Privacy notice
1. Controller
Sovereignty Foundation Asbl., Avenue Marnix 13–17, 1000 Brussels, Belgium, represented by Dr. Alexander Sell, President.
Email: info@sf-foundation.eu · Telephone: +49 152 2957 8069
This notice applies to the website the-venice-symposium.eu and to the registration for the Venice Symposium of 29 October to 1 November 2026. Other websites of the Foundation have their own privacy notices.
2. Visiting the website
Our hosting provider records each access in a server log file: IP address, date and time, requested resource, referrer, browser and operating system, and the volume of data transferred.
- Purpose: delivery of the website, stability and security of the server, defence against attacks.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website.
- Retention: 7 days. Server log files are not included in the backups.
- Processor: the website is operated on our behalf by Westmark Media, Timm Westmark, Weidenbornstraße 12, 65189 Wiesbaden, Germany, which also administers the website and the registration system.
- Sub-processor: hosting is provided by maxcluster GmbH, Lise-Meitner-Straße 1b, 33104 Paderborn, Germany, in an ISO 27001 certified data centre in Frankfurt am Main, Germany.
- Data processing agreements under Art. 28 GDPR are in place with both.
Security software. To protect the website and the registration data against attacks, we use the security plugin Wordfence by Defiant, Inc., Seattle, USA. Its firewall and login protection check each request, including your IP address, the requested address and your browser’s user agent, against known attack patterns, and block suspicious requests and repeated failed login attempts. As part of the Wordfence security network, the IP addresses of blocked attackers and of failed login attempts are transmitted to Defiant, Inc., and Wordfence regularly retrieves updated threat data from Defiant’s servers.
- Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting the website and the personal data of our guests against attacks.
- Third country: Defiant, Inc. is located in the United States. The transfer is based on the EU standard contractual clauses.
- Retention: Wordfence deletes its records of blocked requests and login attempts automatically after 30 days.
The website does not use analytics, tracking or advertising services, and it does not load fonts, maps or videos from third-party servers.
3. Cookies and consent management
When you first visit the website, a banner from Borlabs Cookie asks for your choice. The software runs on our own server; no data is transmitted to the manufacturer. The website currently uses only cookies that are strictly necessary; it does not use analytics, advertising or other optional services. The registration form keeps your entries between its steps without cookies.
Borlabs Cookie stores your choice in the cookie borlabs-cookie for 60 days and keeps a record of it, consisting of a randomly generated ID, your choice, the version of the settings and the date and time. The record is deleted automatically after 60 days. Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent) and Art. 129 of the Belgian Electronic Communications Act.
Further cookies are set only when an administrator logs in (the WordPress and Wordfence login cookies). Details are set out in the cookies policy.
You can review or change your choice at any time via the “Cookie settings” link in the footer.
4. Registering for the symposium
Registration is possible only with a personal invitation code. We process:
- the invitation code and its status (unused, redeemed, blocked) and the delegation to which it was issued,
- first name, last name, email address,
- mobile number, for on-site coordination,
- your date of birth, which determines whether the under-30 ticket applies,
- whether you need accommodation, the nights you need, and your room occupancy: a room to yourself, sharing with a person you name (with that person’s name or email address), or sharing with a room-mate we allocate,
- dietary requirements and allergies, and accessibility requirements (see section 5),
- the date and time of your registration and the confirmation we send you.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Checking the invitation code, allocating and administering your place within your delegation’s contingent | Art. 6(1)(b) GDPR — performance of the contract |
| Booking and allocating your room | Art. 6(1)(b) GDPR |
| Applying the under-30 ticket and checking your age at check-in | Art. 6(1)(b) GDPR |
| Printing your badge with your name | Art. 6(1)(b) GDPR |
| Sending your confirmation, identity check at check-in on site | Art. 6(1)(b) GDPR |
| On-site coordination via your mobile number | Art. 6(1)(b) GDPR |
| Planning the catering on the basis of your dietary requirements and allergies | Art. 6(1)(b) GDPR |
| Payments, accounting and tax records | Art. 6(1)(c) GDPR in conjunction with the applicable retention obligations |
Providing the mandatory fields is necessary for the conclusion of the contract. Without them we cannot register you.
We use dietary requirements and allergies only ourselves, to plan the catering. We do not pass them on in a form that identifies you: the kitchen receives only the number of guests with each requirement.
If you name a substitute (section 11 of the terms of participation), the substitute registers with the same invitation code and gives their own consents. Your registration data are deleted once the substitute has registered.
If you take part as a speaker or panel participant, we register you ourselves on the basis of the details you give us, and the same purposes and legal bases apply.
While you fill in the registration form, your entries are saved automatically so that you can continue later and so that we can remind you if your registration stays unfinished. Saved entries that do not contain an email address are deleted automatically after 24 hours.
5. Special categories of personal data
Some information connected with your registration falls under Art. 9 GDPR:
- Accessibility requirements may reveal health data.
- Your participation in this symposium, and the delegation through which you were invited, allow conclusions about your political opinions.
We process this information only with your explicit consent under Art. 9(2)(a) GDPR, which you give by a separate tick box during registration. You may withdraw this consent at any time with effect for the future by writing to info@sf-foundation.eu. Withdrawal does not affect the lawfulness of processing carried out beforehand, and it does not affect your registration as such. If you do not consent, we cannot take accessibility requirements into account.
Access is restricted to the members of staff who organise the symposium and to the administrators named in section 11, all of whom are bound by confidentiality.
6. Information about other people you name
If you would like to share a room and give us the name or email address of the person sharing it with you, we process that information and the room allocation for the purpose of booking the accommodation, on the basis of Art. 6(1)(f) GDPR. Please inform that person that you have given us their name. We will inform them ourselves at the latest when we contact them or within one month, as required by Art. 14 GDPR.
7. Payment
After your registration we send you the bank details and your payment reference by email. You pay the participation fee by bank transfer. For this purpose we process your name, the payment reference, the amount, the date of payment and the bank details shown on your transfer.
- Purpose: monitoring of payments and accounting.
- Legal basis: Art. 6(1)(b) GDPR for payment, Art. 6(1)(c) GDPR for the accounting and tax records.
- Retention: see section 12.
8. Reimbursement of travel expenses
We reimburse your travel expenses up to the amount stated in the terms of participation, on presentation of receipts. For this purpose we process your name, the email address you used for registration (to match your claim to your registration), the amount claimed, your receipts and the travel details they contain, the name of the account holder, your IBAN and, if you provide it, your BIC, and any notes you add.
- Purpose: examination and payment of your reimbursement claim, and the related accounting.
- Legal basis: Art. 6(1)(b) GDPR for the reimbursement itself, Art. 6(1)(c) GDPR for the accounting records.
- When and how: after the symposium, through a separate online form on this website, from 1 to 8 November 2026. These details are not collected during registration. The form sends your claim and receipts to the Foundation by email.
- Retention: in the registration system until 1 November 2027, when they are deleted automatically. The receipts are accounting records; we keep them outside the registration system for the statutory period, see section 12.
9. Photographs, audio and video recordings
Photographs and audio and video recordings will be made during the symposium. They are to be used for the documentation of the symposium and for the public relations work of the Foundation, on the Foundation’s website sf-foundation.eu, on its social media channels and on this website the-venice-symposium.eu.
- Legal basis: your consent under Art. 6(1)(a) GDPR, which you may give by a separate tick box during registration. Because recordings of this symposium can allow conclusions about your political opinions, this is an explicit consent under Art. 9(2)(a) GDPR.
- Voluntary: your participation does not depend on this consent. If you do not consent, we will ensure that you cannot be recognised in published recordings.
- Withdrawal: you may withdraw your consent at any time with effect for the future by writing to info@sf-foundation.eu. We will then no longer use recordings in which you can be recognised and will remove them from the channels we control. Withdrawal does not affect the lawfulness of use before that date.
- Retention: until you withdraw your consent, or until the purpose no longer applies.
Journalists. We invite journalists to report on the symposium. They take photographs and make recordings on their own account and as controllers in their own right, not on our behalf. The consent described in this section does not cover their recordings.
10. Confirmation and admission
Your confirmation is sent by email. At check-in at the reception desk on San Servolo we check your identity against the list of registered guests. If you use the under-30 ticket, we also check your date of birth against your identity document. We only look at the document; we do not copy it.
11. Recipients
Our service provider Westmark Media has administrative access to the registration system and therefore to registration data, including the information referred to in section 5. Access is limited to named members of staff, who are bound by confidentiality, and is used solely to operate and maintain the system on our instructions.
Beyond the parties already named, personal data is disclosed to:
- 1&1 IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, which transmits the emails we send to you.
- San Servolo s.r.l., an in-house company of the Metropolitan City of Venice, Isola di San Servolo 1, 30124 Venice, Italy, which operates the island of San Servolo and provides the accommodation. We pass on only your name, for check-in. San Servolo collects the further information that accommodation providers are required to record directly from you at check-in and processes it as a controller in its own right, under its own privacy notice.
- Elementor Ltd., Israel, which compresses the images published on this website. Images may show identifiable persons, in particular the speakers of the symposium. Israel is recognised by the European Commission as providing an adequate level of data protection (Decision 2011/61/EU of 31 January 2011), so no additional safeguards are required. Elementor engages Amazon Web Services, Google Cloud and Cloudflare as sub-processors.
- public authorities, where we are legally obliged to disclose.
We do not sell personal data and we do not use it for advertising.
12. Retention
| Data | Retained until |
|---|---|
| Registration data, room allocation, dietary and accessibility requirements | 1 November 2027 (one year after the end of the symposium) |
| Invitation codes and their status | 1 November 2027 |
| Copies of travel expense claims in the registration system | 1 November 2027 |
| QR tickets and the log of emails sent by the website | 1 November 2027 |
| Payment records, travel expense receipts and bank details in the Foundation’s accounting records | ten years from 1 January of the following year (Art. 60 of the Belgian VAT Code, Art. 315 of the Belgian Income Tax Code 1992) |
| Security records of the Wordfence plugin | 30 days |
| Server log files | 7 days |
| Consent records of Borlabs Cookie | 60 days |
| Unfinished registrations saved while the form is filled in | Without email address: 24 hours. With email address: 1 November 2027 |
On the dates shown, registration data, invitation codes, QR tickets, the email log and the copies of travel expense claims are deleted automatically. Payment records and receipts are not covered by this deletion: they are accounting records, and we keep them outside the registration system. They are also subject to the audit rights of the Authority for European Political Parties and European Political Foundations.
13. Your rights
You have the right to request access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18), the right to data portability (Art. 20) and the right to object to processing based on Art. 6(1)(f) (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.
To exercise these rights, write to info@sf-foundation.eu.
You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence or place of work. The authority responsible for us is the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.
14. Security
The website is delivered exclusively over an encrypted TLS connection. Registration data is stored on a server in Germany and is accessible only to named members of staff.
15. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The automatic check of your invitation code does not produce legal effects beyond the allocation of a place and can be reviewed by our office at any time.
16. Changes
We may update this notice when the website or the registration process changes. The current version always applies.
Version: 2 October 2026