Select language
Register

Privacy Policy

Last updated:

Table of contents

In plain English

Harbour.Space runs IOAI Spain, the Spanish selection and training programme for the International Olympiad in Artificial Intelligence. We use the details you give us to check eligibility, run the competition and training, assess your work and keep you informed about your participation.

  • Under 14? A parent or guardian needs to register you and give permission. If you are 14–17, you can register yourself; we ask for guardian details later if needed for travel or an event.
  • Promotional emails and publicity are optional. You choose separately whether to receive IOAI promotional emails and whether we may use your name, photos or recordings for publicity. Saying no does not affect participation. You can change your mind at any time.
  • We keep your data for these periods:
    • While you take part, plus two years: records needed for service emails and administration, including while you use related learning platforms. The two years run from the end of active participation or your last substantive programme-related interaction, whichever is later.
    • Ten years after the activity: a limited participation and certificate record, and named results or publicity material you have authorised. You can withdraw publication permission or request deletion of the limited participation record at any time.
    • No fixed expiry: anonymous statistics and valid IOAI email subscriptions. You can unsubscribe at any time.
  • Results are published to explain the selection process and report achievements. We use participant codes for selection rounds and obtain separate permission for named reports, including the international team’s results.
  • Some information is shared with the personnel and service providers who help us run activities. We explain additional sharing for international events before it happens.
  • Optional analytics and advertising need your permission. You can reject them and still register.
  • You can ask to see, correct or delete your information. Email info@harbour.space. Some records may need to be kept for legal reasons.

The sections below explain the details, including your rights and the exceptions to these periods.

In accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”), this Privacy Policy sets out the processing of personal data by Harbour.Space BCN, S.L.U. in connection with the International Olympiad in Artificial Intelligence in Spain (“Olympiad”), its website, and related training activities and camps.

1. Data Controller

  • Data Controller: Harbour.Space BCN, S.L.U. (“Harbour.Space”).
  • NIF: B66667064.
  • Address: Rosa Sensat Street 9–11, Barcelona 08005, Spain.
  • Email: info@harbour.space.

2. Purposes of Processing

Personal data is collected and processed for the following purposes:

  • Managing enquiries, applications, eligibility and guardian permissions, and sending service emails throughout participation in IOAI activities and related learning platforms;
  • Delivering competitions, training and camps, including bookings, payments and practical arrangements;
  • Assessing submissions, publishing selection results and reports of international participation in accordance with IOAI transparency requirements, and issuing and verifying certificates and awards;
  • Protecting the website and activities against misuse and meeting applicable legal obligations;
  • Sending optional IOAI promotional emails and using separately authorised material for IOAI publicity.

Official results. We publish results from the national selection stages using participant codes and report the international team’s results, medals and rankings. With separate publication permission, reports may identify the students who represented Spain by name. Where privacy requires, reports use participant counts instead. Identifying information is removed or anonymised when publication permission or its retention period ends. Refusing or withdrawing named-publication permission does not affect participation.

Promotional emails. These concern IOAI activities only. Each promotional email includes an unsubscribe option.

Publicity. With separate permission, we may use a participant’s name, photographs, video or audio recordings, interview statements and achievements on IOAI Spain webpages, IOAI-related social-media posts and digital or printed promotional materials. The consent request identifies the material and publication channels. Permission covers use for up to ten years after the relevant activity ends, subject to earlier withdrawal.

Your choice. Consent is obtained from the participant or parent/guardian as applicable. Refusing or withdrawing email or publicity consent does not affect eligibility, selection or participation.

Withdrawing publicity permission. Email info@harbour.space. We stop new publicity uses and remove the relevant material from channels under our control; printed material already distributed cannot be recalled.

The applicable legal basis depends on the purpose of processing:

  • Consent: voluntary Olympiad registration and participation, including eligibility checks, assessment, programme communications and coded results. Separate consent is requested for publication of named results, IOAI promotional emails, optional publicity and optional analytics or advertising technologies.
  • Performance of a contract: processing the booking party’s details to arrange and deliver activities contracted with Harbour.Space, including payment management and requested pre-contractual steps.
  • Legitimate interests: responding to enquiries, preventing misuse and retaining limited records for participation and certificate verification. Such processing is subject to consideration of the rights and interests of the individuals concerned, particularly children.
  • Compliance with legal obligations: applicable accounting requirements and legally binding requests from competent authorities.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent necessary for participation may prevent continued participation in the relevant activity.

4. Categories and Sources of Personal Data

From participants, or a parent or guardian registering them:

  • Full name and date of birth;
  • Email address;
  • Gender — used only for participation statistics.
  • Autonomous community of residence in Spain;
  • School and expected graduation year.

From parents or guardians, where required:

  • Full name, email address and telephone number;
  • Relationship to the participant and confirmation of parental responsibility or guardianship.

Created during participation: applications, correspondence, submissions, scores, participation records and consent records. Where publicity is authorised, this includes the names, images, recordings, statements and achievements covered by that permission.

From the website and related learning platforms: the website information described in section 9 and relevant participation, progress and completion updates from platforms used for IOAI activities. These updates support service emails and programme administration across successive activities.

For camps, travel and physical events: additional information is requested at the relevant stage. Booking terms and information about the processing of booking and child participant data are provided before booking. Any necessary health information is requested separately, with information about its use, recipients and retention and any required explicit consent.

5. Data Retention

During active participation, plus up to two years

Application and progress records needed to manage continuing participation — including relevant submissions, scores, correspondence and guardian contact details — are retained throughout that participation and for up to two years after it ends or after the last substantive programme-related interaction, whichever is later. This covers participation across successive IOAI editions and related training, including substantive activity on the learning platforms used for those programmes. Such activity also supports continued retention of the contact, application and participation records needed for service emails and programme administration, even where the platform has its own privacy notice.

Up to ten years

A limited participation record — name, participant or certificate identifier, programme, year and final result or award — is retained for ten years after the activity ends to verify participation and achievements for later education and employment, including beyond graduation. You can request deletion of this verification record at any time by emailing info@harbour.space; we delete it on request. Any specific evidence that must remain for legal obligations or claims is held separately with restricted access.

Separately authorised named results and publicity material may be published for up to ten years after the activity ends, subject to earlier withdrawal. At expiry or withdrawal, new uses cease and material is removed from channels under our control; distributed printed material cannot be recalled.

No fixed expiry

IOAI email subscriptions have no fixed expiry while consent remains valid and the subscription purpose continues. You can unsubscribe at any time. After unsubscription, limited information may remain solely to record permission and withdrawal and prevent further marketing, for as long as needed for those purposes.

Statistics that no longer identify anyone may be retained indefinitely.

Accounting records are retained for six years from the last accounting entry, or longer where applicable law requires. Other financial records and legal evidence follow the applicable statutory or limitation periods, with restricted access. Evidence of permissions is retained while needed to support the relevant use and any applicable legal claims. Data subject to statutory blocking is retained solely for the purposes permitted by law and subsequently destroyed. Other expired data is deleted or anonymised; recovery copies expire through the applicable backup cycle.

6. Recipients and International Transfers

Access to personal data is limited to personnel who require it for their authorised duties. Harbour.Space uses service providers for hosting, IT support, registration, communications, activity delivery, payments and website measurement. Providers acting as processors are subject to contractual obligations concerning confidentiality, security and processing on Harbour.Space’s instructions.

Relevant participation data may be communicated to Olympiad organisers where necessary for selection or attendance. Before registering selected participants for an international event or sharing additional travel or health information, we provide the relevant recipient, purpose and country information, together with the applicable basis and any international transfer safeguards. Data may also be disclosed in compliance with legal obligations or for the establishment, exercise or defence of legal claims.

Certain providers process data outside the European Economic Area, including in the United States. Such transfers are subject to an applicable European Commission adequacy decision or appropriate safeguards, including approved standard contractual clauses. Information about recipients and copies of the relevant safeguards may be requested at info@harbour.space.

7. Rights of Data Subjects

Subject to the applicable legal conditions, data subjects may exercise the following rights:

  • Access: obtain confirmation of processing and a copy of their personal data;
  • Rectification: correct inaccurate data and complete incomplete data;
  • Erasure: request deletion of personal data;
  • Restriction: request limitations on the processing of personal data;
  • Objection: object to processing based on legitimate interests on grounds relating to their particular situation, and to direct marketing at any time;
  • Portability: receive data provided under consent or contract in a structured, commonly used, machine-readable format where processing is automated, and request transmission to another controller where technically feasible;
  • Withdrawal of consent: withdraw consent at any time.

To exercise these rights, email info@harbour.space. We normally respond free of charge within one month. If a lawful extension is needed, we explain why within that month. Before disclosing or changing records, we may ask for information needed to confirm your identity or, if you are acting for a child, your authority to do so.

You have the right to complain to a competent supervisory authority, including the Spanish Data Protection Agency (AEPD).

8. Minors and Guardians

Participants under 14 must register through a parent or legal guardian, who supplies the participant and guardian details and gives the required consent. Participants aged 14 or older can register and give data-processing consent themselves. If applicable law requires parental consent for an older participant, we obtain it before completing registration.

For online registration, we request the parent or guardian’s details, their declaration of parental responsibility or guardianship, and confirmation of consent through their email address. Additional evidence may be requested if there is doubt about their authority or where travel or another activity requires it.

For participants aged 14–17 registering themselves, guardian information and any permissions required for travel, accommodation or physical events are obtained at the relevant later stage. Data-processing consent is separate from the permissions and booking conditions for those activities.

9. Cookies and Similar Technologies

What are cookies? Cookies are small files saved on your device by a website. They allow information, such as a preference or identifier, to be recognised on subsequent requests. Browser storage performs related functions without sending its contents automatically with each request.

Technologies used on this website:

  • Website functions: browser storage retains registration progress so an interrupted application can be resumed, and remembers page position where used.
  • Google Analytics: measures visits, pages viewed and interactions to understand website use. It may process device identifiers and browser and visit information.
  • Mixpanel: measures page views, interactions and registration steps to understand website use. It uses browser storage and device or user identifiers; with analytics consent, activity may be linked to a supplied email address.
  • Google Ads: measures whether advertising leads to registrations or other actions. It may process advertising identifiers, referral information and conversion events.

Optional analytics and advertising require consent. Cookie settings allow you to accept, reject or select these purposes separately, withdraw consent, and consult provider and storage-period information. Rejecting optional tracking does not prevent registration.

You may also delete cookies and browser storage through your browser settings. Deleting saved form data may remove the ability to resume that application on the device.

10. Data Security

Harbour.Space applies appropriate technical and organisational measures to safeguard personal data against unauthorised access, alteration, disclosure or destruction. These measures include access controls, secure communications and procedures governing the handling of personal data by personnel.

11. Contact Information and Policy Updates

For questions regarding this Privacy Policy or the processing of personal data, please contact:

Harbour.Space BCN, S.L.U. Rosa Sensat Street 9–11 Barcelona 08005, Spain Email: info@harbour.space

Revisions to this Policy will be published on this page. Material changes affecting data subjects will be brought to their attention as appropriate.