of the Croatian eVisitor system.
Access will be limited according to operational necessity.
Allergy, disability and health-related information will be made available only to persons who genuinely require the information to provide the requested service or protect health and safety.
For example, catering personnel should normally receive only operationally necessary information such as “severe nut allergy”, rather than unrelated medical details.
Personal data will not be sold or rented.
8. SHARING BETWEEN THE ORGANISER AND THE HOTEL
The Organiser may provide the Hotel with information necessary to arrange accommodation and related services, including:
- first name and surname;
- date of birth, where necessary;
- gender for room allocation;
- country of residence or country represented;
- contact details, where necessary;
- arrival and departure dates;
- accommodation package;
- room category;
- room-sharing request;
- relevant dietary requirements;
- allergy information;
- relevant accessibility requirements;
- information necessary for invoicing or confirming payment status.
Allergy, disability and health-related information will be shared with the Hotel only where necessary and, except where another legal exception applies, on the basis of the participant’s explicit consent.
The Hotel may provide the Organiser with limited information necessary for Event administration, including:
- confirmation of accommodation;
- reservation status;
- room-allocation status;
- arrival or non-arrival information;
- departure status;
- unresolved accommodation issues;
- information necessary to coordinate invoices or payment status.
Neither organisation should disclose more personal data than are necessary for the relevant purpose.
9. WEBSITE HOSTING AND TECHNICAL PROCESSORS
The Event website and custom registration application are hosted using managed WordPress hosting provided by Kinsta Inc.
The primary hosting location selected for the website is Frankfurt, Germany.
Kinsta processes personal data submitted through the website and registration application on behalf of the Organiser and in accordance with its applicable Data Processing Addendum.
The Organiser may also use:
- website developers and administrators;
- WordPress plugin providers;
- application developers;
- backup providers;
- security service providers;
- transactional email providers;
- database and technical support providers;
- other processors necessary to operate and secure the registration system.
The Organiser will maintain appropriate contractual data protection arrangements with processors that process personal data on its behalf.
10. INTERNATIONAL DATA TRANSFERS
The primary hosting location for the Event website has been selected in Germany.
However, certain hosting, logging, security, content delivery, technical support or communication functions may involve the processing of personal data outside the European Economic Area.
Where personal data are transferred outside the European Economic Area to a country that has not been recognised as providing an adequate level of data protection, appropriate safeguards will be used where required.
Such safeguards may include:
- European Commission Standard Contractual Clauses;
- contractual obligations imposed on processors and subprocessors;
- encryption;
- access controls;
- data minimisation;
- supplementary technical and organisational measures;
- another lawful transfer mechanism permitted under Chapter V GDPR.
Further information about applicable transfer safeguards may be requested from the Organiser.
11. RETENTION PERIODS
Personal data will not be retained longer than necessary for the purposes for which they were collected.
11.1 Event registration, gender and logistics data
Ordinary Event registration, Whatsup chats/groups, email correspondence, contact, gender, room allocation, accommodation coordination and logistics data will normally be deleted or irreversibly anonymised within 30 days after the Event ends.
The planned ordinary deletion deadline is:
2 December 2026
11.2 Allergy, disability and health-related information
Allergy, disability, accessibility and other health-related information will normally be deleted within 30 days after the Event ends.
The planned ordinary deletion deadline is:
2 December 2026
Such information may be deleted earlier where it is no longer operationally necessary.
It may be retained longer only where:
- an incident, complaint or legal claim requires continued limited retention;
- retention is required by applicable law;
- the participant has requested an arrangement that remains unresolved;
- the information has been irreversibly anonymised.
11.3 Cancelled, withdrawn or incomplete registrations
Information relating to incomplete, rejected, withdrawn or cancelled registrations will normally be deleted within 30 days after the relevant registration, refund or financial matter has been completed.
Information may be retained longer where necessary to resolve a complaint, dispute or legal claim.
11.4 Technical and security logs
Routine website and application logs will normally be deleted or anonymised within 30 days unless:
- a security incident has occurred;
- suspicious activity requires investigation;
- longer retention is necessary to establish, exercise or defend legal claims;
- another lawful retention obligation applies.
11.5 Financial and accounting records
Invoices, payment records and accounting documentation will be retained by the organisation that issued the relevant invoice for the period required under applicable Croatian accounting, taxation and related laws.
Such records are not subject to the general 30-day Event deletion period.
11.6 Hotel and statutory guest records
The Hotel will retain reservation, check-in, eVisitor, tourist-tax, invoicing, payment and other statutory Hotel records for the periods required under applicable Croatian tourism, hospitality, accounting, taxation and other legislation.
Such records are not subject to the Organiser’s general 30-day Event deletion period.
11.7 Photographs and video recordings
Unselected, duplicate or technically unsuitable photographs and recordings should be deleted within a reasonable period after the Event.
Selected photographs and recordings may be retained for as long as they remain necessary for the documented Event reporting, communication, historical or promotional purpose for which they were created.
The Organiser will periodically review whether continued retention and publication remain necessary.
Where processing is based on consent, new use of identifiable material will stop following a valid withdrawal of consent, subject to material already lawfully printed, published or distributed.
11.8 Consent records
Evidence that consent was provided, refused or withdrawn may be retained for as long as necessary to:
- demonstrate compliance with data protection requirements;
- manage participant requests;
- establish, exercise or defend legal claims.
Consent records are not subject to the ordinary 30-day operational deletion period where longer retention is necessary to demonstrate compliance.
11.9 Complaints, incidents and legal claims
Information necessary to handle a complaint, safety incident, insurance matter or legal dispute may be retained until the matter has been resolved and the applicable legal limitation periods have expired.
12. DATA SECURITY
The Organiser and the Hotel will implement appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- unlawful disclosure;
- accidental loss;
- alteration;
- destruction;
- misuse;
- other unlawful processing.
Such measures may include:
- encrypted HTTPS communication;
- restricted administrative access;
- individual user accounts;
- strong passwords;
- multi-factor authentication where available;
- role-based access controls;
- regular security updates;
- secure backups;
- security and activity logging;
- firewall and anti-malware protection;
- confidentiality obligations;
- staff training;
- limited export and distribution of participant lists;
- secure deletion procedures;
- incident-response and personal-data-breach procedures.
Participants should not enter unnecessary health or other sensitive information in open-text fields.
No Internet-based transmission or storage system can be guaranteed to be completely secure.
13. DATA PROTECTION RIGHTS
Subject to the conditions and limitations established by the GDPR, participants may exercise the following rights.
13.1 Right of access
Participants may request confirmation of whether their personal data are being processed and may obtain access to those data and related processing information.
13.2 Right to rectification
Participants may request correction of inaccurate personal data or completion of incomplete information.
13.3 Right to erasure
Participants may request deletion of personal data where the applicable legal conditions are met.
The right to erasure does not apply where continued retention is required by law or necessary to establish, exercise or defend legal claims.
13.4 Right to restriction of processing
Participants may request restriction of processing in circumstances provided by the GDPR.
13.5 Right to data portability
Where processing is automated and based on consent or contract, participants may have the right to receive personal data they provided in a structured, commonly used and machine-readable format.
13.6 Right to object
Where processing is based on legitimate interests, participants may object on grounds relating to their particular situation.
The relevant controller will stop the processing unless it demonstrates compelling legitimate grounds that override the participant’s interests, rights and freedoms, or the processing is necessary for legal claims.
13.7 Right to withdraw consent
Where processing is based on consent, the participant may withdraw consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
13.8 Right to lodge a complaint
Participants have the right to lodge a complaint with the Croatian Personal Data Protection Agency or another competent European data protection supervisory authority.
14. EXERCISING DATA PROTECTION RIGHTS
For personal data relating to Event registration, gender and room allocation, Event communication, Event logistics, Organiser invoices and Organiser photography, contact:
Data Protection Officer
Savez za Transcendentalnu meditaciju
Ul. Gaje Bulata 23
10000 Zagreb
Croatia
Telephone: +385 98 940 4017
Email: wpa@tm-savez.hr
For personal data relating to Hotel accommodation, Hotel invoices, check-in, eVisitor registration and Hotel services, contact:
Data Protection Officer
Hotel Medena d.d.
Ulica Hrvatskih žrtava 185
21218 Seget Donji
Croatia
Telephone: +385 21 880 588
Email: zop@hotelmedena.com
The organisation receiving a request may ask for information reasonably necessary to verify the identity of the person making the request.
Copies of identity documents will not be requested or retained unless identity cannot reasonably be verified by less intrusive means.
Requests will be handled within the time limits prescribed by applicable data protection law.
15. CROATIAN SUPERVISORY AUTHORITY
Participants may lodge a complaint with:
Croatian Personal Data Protection Agency
Agencija za zaštitu osobnih podataka – AZOP
Ulica Metela Ožegovića 16
10000 Zagreb
Croatia
Telephone: +385 1 4609 000
Email: azop@azop.hr
Participants may also lodge a complaint with the supervisory authority in the European Union or European Economic Area country of their habitual residence, place of work or place of the alleged infringement.
16. AUTOMATED DECISION-MAKING
Personal data collected through the Event registration process will not be used for automated decision-making or profiling that produces legal effects or similarly significantly affects participants.
Gender information will not be used for automated profiling or decisions unrelated to shared-room allocation.
If this changes, affected participants will receive additional information before such processing begins.
17. AGE REQUIREMENT
Registration through this form is intended only for individuals aged 18 or older.
The registration form must not be used to submit personal data concerning a person under the age of 18.
A parent or legal guardian wishing to enquire about participation by a minor must contact the Organiser before submitting personal data concerning that minor.
18. CHANGES TO THIS PRIVACY NOTICE
This Privacy Notice may be updated where:
- Event arrangements change;
- processing activities change;
- service providers change;
- legal or regulatory requirements change;
- additional information is required to ensure transparency.
Material changes will be communicated through the Event website, by email or through another appropriate communication channel.
The date of the latest version will be displayed at the beginning of this Privacy Notice.
19. APPLICABLE DATA PROTECTION FRAMEWORK
Personal data are processed in accordance with:
- Regulation (EU) 2016/679, the General Data Protection Regulation;
- the Croatian Act on the Implementation of the General Data Protection Regulation;
- applicable Croatian and European Union legislation governing tourism, accommodation, taxation, accounting, electronic communications and personal data protection.
