Privacy Policy

1. Who is responsible

Surpresas Imaculadas LDA, NIPC PT518339661, Rua Ruben A. Leitão 4, 2.º Dto, 1200-392 Lisboa, Portugal, is the controller of the personal data described here. For anything about your data, write to live@conscioushealth.io. We have not appointed a data protection officer; the law does not require one for an organisation of our size.

2. What we collect, and when

• LinkedIn advertising measurement: the LinkedIn Insight Tag measures visits and successful form signups on this site. LinkedIn receives technical browser and page information and may set advertising identifiers, including the first-party li_fat_id cookie. It loads only when our advertising consent rules permit it, and stays off when you decline or send Global Privacy Control. You can change your choice under Cookie settings. LinkedIn is a recipient of this measurement data.
• X advertising measurement: the X website pixel and Conversion API measure visits, successful sign-ups and ticket purchases from our X ads. X receives page and browser information, IP addresses where available, X click identifiers, a hashed form of your email for sign-ups and purchases, conversion identifiers and, for purchases, the value and currency. Both browser and server measurement follow our advertising consent choice and stay off when you decline. Global Privacy Control enables X's Restricted Data Use for measurement without advertising optimisation. X is a recipient of this measurement data.
• Visiting this site: we count visits with Vercel Web Analytics for every visitor. It sets no cookies and keeps no identifier beyond a hash that expires within a day, so it cannot follow you across sites or visits. We also use Google Analytics, to see how people find and use the site, and Google Ads and Meta's pixel, to measure whether our ads lead to visits, sign-ups and ticket sales. These set cookies (such as _ga, _gcl and _fbp) and receive your IP address, your browser and device, the pages you visit and what you do on them. Where the law requires your consent first, as in the European Economic Area, the United Kingdom and Switzerland, none of this loads until you accept. Elsewhere it runs unless you opt out. If your browser sends a Global Privacy Control signal, Google and Meta still count our ad results, but in their limited modes (restricted data processing, Limited Data Use): the data is used only to measure our campaigns, never to personalise ads or to share or sell it. Once measurement runs, our server re-issues these cookies on our own domain so they last their normal lifetime (up to 13 months) rather than the few days some browsers allow. You can change your choice at any time under Cookie settings at the bottom of every page. Our hosting provider processes your IP address and technical request data to deliver the pages and protect the site. The aftermovie plays from YouTube's privacy-enhanced player, which stores cookies only if you start it.
• Joining the mailing list or writing through a form: your email address and, if you give them, your name, organisation, your message, and the way you want to join (attend, partner, speak, report). We store each submission and add you to our mailing list with a matching tag. A newsletter subscription is confirmed by a link in a first email.
• Buying a ticket: your name, email address, the company for your badge, billing details and VAT number if you want an invoice, the ticket type and any code used, your order and payment history. Card payments are processed by our payment provider; we never hold your full card number.
• At the Summit: the time your ticket is scanned at check-in, workshop and session choices, and the contact details you let an exhibitor scan from your badge.
• Sensitive information: dietary requirements, accessibility needs, and health information you give us or a facilitator for a session or in an emergency. We ask for it only when a service needs it, use it only for that, and delete it after the Summit.
• Speakers, exhibitors, partners, press and volunteers: application and contact details, company and billing details, biographies, photos and logos you give us, and the agreements we sign.
• Correspondence: emails, messages and notes of calls with you, and your interactions with our accounts on social networks.
• Photos and recordings: images and voice recordings made during the Summit, as described in section 8 of our Terms & Conditions.
• What others give us: when someone buys a ticket for you or registers you as their staff, we receive your name and email address from them.

3. Why, and on what legal basis

• To fulfil our contract with you: selling and delivering tickets, issuing badges and invoices, giving access to what you bought, and sending the messages your booking needs, such as confirmations, access details and schedule changes. These service messages are not marketing and come whether or not you subscribe to news.
• Because the law requires it: keeping invoices and accounting records for ten years under Portuguese tax law, keeping complaint records, meeting safety and security duties, and answering lawful requests from authorities.
• Because we have a legitimate interest: running and securing the Summit, keeping records of our relationships with partners and speakers, documenting and promoting the Summit with images of the audience (by attending you agree to this under the Terms, and you can ask us to take down a published close-up of you), understanding what worked, counting visits and measuring our advertising where the law does not require consent (you can object at any time under Cookie settings), defending our rights, and contacting people in a professional capacity about partnering, speaking or exhibiting. We weigh these interests against your rights each time.
• With your consent: our newsletter and news about future editions (unsubscribe at any time, with one click), analytics and marketing cookies and advertising measurement where the law requires consent (sections 2 and 4), quotes and testimonials published with your name, sensitive information, and anything else we ask you for separately. Withdrawing consent does not affect what was done before.

4. Who else sees your data

We do not sell personal data, and we do not give attendee lists to sponsors or exhibitors. We share data only with the following, and only what each needs:

• Providers working for us: our payment provider (Stripe), the ticketing and check-in platform named at checkout, our mailing-list provider (Kit), our cloud and web hosting (Amazon Web Services, Frankfurt, and Vercel, which also counts our visits), our analytics provider (Google Analytics), our office and work tools (Google Workspace, Tresorit and the software we run the Summit with), our invoicing software (Moloni), our accountants, and the venue and security team. They act under contracts that limit them to our instructions.
• Exhibitors: an exhibitor receives your contact details only when you let them scan your badge or hand them over yourself. From then on the exhibitor is responsible for how they use them and must let you opt out of their communications.
• Advertising measurement: we send Google and Meta (Instagram and Facebook) the events that matter to our campaigns, such as a page visit, a sign-up or a ticket purchase. To both we also send a hashed form of your email address and name, and the city, region and postcode your connection points to (hashed for Meta), through Google's enhanced conversions, Meta's pixel and Conversions API, to measure the campaigns and reach people like our attendees. When you buy a ticket, the ticketing or payment platform reports the order to our server (its amount and tickets, your email and name, and the visit identifier the site added when you went to checkout), and our server sends the purchase on. A ticket bought without that identifier is counted in Google Analytics as revenue only, with no identifier and nothing sent to Meta. Where the law requires consent, this happens only after you accept; elsewhere it happens unless you opt out, and with a Global Privacy Control signal only in the limited modes described in section 2. If you fill in one of our lead forms on Facebook or Instagram, Meta passes us what you entered and we handle it like a sign-up on this site. For collecting and sending that data, we and Meta Platforms Ireland are jointly responsible under Meta's Controller Addendum; what Meta does with it afterwards is governed by Meta's own policy. You can change your choice at any time under Cookie settings or by writing to us.
• Platforms you use with us: when you interact with our pages on Instagram, Facebook, LinkedIn or YouTube, those companies process your data under their own policies.
• Partner communities: a community that shares a code with its members tells us only that a code was used, not who you are.
• Authorities, insurers and advisers: when the law requires it, in an emergency, or to establish or defend a legal claim.
• A successor: if another company takes over the organisation of the Summit, your data goes with it under the same commitments; we will tell you.

5. Where your data goes

We keep our records in the European Economic Area. Some of our providers are established in the United States or process data there, among them our mailing-list, payment and hosting providers. We rely on their certification under the EU–US Data Privacy Framework where they hold it, and otherwise on the European Commission's Standard Contractual Clauses, together with the measures the providers describe in their own policies.

6. How long we keep it

• Orders and invoices: ten years, as Portuguese tax law requires.
• Ticket and attendance records: three years after the Summit, then only as anonymous statistics.
• Mailing list: until you unsubscribe, or after two years without opening any of our emails. Analytics data: 14 months. Consent records for cookies and advertising measurement: three years.
• Form submissions and correspondence: while the matter is open and for three years after it closes.
• Sensitive information for the Summit: deleted within 30 days after it.
• Applications we did not take up: one year, unless you ask us to keep you in mind for the next edition.
• Photos and recordings of the Summit: kept as its archive. A published close-up of you is taken down when you ask, where we control it.
• Complaints: three years, as the law requires.

7. Your rights

You can ask us for a copy of the data we hold about you, have it corrected or deleted, restrict or object to how we use it, receive it in a portable format, withdraw a consent, and object to marketing at any time. Write to live@conscioushealth.io; we may ask you to confirm your identity, and we answer within one month. You may also complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority of the country where you live.

8. Security

The site is served over an encrypted connection. Access to your data is limited to the people who need it for their work, our providers hold their own security certifications, and card details never touch our systems. If a breach ever puts you at risk, we will tell you and the authority as the law requires.

9. Children

The Summit and this site are made for adults. We do not knowingly collect data from anyone under 18: a child ticket is registered under the accompanying parent's or legal guardian's details.

10. Changes

When our practices change, we update this policy and its date. If a change matters to you, we will say so here, and where it needs your consent we will ask you first.

11. Contact

Surpresas Imaculadas LDA, Rua Ruben A. Leitão 4, 2.º Dto, 1200-392 Lisboa, Portugal. Email: live@conscioushealth.io.