Privacy Policy

The Portuguese Competition Authority (hereinafter “AdC”), with registered office at Avenida José Malhoa, no. 17, 1070-157 Lisbon, Portugal, a public-law legal person, corporate identification number 506557057, of an institutional nature, with its own assets and administrative and financial autonomy, is the entity responsible for the collection and processing of personal data for the purposes set out in this Privacy Policy (hereinafter the “Policy”), relating to the planning, organisation, holding and dissemination of the 27th International Competition Network Annual Conference (hereinafter the “Conference”).

In connection with its activities, AdC may be contacted through the following means:

In view of the legal obligation arising from Article 37(1)(a) of the GDPR, AdC, as a public-law legal person with the status of an independent administrative authority, has appointed a Data Protection Officer.

Data Subjects may address any questions relating to the processing of their personal data to the Data Protection Officer at the following email address:

This Privacy Policy supplements the AdC Privacy Policy.

Personal data may be collected directly from participants and speakers, namely through the registration form, communications by email or the contact channels made available for the Conference, as well as in connection with their participation in the Conference.

Personal data may also be obtained from the International Competition Network (hereinafter the “ICN”), its members and working groups, as well as from authorities, organisations or other entities that nominate or designate participants and speakers, including through official lists intended exclusively for the planning, organisation and holding of the Conference.

Where personal data have not been collected directly from the Data Subject, AdC shall provide the information required under Article 14 of the GDPR, within the legally applicable terms and time limits, unless the Data Subject already has that information or another exemption provided for by the applicable legislation applies.

In connection with the planning, organisation, holding and dissemination of the Conference, AdC may collect and process the following categories of personal data:

• Identification and contact data: full name, email address and telephone number, for the purposes of managing invitations, registrations, accreditation, communications and participation in the Conference.
• Professional and representation data: authority, institution or organisation, position or role, country or jurisdiction and participant category, including National Competition Agency Staff, Non-Governmental Advisors, Special Guests or other categories specified by the participant, for the purposes of validating participation, preparing participant lists, organising the programme, protocol and Conference logistics.
• Participation data: the number of days on which the participant expects to attend the Conference and the social activities for which the participant wishes to register, for the purposes of managing registrations, capacity, access, transport and other logistical matters.
• Data relating to the issue of an invitation letter for visa purposes: an indication of whether an invitation letter is required and, if so, the personal data strictly necessary for its issue and for liaison with the competent authorities for visa purposes.
• Data relating to dietary restrictions: an optional indication of the existence of dietary restrictions and, where applicable, additional information necessary to provide suitable meals. This information may reveal data concerning health, religious beliefs or other special categories of personal data.
• Data relating to accessibility needs: an optional indication of the existence of accessibility needs and, where applicable, additional information necessary to provide appropriate accommodations for full participation in the Conference. This information may reveal data concerning health or other special categories of personal data.
• Image, voice and contribution data: photographs, images and audio and video recordings captured during the Conference, including in common and circulation areas, as well as the image, voice, questions and other contributions captured during sessions held in the auditorium. All sessions held in the auditorium will be recorded and livestreamed through AdC’s YouTube channel, embedded on the Conference website, and the corresponding recordings may subsequently be made available through AdC’s institutional channels, for the purposes of transmission, documentation, archiving and institutional dissemination of the Conference.
• Data relating to consent for the use of images: the expression of consent, the date on which consent was given and the version of the consent statement presented to the Data Subject, for the purposes of recording and demonstrating that consent was given.
• Speaker data: full name, photograph, biographical note, position or positions, authority or organisation, link to the institutional website indicated by the speaker and link to the corresponding LinkedIn profile, where provided, for the purposes of creating and publishing the speaker’s individual profile and organising the Conference programme.

AdC may create, update and use an internal participant list for the purposes of planning, organisation, coordination, protocol, accreditation, security, communication and Conference logistics.

For the purposes of planning, organising and coordinating the Conference, AdC may share with persons expressly designated by the ICN or by its members the participants’ full name, country or jurisdiction, authority, institution or organisation, position or role, participant category and, where necessary, email address.

Where this sharing involves a transfer of personal data outside the European Economic Area, the conditions and safeguards set out in the section of this Policy concerning international transfers shall apply.

The sharing shall be limited to the recipients and data strictly necessary for the coordination of the Conference and shall be subject to the prior identification of the legal basis and, where applicable, the appropriate international transfer mechanism.

The participant may indicate in the registration form whether an invitation letter is required to support a visa application.

Where an invitation letter is requested, AdC shall process the personal data strictly necessary to identify the participant, prepare the letter and confirm that the participant is expected to attend the Conference, namely:

• full name, as shown in the passport;
• date of birth;
• passport number;
• nationality, as shown in the passport;
• passport expiry date;
• country and place of residence in that country;
• expected date of travel;
• email address;
• telephone number.

These data may be disclosed to the Portuguese Ministry of Foreign Affairs for onward communication to the competent diplomatic or consular representations, for the purpose of confirming that the Data Subject is expected to attend the Conference.

AdC may request additional information where it is indispensable for issuing the invitation letter or required by the competent consular authority. A copy of the passport shall be requested only where strictly necessary for that purpose.

The invitation letter is intended solely to confirm participation in the Conference. It does not replace any other required documents and does not guarantee the issue of a visa or entry into Portuguese territory.

The fields relating to dietary restrictions and accessibility needs are optional. The information provided may reveal data concerning health, disability, religious beliefs or other special categories of personal data.

This information shall be processed exclusively to provide suitable meals and the accessibility accommodations necessary for participation in the Conference, on the basis of the participant’s explicit consent.

Access to these data shall be limited to duly authorised persons who need them to arrange the requested conditions. The information may be disclosed to teams or entities responsible for catering, accessibility or on-site assistance, only to the extent strictly necessary and, whenever possible, without directly identifying the participant.

Data relating to dietary restrictions and accessibility needs shall be stored separately from the other general registration data and shall be subject to enhanced access control measures.

Refusal to provide this information shall not prevent registration or participation in the Conference, although it may limit the organisers’ ability to arrange in advance any conditions or accommodations that have not been communicated.

The participant may withdraw consent at any time by contacting privacidade@concorrencia.pt, without affecting the lawfulness of processing based on consent before its withdrawal.

Personal data are processed on the following legal bases, depending on the purpose:

• Registration and participation in the Conference: the processing of data necessary for managing registration, accreditation, participation, social events, communications and logistics is based on the implementation of measures associated with the Data Subject’s registration and participation in the Conference, pursuant to Article 6(1)(b) of the GDPR.
• Coordination with the ICN: the receipt, updating and use of the internal participant list, as well as its restricted circulation within the International Competition Network and among the representatives involved in planning the Conference, are based on the performance of tasks carried out in the public interest by AdC, pursuant to Article 6(1)(b) of the GDPR, to the extent necessary for organising the Conference.
• Invitation letter for visa purposes: the processing of data necessary to prepare and issue the invitation letter requested by the participant is based on the performance of tasks carried out in the public interest by AdC, pursuant to Article 6(1)(a) of the GDPR.
• Dietary restrictions and accessibility needs: where the information provided reveals special categories of personal data, the processing is based on the participant’s explicit consent, pursuant to Articles 6(1)(a) and 9(2)(a) of the GDPR.
• Speaker profiles: the processing and publication of the name, photograph, biographical note, position or positions, authority or organisation, link to the institutional website and, where indicated, link to the LinkedIn profile are based on the speaker’s consent, pursuant to Article 6(1)(a) of the GDPR, without prejudice to the terms agreed for the speaker’s participation.
• Speakers’ image, voice and materials: the capture, recording and transmission of the image, voice and contributions of speakers during sessions held in the auditorium, as well as the subsequent availability of the corresponding recordings, are based on the speakers’ consent, pursuant to Article 6(1)(a) of the GDPR. The use of presentations, photographs and other materials protected by copyright shall be subject to appropriate authorisation or licence.
• General images of the event: the capture and use of general shots of the audience, premises and sessions for documentation, archiving, public information and institutional dissemination are based on the performance of tasks carried out in the public interest by AdC, pursuant to Article 6(1)(a) of the GDPR. Participants may exercise the right to object under Article 21 of the GDPR.
• Cookies and YouTube: the use of cookies that are not strictly necessary and the loading of the YouTube player embedded on the website depend on the user’s consent, where legally required.

Where processing is based on consent, the Data Subject may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

With the consent given by the speaker at the time of registration, the website may display an individual profile containing the full name, photograph, biographical note, position or positions, authority or organisation, link to the institutional website indicated by the speaker and, optionally, a link to the corresponding LinkedIn profile.

Personal data shall be collected directly from the speaker or, where applicable, obtained from the authority or organisation represented or from another institutional source indicated for that purpose. Where personal data have not been collected directly from the speaker, the information required under Article 14 of the GDPR shall be provided within the legally applicable terms and time limits.

The speaker shall confirm the accuracy of the details presented and declare that the speaker holds the necessary rights to the photograph and other content provided to allow their publication on the Conference website.

External links are provided solely for public information and are subject to the terms of use and privacy policies of the corresponding websites.

The speaker may request the correction or updating of the details contained in the profile by emailing icn2027@concorrencia.pt and may exercise data protection rights by emailing privacidade@concorrencia.pt.

During the Conference, photographs may be taken and image and sound recordings may be made, namely in common areas, circulation areas and the auditorium.

Sessions held in the auditorium will be recorded in audio and video and livestreamed through AdC’s YouTube channel, using a player embedded on the Conference website. The corresponding recordings will subsequently remain available on that channel and may also be made available through other AdC institutional channels. Visible notices will be displayed at the entrances to the venue and the auditorium, informing participants about the taking of photographs, audio and video recording, and the livestreaming of sessions held in the auditorium.

Photographs and recordings may include participants’ image and voice, as well as questions or other contributions made during sessions in the auditorium. These data shall be processed for the purposes of livestreaming, documentation, archiving and institutional dissemination of the Conference.

The individual capture and use of participants’ image, voice and any contributions depend on the consent given during the registration process. Participants may indicate their decision by selecting “I agree” or “I do not agree”. The option selected, the date and time of the corresponding record and the version of the information presented to the participant shall be retained for the purposes of demonstrating that consent was given or refused.

Refusal of consent shall not prevent registration or participation in the Conference. Participants who have not given consent shall be informed of the recording and transmission arrangements for sessions held in the auditorium and of the measures available to avoid or limit, to the extent possible, the individual capture of their image, voice or contributions.

Consent may be withdrawn at any time by contacting privacidade@concorrencia.pt, without affecting the lawfulness of processing based on consent before its withdrawal.

The withdrawal of consent shall take effect in relation to future uses of the participant’s image, voice or contributions. Where the content remains under AdC’s control, technically and legally feasible measures shall be taken to cease its individual use. The withdrawal of consent shall not affect livestreams already carried out or uses made before the withdrawal.

The capture and use of speakers’ image, voice, presentations and contributions shall be subject to specific information and consent.

Personal data may be processed by duly authorised AdC employees and collaborators and by entities contracted to provide services necessary for the organisation and holding of the Conference, including registration management, website hosting and maintenance, accreditation, audiovisual production, livestreaming, catering and accessibility services.

Entities that process personal data on behalf of AdC shall be subject to a contract entered into pursuant to Article 28 of the GDPR and may process the data only in accordance with AdC’s documented instructions, ensuring their confidentiality and security.

Where personal data are disclosed to an entity that processes them for its own purposes, AdC shall first identify the applicable legal basis and provide the Data Subject with the information required by law.

Where the disclosure of personal data to a third party depends on the Data Subject’s consent, that consent shall be requested freely, specifically and in an informed manner, after identifying the recipient or category of recipients and the purpose of the disclosure.

Data relating to dietary restrictions and accessibility needs shall be disclosed only to the persons or entities responsible for providing the requested meals or accommodations, and the disclosure shall be limited to the data strictly necessary for that purpose.

Data processed for the purposes of issuing an invitation letter may be disclosed to the Portuguese Ministry of Foreign Affairs and, through that Ministry, to the competent diplomatic or consular representations, as described in section 5 of this Policy.

The sharing of personal data with the ICN is described in section 4 of this Policy.

In the context of the international coordination of the Conference, the version of the participant list referred to in section 4 may be made available to persons designated by the ICN or by its members, including recipients located outside the European Economic Area. The transfer shall be limited to the data strictly necessary and shall take place only where the conditions laid down in Chapter V of the GDPR are met.

AdC shall identify and document the recipients, countries of destination and the legal mechanism applicable to each transfer. Where the recipient country benefits from an adequacy decision adopted by the European Commission, the transfer shall be carried out on the basis of that decision. In the absence of an applicable adequacy decision, AdC shall adopt the appropriate safeguards provided for under the GDPR, including standard contractual clauses where they constitute the appropriate mechanism for the transfer concerned.

Data Subjects may obtain information about the recipient countries and the applicable mechanism by contacting privacidade@concorrencia.pt.

Personal data shall be retained for the period necessary to pursue the purposes for which they were collected, without prejudice to the retention periods and final disposal arrangements laid down in the legislation and records management instruments applicable to AdC.

In particular:

• data necessary for the administrative management of registration, communication with participants and documentation of the procedure, including the internal participant list and the version intended for coordination with the ICN, shall be retained until the administrative closure of the Conference and thereafter for the period provided for in the records management instruments applicable to AdC;
• data used exclusively for managing attendance, activities, capacity, access, transport and other logistical matters shall be deleted or anonymised no later than 90 days after the end of the Conference, unless retention for a longer period is necessary to deal with an incident or complaint or to comply with a legal or administrative obligation;
• data relating to dietary restrictions and accessibility needs shall be deleted no later than 30 days after the end of the Conference, unless retention for a longer period is necessary to deal with an incident or complaint;
• data relating to the issue of invitation letters shall be retained for up to six months after the end of the Conference, unless a legal or administrative obligation justifies retention for a longer period;
• records relating to consent given shall be retained while the processing based on consent continues and thereafter for the period necessary to demonstrate AdC’s compliance with its legal obligations;
• technical data and website security logs shall be retained for the period necessary for the operation and security of the website, in accordance with the security and retention rules applicable to AdC;
• speaker profiles, photographs, recordings, presentations and other content selected for archiving and institutional dissemination shall be retained for as long as they remain necessary and appropriate for those purposes, without prejudice to the exercise of Data Subjects’ rights. Recordings made available on AdC’s YouTube channel shall remain available for as long as they remain necessary and appropriate for the purposes identified in this Policy.

At the end of the corresponding retention periods, personal data shall be deleted or anonymised, unless they must be retained pursuant to a legal, administrative or archival obligation applicable to AdC.

Under and within the limits laid down by the applicable legislation, the Data Subject may:

• request access to the personal data concerning them;
• request the rectification of inaccurate or incomplete personal data;
• request the erasure of personal data where the applicable legal requirements are met;
• request the restriction of the processing of their personal data;
• object to the processing of their personal data where it is based on the performance of tasks carried out in the public interest by AdC;
• request data portability where that right applies.

Where processing is based on consent, the Data Subject may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Requests to exercise rights must be submitted by email to privacidade@concorrencia.pt.

The Data Subject may also lodge a complaint with the Portuguese Data Protection Authority through www.cnpd.pt.

AdC shall implement appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and security of personal data processed in connection with the Conference, including access control measures, restriction of permissions, secure transmission of information and duties of confidentiality applicable to persons authorised to access the data.

Access to personal data shall be limited to persons who need them to perform their respective duties, in accordance with the purposes set out in this Policy.

The internal participant list and the version intended for coordination with the ICN shall not be sent through open distribution lists, published on the website, made available to other participants or stored in personal or unauthorised locations.

Data relating to dietary restrictions and accessibility needs shall be stored separately and shall be subject to particularly restricted access. Data relating to the issue of invitation letters for visa purposes shall also be subject to particularly restricted access. In all cases, access shall be restricted to what is strictly necessary to fulfil the corresponding purposes.

AdC shall also take appropriate measures to ensure that entities processing personal data on its behalf comply with AdC’s documented instructions and the applicable obligations concerning confidentiality, security and personal data protection.

This Policy may be reviewed or updated whenever necessary. The current version and the date of the latest update shall be made available on the Conference website.

Last updated: 29 September 2026