Privacy
Privacy policy
How the personal data collected on this website is handled. The final version will be reviewed by the organisers' legal adviser.
[final text to be reviewed by the legal adviser]
Data controller
The organisers are Comunidade Islâmica de Palmela and Centro Português do Qur'an.
Which entity is the data controller is still being confirmed with the competition organisers. If the two organising entities decide together on the data, they are joint controllers (Article 26 GDPR) and the essence of their arrangement will be published here.
Data controller, Portuguese company number (NIPC) and registered address: [to be confirmed]
Data collected
- Full name
- date of birth
- nationality, country and city of residence
- email and mobile number
- Qur'an training institution (school, maktab or teacher)
- category, chosen parts (Juz) and riwayah
- answer about the accommodation provided by the organisers (category F)
- parent or guardian details and the name of the accompanying adult (under 18s)
- a copy of the participant's identity document and, for under 18s, also the parent or guardian's
- a record of the declarations, the consents and the version of the texts accepted
Health data (optional): once a registration is approved, the registration status page lets you indicate allergies and support needs during the competition. It is collected only with explicit consent, is not a condition for taking part and only authorised staff can see it.
Travel details (optional, after approval): the registration status page lets you give the travel mode, the date and approximate time of arrival and departure, the flight numbers, the place of arrival, the number of people travelling with the participant, notes and, if you wish, a copy of the ticket or booking. For under 18s, they can be given by the participant or by the parent or guardian, and who gave them is recorded. They are used only to organise the event logistics (welcome, arrivals and departures); the notes are not meant for health data.
Purposes
To organise the competition; to confirm age and category; to communicate with the participant or their parent or guardian, including emails about the registration status; to organise the event logistics (welcome, arrivals and departures), when travel details are provided; to look after the safety and well-being of participants during the competition, when health data is provided; to produce statistics for managing the event, without identifying anyone; to protect the website against abuse and attacks; to share the competition in audio and video, in line with the declarations given.
Legal basis
Performance of the participation agreement (Article 6(1)(b) GDPR), including the travel details given after approval. Explicit consent for data that may reveal religious belief and for health data (Article 9(2)(a) GDPR). Consent for audio and video recording and broadcasting. Legitimate interest in the security of the website and the prevention of abuse (Article 6(1)(f) GDPR).
Recipients and processors
Only the organisers' authorised staff see the data. The following process data on the organisers' behalf, under a data processing agreement: Vercel (website hosting), Supabase (database and files, stored in Frankfurt, in the European Union), Resend (sending emails, from Ireland) and Cloudflare (protection against abuse). During the competition, the participant's name, country, age and category appear on the screens and in the broadcast. The data is never sold or shared for commercial purposes. [to be confirmed]
Transfers outside the European Union
Some of these providers are companies based in the United States. Where data is transferred outside the European Economic Area, this is done under a European Commission adequacy decision or standard contractual clauses. [to be confirmed]
Retention periods
Copies of identity documents are deleted when a registration is cancelled and, for every registration, on 29 March 2027.
Health data is deleted when a registration is cancelled, when consent is withdrawn and, for every registration, on 29 March 2027.
Travel details and copies of tickets or bookings are deleted when a registration is cancelled and, for every registration, on 29 March 2027.
Anonymous website measurements (visits, performance and errors) are deleted after 90 days, and the log of views and changes made by staff after 400 days.
Retention of the remaining data: [to be confirmed]
Rights
Access and rectification through the link received by email, while the registration is pending. Erasure, objection, restriction and portability on request to the organisers, with a reply within one month. You can withdraw any consent at any time, without affecting processing already carried out; consent for health data can be withdrawn on the registration status page itself, until the data is deleted, the day after the competition ends. You also have the right to lodge a complaint with the Portuguese data protection authority (Comissão Nacional de Proteção de Dados, CNPD, www.cnpd.pt).
Under 18s
Under 18s are registered by their parent or guardian, who gives the declarations and consents on their behalf and also receives the communications. A minor's health data can only be provided by the parent or guardian, through the link sent to them.
Automated decisions
The form suggests a category based on the date of birth, but every registration is always decided by people from the organisers.
Security
The data is stored in the European Union, with access restricted to authorised staff, two-factor authentication and a log of views, changes and exports. Free-text health details are encrypted. To stop abuse, IP addresses are only used briefly or turned into a code that changes every day and cannot be turned back into the address; the website never stores IP addresses. The hosting providers may record IP addresses in their technical logs, for a short period, to run and secure the service.
Privacy contact
For privacy questions: hifz@cip.edu.pt