Participant Privacy Notice

1 Who this notice is for

This notice applies to you if you are a participant in an event organized by an institution that uses Attendae — for example, a student in a course, a delegate at a congress, or an employee in a training program. If you are an institutional administrator, see the Privacy Policy.

2 Data Controller and Processor

Data Controller — The Institution

The organization that runs the event (school, university, company, government body, etc.) is the Data Controller. It decided to collect your data and determines the purposes. Direct any primary concerns about your personal data to the institution.

Data Processor — Attendae

Attendae processes your personal data on behalf of the institution, following its instructions. Attendae does not use your data for its own commercial purposes beyond operating the platform.

This distinction matters for your rights: the institution is responsible for deciding how long to keep your data, who can access it, and for most decisions about your participation records.

3 Data we collect

Data	Required?	Source
Full name	Yes	Provided by you at registration, or pre-loaded by the institution from an attendance list
Email address	Yes	Provided by you at registration, or pre-loaded by the institution
Employee / student ID	Optional (institution decides)	Provided by you or imported by the institution
Group / cohort	Optional (institution decides)	Pre-loaded by the institution
Attendance records	Yes (purpose of platform)	Generated automatically at check-in
Check-in method	Yes	Recorded automatically (QR scan, admin manual, or imported)
Check-in timestamp	Yes	Recorded automatically
Geolocation data	Depends on event settings	Requested from your device browser at check-in if geolocation is enabled

4 Geolocation

If the organizing institution has enabled geolocation verification for the event, Attendae will request access to your device's GPS location at the moment of check-in.

Your browser will ask for permission before sharing your location. You may deny the request, though this may prevent check-in if the institution requires geolocation.
Your coordinates are used solely to verify that you are within the designated check-in area (geofence) at the time of check-in.
Coordinates are stored in the attendance record for audit purposes and accessible to the organizing institution.
Attendae does not track your location continuously — only the single coordinate at the moment of check-in is recorded.
Location data is not shared with advertising platforms, analytics services, or any third party beyond the organizing institution and Attendae's hosting provider.

Whether geolocation is required for an event is a decision made by the organizing institution, not by Attendae. If you have concerns about geolocation at a specific event, contact the institution.

5 How your data is used

Record your attendance at individual sessions and track cumulative attendance across the event
Verify that attendance requirements are met for certificate eligibility
Generate and deliver your participation certificate by email
Enable you to access your personal participation profile at attendae.app/mi/{token}
Allow public verification that a certificate with a specific folio number is authentic
Provide the organizing institution with attendance reports and analytics

Attendae does not use your data for advertising, profiling, or any purpose beyond operating the platform on behalf of the institution.

6 Data sharing

Your data may be shared with:

The organizing institution — as the Data Controller, the institution has full access to your participation records, attendance data, and generated certificates
Banahosting — the server hosting provider (Mexico), where all data is stored
Attendae staff — strictly for platform support and maintenance, subject to confidentiality obligations

Your data is not shared with advertising networks, analytics platforms, data brokers, or any commercial third party. See Sub-processors for the complete list.

7 Certificates and public verification

Public certificate verification

Participation certificates issued by Attendae include a unique folio number and a QR code. Anyone who scans that QR or visits the verification URL can confirm whether a certificate with that folio is valid — the verification page shows:

The certificate holder's name
The event name and organizing institution
The certificate status (valid / cancelled)
The issue date

This public verifiability is the core purpose of the certificate. If you do not want your name to appear on a publicly verifiable certificate, do not accept the certificate or contact the organizing institution before it is issued.

8 How long we keep your data

Retention periods are determined primarily by the organizing institution as Data Controller. As a general guide, Attendae retains participant data for as long as the institution's account is active, plus a grace period after account closure. Issued certificates are retained for their verification lifetime.

For specific retention timelines, see Data Retention & Deletion Policy.

9 Your rights

Under Mexico's LFPDPPP, you have the right to Access, Rectification, Cancellation, and Opposition (ARCO) over your personal data.

For data related to your participation records and certificates, contact the organizing institution in the first instance.
For data processed by Attendae in its own capacity, contact privacidad@attendae.com.
If you are unsure who to contact, email Attendae and we will route your request.

For full details on how to exercise these rights and response timelines, see ARCO Rights.

If you believe your rights have been violated, you may file a complaint with INAI.

10 Contact

Attendae Privacy Office: privacidad@attendae.com
Organizing institution: See the event microsite or your invitation email for contact details.