Privacy notice

This notice applies to the website as it operates today (Part 1). The Summer School 2027 priority list is not yet open and no registration data is accepted; Part 2 describes it provisionally and will be completed before it opens. Outstanding items are identified where they apply.

Version: draft-2026-11-r5

Basic information

Controller

Frank Hernandez, independent operator of IQ4Science, Spain.

Purposes

Delivering and protecting this website, and answering your emails. Once it opens, and only if you choose to join: managing the Summer School 2027 priority list and, only if you ask for it, sending optional news.

Legal basis

Website delivery and security, and replying to emails: our legitimate interest. Priority list (not yet open): stated in this notice before the list opens. Optional news: only with your separate consent.

Recipients

No sale or sharing for others’ marketing. Service providers acting for us: Railway (hosting), Cloudflare (network delivery and security), Zoho Mail (email).

Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent — write to [email protected]. You may complain to a data-protection authority.

More information

The full privacy notice at iq4science.com/privacy.

Who is responsible for your data

Frank Hernandez, an individual who independently operates IQ4Science in Spain. IQ4Science is not an incorporated company.

Correspondence address: Frank Hernandez (IQ4Science), Paseo de Manuel Lardizabal 13, 20018 San Sebastián, Spain. This is a correspondence address only: the institution located at this address does not operate, sponsor or control IQ4Science and is not responsible for this website or for the processing of personal data described here.

Privacy contact: [email protected]

About IQ4Science

IQ4Science — Integrity & Quality for Science is an independent educational initiative operated from Spain by Frank Hernandez. It is not an incorporated company.

IQ4Science is not organised, sponsored, endorsed, operated or controlled by Linköping University, the University of Navarra or any other university, and no university is responsible for this website or for the processing described here.

Part 1 — This website today

When you visit the website

The website does not use cookies, local storage, analytics, advertising or social-media plugins, and it does not load fonts or scripts from third parties. Photographs are served from our own media address (media.iq4science.com).

Even so, visiting the website involves processing personal data. To deliver and protect the website, our service providers process technical data about each request — your IP address, the page or image requested, the date and time, and browser information — including in request and security logs. Cloudflare uses this data for network delivery and protection against attacks; Railway, which hosts the website, records request logs to operate its platform.

Purpose: delivering the website and protecting it against attacks and misuse. Legal basis: our legitimate interest in providing a secure, working website (Article 6(1)(f) GDPR).

Our own application does not record IP addresses or other personal data in its logs.

How long: Railway keeps request logs for a limited period set by its platform, of up to 90 days, after which they are deleted automatically. Cloudflare processes request data only for as long as it needs to deliver and protect the website, under its data processing addendum; we do not export or keep copies of these logs ourselves.

When you email us

If you write to [email protected] or [email protected], we process your email address, name and whatever you include in your message in order to reply and keep a record of the exchange. Legal basis: our legitimate interest in answering enquiries (Article 6(1)(f) GDPR), or steps you ask us to take (Article 6(1)(b)). Email is handled by Zoho Mail.

How long: we keep email correspondence for up to 24 months after our last substantive exchange and then delete it, unless a legal reason, recorded at the time, requires us to keep it longer.

Who can access your data

Frank Hernandez (data controller) and Sofia Hernandez-Onu, an authorised member of the administrative team acting on the controller’s instructions and under a duty of confidentiality.

Service providers that process data on our behalf: Railway (website hosting), Cloudflare (network delivery and security) and Zoho Mail (email service that receives and stores messages sent to [email protected] and [email protected], including any personal data you include in them).

We do not sell your data or share it for others’ marketing. We may disclose data where the law requires it.

International transfers

Our service providers operate internationally, and personal data may be processed in, or accessed from, countries outside the European Economic Area, including the United States.

Cloudflare: transfers are covered by the EU Standard Contractual Clauses incorporated in Cloudflare’s data processing addendum, and by Cloudflare’s certification under the EU–US Data Privacy Framework.

Railway: Railway states that its primary processing takes place in the United States. Our data processing agreement with Railway, which sets out the transfer safeguards, has not yet been concluded; we will state the safeguards here once it is.

Zoho Mail: our mailboxes are hosted in Zoho’s European Union data centre. Our data processing agreement with Zoho, which sets out any transfer safeguards, has not yet been concluded; we will state the safeguards here once it is.

You can ask for a copy of the relevant safeguards by writing to [email protected].

Your rights

You may ask for access to your data, rectification, erasure, restriction of processing, data portability, or object to processing based on legitimate interest, and you may withdraw consent at any time. Write to [email protected] from the email address concerned; to protect you, we may reply to that address to confirm the request before acting. We reply within one month (extendable by two months for complex requests, in which case we will tell you).

Please note that deleted data may remain for a limited time in backups and in our email history until those expire; it is not used for any other purpose.

Part 2 — The Summer School 2027 priority list (not yet open)

The priority list is not yet open. This website does not currently accept or store any registration data. This part describes what we intend; it will be completed and confirmed before the list opens, and the form will show the final information.

What we would collect and why

If you choose to join, we would collect your full name, email address, institution or university, and academic level, together with the date and time of your request and the version of this notice and form wording you saw. Joining would be entirely voluntary.

We would use these details to manage the list, to estimate interest and likely attendance, and to send you information about the 2027 programme, the opening of registration and any early-registration discount. You could ask to leave the list at any time.

Legal basis: To be confirmed.

How long: To be confirmed.

To protect the form against abuse, the website would keep only a one-way, keyed hash of your connection address for one day. Railway would host the priority-list database.

Not enrolment

Joining would be free and non-binding. It is not enrolment, does not reserve a place, and does not guarantee admission or any discount. IQ4Science does not collect payments. Formal enrolment and payment are expected to be handled by a separate company, which will be identified before registration opens and will act under its own privacy notice; we will not pass your priority-list details to that company without telling you first and, where required, asking for your consent.

We do not make decisions about you based solely on automated processing, and we do not profile you.

Optional news about other activities

Only if you tick a separate, optional box (never pre-ticked) would we occasionally send you news about future editions, corporate training and other IQ4Science activities, based on your separate consent (Article 6(1)(a) GDPR and the Spanish rules on electronic commercial communications). You could withdraw this consent at any time, while staying on the priority list, by writing to [email protected] or using the opt-out included in each message.

Changes to this notice

We will publish any changes on this page with a new version label. If a change materially affects how we use data you have already given us, we will tell you and, where required, ask for your consent again.

Complaints

If you are not satisfied with our answer, you may lodge a complaint with a data-protection authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es); you may also contact the authority where you live or work.