The Data Controller for the processing of personal data collected through this registration form is:

Where the School is organised jointly by more than one institution, the relevant roles and responsibilities of the participating organisations will be defined in accordance with applicable data protection rules.

The School may collect the following categories of personal data:

• first and last name;
• date of birth;
• nationality and country of residence;
• email address and, where provided, telephone number;
• academic or professional affiliation and position;
• field of study or professional expertise;
• curriculum vitae;
• motivation letter;
• information provided in connection with a scholarship application;
• payment information and proof of payment;
• any other information voluntarily provided by the applicant in connection with the application.

Personal data will be processed exclusively for purposes connected with the organisation and administration of the GIG-ARTS School on Digital Governance, including:

• receiving and managing applications;
• assessing eligibility and selecting participants;
• assessing scholarship applications and allocating available financial support;
• managing registration and participation;
• verifying payment of registration fees;
• communicating with applicants and participants;
• organising teaching, logistical and administrative activities;
• fulfilling accounting, administrative and legal obligations;
• maintaining records necessary for the proper management and reporting of the School.

Personal data will not be used for unrelated purposes without an appropriate legal basis and, where required, additional information being provided to the data subject.

Depending on the specific processing activity, personal data are processed on one or more of the following legal bases under Article 6 GDPR:

• processing necessary in order to take steps at the applicant’s request prior to entering into an agreement and, following admission, for the performance of the registration agreement;
• compliance with legal obligations applicable to the Data Controller, including administrative, accounting and financial obligations;
• the legitimate interests of the organisers in managing, documenting and evaluating the School, provided that such interests do not override the rights and freedoms of the data subject;
• consent, where specifically requested for optional processing activities.

Participation in the application and registration procedure requires the provision of the personal data marked as mandatory in the registration form. Failure to provide such information may make it impossible to process the application or complete registration.

Information submitted in connection with scholarship applications will be used solely to assess eligibility for the available financial support and to administer the scholarship programme.

The number and availability of scholarships may be subject to confirmation. Submission of a scholarship application does not constitute an entitlement to receive financial support.

Applicants should provide only information that is relevant to the assessment of their scholarship request.

Personal data may be accessed, where necessary, by:

• members of the School’s organisational and administrative team;
• members involved in the assessment of applications and scholarship requests;
• authorised staff of the institutions involved in organising the School;
• technical service providers supporting registration, file storage, communication, payment processing or other organisational activities;
• public authorities or other entities where disclosure is required by law.

Personal data will not be sold or disclosed to third parties for commercial purposes.

Where external service providers process personal data on behalf of the Data Controller, they will act under appropriate contractual and data protection safeguards in accordance with Article 28 GDPR.

Where services used for registration, communication or document storage involve the processing of personal data outside the European Economic Area, any transfer will be carried out in accordance with Chapter V of the GDPR and on the basis of an appropriate transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, or another legally recognised safeguard.

Personal data will be retained only for as long as necessary for the purposes for which they were collected.

Application materials relating to unsuccessful applicants will normally be deleted or anonymised after the completion of the relevant selection and administrative procedures, unless retention is required for legitimate administrative, legal or accountability purposes.

Information concerning admitted participants and financial transactions may be retained for a longer period where necessary to comply with accounting, tax, auditing or other legal obligations.

Under the GDPR, data subjects may, where the relevant legal requirements are met, exercise the following rights:

• access their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of their personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Applicants also have the right to lodge a complaint with the competent national data protection supervisory authority.

Applications and scholarship requests will not be subject to decisions based solely on automated processing that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

This Privacy Notice may be updated where necessary to reflect changes in the organisation of the School, applicable legislation, or data-processing arrangements.

The version made available at the time of application will indicate the date of its most recent update.