Participation Policy, Privacy Notice & Image Use
Version 1.0 — applicable to GDCY Fest 2026
1. About this document
This document sets out the rules of participation, the image and likeness policy, and the privacy notice for the CYGMA Teen Track held within GDCY Fest 2026 (the “Event”). It applies to all participants and, for participants under the age of 18, to their parents or legal guardians.
This is a reference policy. The corresponding consents are collected at the time of registration through the online registration form. By submitting the registration form, the participant (or, for minors, the parent or legal guardian) confirms that they have read this policy and accept it. Registration is finalised only after the parent or guardian confirms their email address through the confirmation link sent by the Organiser.
2. Organiser and Data Controller
Organiser: GDCY Ltd., Erotokritou 17, 4527 Mouttagiaka, Limassol, Cyprus.
Contact for all matters related to this policy, participation and personal data: tim@gdcy.eu.
3. Attendance & Supervision Policy
The CYGMA Teen Track is a non-residential, drop-in educational programme held within the wider GDCY Fest 2026 venue. Participants attend the Event independently. The following rules apply:
- The Organiser provides supervision only inside scheduled Teen Track sessions, while those sessions are in progress and inside the designated session rooms.
- Outside of scheduled sessions — including arrival, departure, breaks, lunch, transitions between rooms, and any time the participant chooses to leave the venue — the participant is not supervised by the Organiser.
- The Organiser does not act in loco parentis, does not control entry or exit, and does not take custody of the participant at any point.
- The parent or legal guardian remains responsible for the participant’s transport to and from the venue, conduct outside sessions, personal belongings, and any decision to leave the venue early.
- The Organiser may remove a participant from the programme for breach of the Code of Conduct (see Section 6), in which case the parent or legal guardian will be contacted using the details provided at registration.
No medical information is collected by the Organiser. Participants are responsible for carrying any necessary personal medical items themselves. In case of emergency, the Organiser will contact the parent or legal guardian first; if unreachable, the backup emergency contact provided at registration.
4. Image & Likeness Rights
Photography and video recording will take place throughout the Event. Captured material may include the participant’s image, voice and name.
By completing the registration form and granting the corresponding consent, the parent or legal guardian (or the participant, if 18 or over) grants GDCY Ltd. and CYGMA a free, non-exclusive, worldwide, perpetual and irrevocable licence to use, reproduce, edit, publish, broadcast, distribute and sublicense photographs, video and audio recordings of the participant captured at the Event for the following purposes:
- Internal Event documentation, archive and reporting.
- Publication on websites, social media accounts and digital channels of CYGMA and GDCY Fest.
- Press releases, press kits and editorial coverage by media outlets covering the Event.
- Marketing and promotional materials for CYGMA and GDCY Fest, including future editions of the Event.
- Communication and promotional materials of Event partners (sponsors, exhibitors, co-organisers).
No additional remuneration will be due. The participant’s full name may be used alongside the image only with separate confirmation in writing. Once material has been published or distributed to media or partners, the Organiser cannot guarantee its withdrawal from third-party publications, although the Organiser will remove material from its own channels on written request to tim@gdcy.eu.
5. Privacy Notice (GDPR)
This section describes how GDCY Ltd. processes personal data in connection with the Event, in accordance with Regulation (EU) 2016/679 (GDPR) and Cyprus Law 125(I)/2018.
5.1 Data we collect
- Participant identity and contact data: name, date of birth, email, phone, place of study.
- Parent or guardian identity and contact data: name, relationship to participant, email, phone.
- Backup emergency contact details: name, relationship, phone.
- Photographs, video and audio recordings captured at the Event.
- Records of consents given through the registration form, including timestamp and submission metadata, kept as proof of lawful processing.
5.2 Purposes and legal bases
|
Purpose of processing |
Legal basis |
|
Registration, selection and communication regarding the Event |
Performance of the agreement — GDPR Art. 6(1)(b) |
|
Verification of parental authority for participants under 18, including the email confirmation step |
Compliance with legal obligations and legitimate interest — GDPR Art. 8 and Cyprus Law 125(I)/2018; GDPR Art. 6(1)(c) and 6(1)(f) |
|
Emergency contact during the Event |
Legitimate interest in safeguarding participants — GDPR Art. 6(1)(f); used only if an emergency arises |
|
Photo and video use as described in Section 4 |
Consent — GDPR Art. 6(1)(a), given through the registration form |
|
Marketing communications from CYGMA (participants 18+ only) |
Consent — GDPR Art. 6(1)(a), given only if the optional checkbox is ticked at registration |
5.3 Recipients
Personal data may be shared with the following categories of recipients, strictly for the purposes set out above:
- CYGMA team and authorised contractors operating the Event (registration, IT, photographers, videographers).
- Event partners (sponsors, exhibitors, co-organisers, official partners) for the photo and video purposes described in Section 4 and, where applicable, business networking activities listed in the GDCY Fest Privacy Policy.
- Media outlets covering the Event, in connection with photo and video material.
- Authorities, where disclosure is required by law.
5.4 International transfers
Some recipients (cloud providers, social media platforms, partners) may be located outside the European Economic Area. In such cases, the Organiser relies on Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms under GDPR Chapter V.
5.5 Retention periods
|
Data category |
Retention period |
|
Registration data of selected participants |
Duration of the Event + 12 months, unless a shorter period is required |
|
Registration data of non-selected applicants |
Deleted within 90 days after the Event |
|
Backup emergency contact data |
Deleted within 30 days after the Event |
|
Photo and video material |
For as long as it is used for archival, reporting and promotional purposes; consent for promotional and partner use may be withdrawn at any time |
|
Records of consents given through the registration form |
6 years after the Event, as proof of lawful processing |
5.6 Your rights
Under GDPR, data subjects have the right of access, rectification, erasure, restriction, objection, data portability and the right to lodge a complaint with the Cyprus Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy). Where processing is based on consent, the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal, also applies. To exercise any right, contact tim@gdcy.eu.
6. Code of Conduct
Participation in the Event requires compliance with the following Code of Conduct. All participants are expected to:
- Treat all attendees, speakers, partners and staff with respect.
- Refrain from harassment, discrimination, hate speech, intimidation, or any unwanted physical contact.
- Refrain from alcohol, drugs, smoking and vaping inside the venue.
- Follow venue safety instructions and the directions of Organiser staff.
- Not record or photograph other attendees without their consent and not share private images of other minors.
Breach of the Code of Conduct may result in immediate removal from the Event without refund, and the parent or legal guardian will be contacted.
7. How consent is given
All consents required for participation are collected through the online registration form, by means of separate, freely given, granular checkboxes. The form records, for each submission, the date and time, the IP address of the submitter and the email of the parent or guardian.
The Organiser reasonably relies on the representation that the parental or guardian confirmation section is completed by the participant together with their parent or legal guardian. Any submission made contrary to this requirement shall constitute a breach of the registration rules by the participant and/or submitting person.
For participants under the age of 18, registration is finalised only after the parent or legal guardian confirms their email address through the confirmation link sent by the Organiser. This double opt-in step constitutes the Organiser’s reasonable verification of parental authority within the meaning of GDPR Art. 8 and Cyprus Law 125(I)/2018.
After registration, a copy of this policy and a record of the consents given remain available to the parent or guardian. Consent given through the registration form may be withdrawn at any time by writing to tim@gdcy.eu, without affecting the lawfulness of processing carried out before the withdrawal.
8. Contact
For any question regarding this policy, participation in the Event, or the processing of personal data, please contact:
GDCY Ltd. — Erotokritou 17, 4527 Mouttagiaka, Limassol, Cyprus — tim@gdcy.eu