Privacy Notice for the Data Spaces Symposium 2026

DATA AI AND ROBOTICS DAIRO (BDVA), 
established in AVENUE DES ARTS 56, BRUXELLES 1000, Belgium
Contact: info@bdva.eu 

FIWARE FOUNDATION EV (FIWARE), 
established in FRANKLINSTRASSE 13 A, BERLIN 10587, Germany
Contact: fiware-personaldataprotection@lists.fiware.org 

GAIA-X EUROPEAN ASSOCIATION FOR DATA AND CLOUD (Gaia-X),
established in AVENUE DES ARTS 6-9, BRUXELLES 1210, Belgium
Contact: info@gaia-x.eu 

INTERNATIONAL DATA SPACES EV (IDSA),
established in EMIL-FIGGE-STR. 80, 44227 DORTMUND,Germany
Contact: info@internationaldataspaces.org 

Hereinafter defined as “the Organizers”, would like to inform you within this privacy notice as a participant or guest at our event (hereinafter “participant” or “you”) or as a speaker or moderator at our events (hereinafter “speaker” or “you”) about the processing of your personal data with regard to the Data Spaces Symposium 2026, taking place at the Novotel Madrid Central Hotel in Madrid, Spain, on 10 – 11 February 2026 (hereinafter “Event”). 

1. Controller

The Organizers have entered into a joint controllership arrangement in accordance with Article 26 GDPR, defining their respective responsibilities regarding compliance with data-protection obligations. In particular, BDVA/DAIRO is responsible for managing registration and participant communications, FIWARE for technical tools and event-platform management, Gaia-X for handling data-subject requests and overall GDPR-compliance oversight, and IDSA for documentation and post-event reporting. 
The main point of contact for exercising data-subject rights is info@gaia-x.eu  

2. Categories of personal data and data sources

In the course of hosting Events, whether online or in-person,  the Parties will process your personal data to prepare, organise, and host the event as set out hereunder. 

2.1 Registration for the Event

We process the following personal data of participants, speakers, and moderators in the preparation
We process the following personal data of participants, speakers, and moderators in the preparation of the Event provided by you during the registration process: 

We process these data to keep track of registrations and to allow us to keep you updated about details relating to the Event (such as topics, speakers, and schedules). 

If they have consented, registered participants may be entered into our database, so we may contact them about similar future events. Should you object to be included in our database or If you do not want to receive event invitations from us, you can withdraw your consent by sending an email to events@dssc.eu. 

2.2 Attendance at the Event

The Organizers will keep a list with the names and affiliations of confirmed participants.

Photography and videography during the Event are carried out on the basis of your explicit consent, which you may withdraw at any time. General panoramic or audience shots taken to document the Event may be processed under the Organizers’ legitimate interest (Art. 6(1)(f) GDPR) to promote and report on the Symposium, provided that such processing does not override your rights and freedoms. By agreeing to this Privacy Notice, I acknowledge that I have been clearly informed of the possibility of being photographed and/or recorded during the Event and that such consent is freely given, specific, informed, and unambiguous in accordance with Articles 6(1)(a) and 7 of the GDPR. I understand that I have the right to refuse to be photographed or recorded and may withdraw my consent at any time with future effect by contacting the Organizers at the following email addresses: events@dssc.eu, info@internationaldataspaces.org, info@gaia-x.eu, or info@bdva.eu. 

3. Purpose and legal basis of the processing of personal data

3.1 Data processing due to the performance of a contract (Art. 6 Sec. 1 lit. b) GDPR)

Any personal data processed as part of your registration and to conduct the Event will be processed as this is necessary for the performance of a contract to which you are party. This includes the processing of your personal data to process your registration, contacting you for organisational purposes and conducting the Event. 

3.2 Data processing due to legitimate interests (Art. 6 Sec. 1 lit. f) GDPR)

We also process personal data to pursue our legitimate interests to keep you posted about future Events, to document and promote the Parties’ events and to gain insights into the impact of our Events and possibilities to optimise such events. In the latter cases, the legal basis will be our legitimate interest and therefore article 6 (1) f of the GDPR, except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject, which require protection of personal data. 

3.3 Consent (Art. 6 Sec. 1 lit a) GDPR

In those cases where you have consented to the use of your personal data, the legal basis is article 6 (1) a of the GDPR.  

You may unsubscribe at any time by email via info@bdva.eu; info@gaia-x.eu; info@internationaldataspaces.org  

3.4 Terms of Use for the use of Microsoft Office 365 Components at Fraunhofer-Gesellschaft by External Parties and Data Protection Information

Acceptance of the invitation and the use of the Microsoft Office 365 components made available by the Fraunhofer Institute shall be deemed a binding declaration of acceptance of the annexed Terms of Use without deviations. If you are acting for a company or an organization that cooperates with Fraunhofer-Gesellschaft, you further confirm thereby that you are authorized to accept the annexed Terms of Use without changes. 

4. Disclosure of personal data

4.1 External service provider

Data may be accessed by service providers with whom we have entered into data processing agreements with, for the purposes of administrating our events logistics, photography, filming, cloud services, or video conferencing. 

The registration process is carried out by a dedicated platform from the following organization: 

CREA EVENTOS E INCENTIVOS BARCELONA, S.L. 
VAT Number: ES B64707409 
C/Travesera de Gracia, 15 S.At. 4ª 
08021 Barcelona (SPAIN) 

4.2 Other recipients 

Furthermore, the images will be published for the purpose of post-event reporting on our media platforms such as Facebook, Twitter, Linkedin, belonging to the Parties. This processing is required in particular to document and promote our event and post-event promotional activities. 

5. Data Retention

Personal data collected for registration and event participation will be retained for a maximum of 12 months after the conclusion of the Event, unless you have consented to further communications. After this period, your data will be deleted or anonymised unless a longer retention period is required by law or necessary for the establishment, exercise, or defence of legal claims. 

6. Rights of the data subject 

You have the following rights in regard to your personal data: 

You have the right to access (Art.15 GDPR) , correct (Art. 16 GDPR), update or request the  erasure  of personal data (Art. 17 GDPR), and you can ask us to restrict the processing of your personal data (Art. 18 GDPR) or request portability (Art. 20 GDPR) . 

If we process your personal data based on our legitimate interest, you can object to this processing (Art. 21 GDPR) insofar as reasons arise from your particular situation that conflict with this data processing. Having received your objection, we will then stop this processing unless we can demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms concerned, or the processing serves the purpose of asserting, exercising, or defending legal claims (Art. 77 GDPR). Contact: info@internationaldataspaces.org, info@gaia-x.eu,  info@bdva.eu.  

Where the processing of your personal data is based on your consent, you can withdraw your consent at any time and without any reason (Art. 7 (3) GDPR). Withdrawing your consent means that the Parties will not make use of your data any longer for the purposes that you consented to. This does not invalidate past uses of your personal data for which you gave consent, and your personal data will continue to be processed in the event of any legal obligations that the Parties must meet. 

To exercise these rights or if you have any questions or complaints about data protection, please feel free to contact us. You can find our contact details under point 7 of this privacy notice. The Parties must confirm your identity and will review your request to ensure that it can be honoured without compromising other legal requirements and pursuant to the limitations provided by GDPR. We aim to have replied within 30 days of your request except where you have withdrawn your consent, which shall be actioned immediately. 

In addition, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). 

As the Organizers are established in both Belgium and Germany, you may lodge a complaint with either the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) or the German Federal Commissioner for Data Protection and Freedom of Information (BfDI), depending on your location or the primary location of data processing. 

7. Contact

The Parties responsible for the processing of your personal data can be reached out at, info@internationaldataspaces.org, info@gaia-x.eu, info@bdva.eu