Privacy Policy

01Information We Collect

1.1Information You Provide Directly

We collect personal information that you provide to us when you:

• Create a participant portal account: your full name, email address, password and profile details
• Register for the Summit: your full name, date of birth and age, gender, nationality, country and city of residence, telephone number, organisation or institution, job title or field of study, and the capacity in which you attend (for example participant, speaker, partner, media or volunteer)
• Register a participant under eighteen (18): the participant’s details listed above, provided by email, together with the name, relationship to the participant, contact details and identification details of the consenting parent, legal guardian or first-degree relative, and the signed consent form
• Obtain your Summit badge: the identification details required for accreditation, badge issuance and security screening at Summit venues, such as your passport or national identity card number
• Choose workshops and use your agenda: your workshop selections, session registrations and personal agenda
• Tell us about your needs: an emergency contact and, on a voluntary basis, dietary requirements and accessibility needs
• Contact us: your name, contact details and the content of your message or enquiry
• Subscribe to communications or complete surveys: your email address, communication preferences and feedback responses.

1.2Information Collected at the Summit

When you attend the Summit, we collect:

• photographs, video and audio recordings in which you appear, including your image, likeness and voice, at any Summit venue
• badge scan and check-in records, including the date, time and venue when you enter the Summit, sessions and workshops
• any questions or contributions you make in sessions that are recorded, livestreamed or broadcast.

1.3Information Collected Automatically

When you visit the Website or use the participant portal, we and our analytics providers may automatically collect certain technical information through cookies and similar technologies, including:

• IP address and approximate geographic location
• browser type, device type and operating system
• pages visited, time spent on pages, links clicked and referring website
• date and time of access, portal login times and general usage patterns.

This information is used in aggregated or pseudonymised form to understand how visitors use the Website and to improve its performance and content.

1.4Information from Third Parties

In limited circumstances, for example when a parent, legal guardian or first-degree relative registers a participant under eighteen (18), or when a delegation, university, partner organisation or embassy registers participants on behalf of others, we may receive personal information about you from a third party. We treat such information in accordance with this Privacy Policy.

02How We Use Your Information

We use the information we collect for the following purposes:

• to create and manage your participant portal account and authenticate access to it
• to process and review registrations for the Summit
• to verify your identity and age and, for participants under eighteen (18), to confirm that valid consent has been given
• to allocate workshop places and prepare your personal agenda
• to produce and issue your Summit badge, which may show your name, photograph, organisation and attendee category
• to manage accreditation, venue access, security screening and protocol arrangements at all Summit venues
• to communicate with you through the participant portal, by email and, for time-sensitive logistics, by SMS or messaging services such as WhatsApp, about your registration, workshops, agenda, venues, programme updates and schedule changes
• to document, report on and promote the Summit through photography, video, livestreams, social media, press releases and publications, including the use of your image, likeness and voice
• to prepare anonymised statistics, such as participant numbers, age groups, gender and nationalities represented, for planning, reporting to partners and future editions
• to send newsletters, announcements and information about future Summit editions and Kurdistan Foundation youth programmes, where you have agreed to receive them (you may opt out at any time)
• to evaluate the Summit, for example through feedback surveys
• to operate, maintain, secure and improve the Website and the participant portal
• to prevent, detect and address fraud, misuse, breaches of the Code of Conduct, security incidents and technical issues
• to comply with applicable legal obligations and respond to lawful requests from public authorities.

We will not use your personal information for purposes materially different from those described above without informing you and, where required, obtaining your consent.

03Cookies and Analytics

3.1What Cookies Are

Cookies are small text files placed on your device when you visit a website. They help websites function properly, remember your preferences and provide analytics about site usage.

3.2Types of Cookies We Use

• Strictly necessary cookies: required for core functions, such as portal login, session management and security. These cannot be disabled through the Website.
• Analytics cookies: used to collect information about how visitors interact with the Website so that we can measure and improve performance. We may use third-party analytics services (such as Google Analytics) for this purpose.
• Functional cookies: used to remember your preferences and settings, such as language.

3.3Managing Cookies

Most web browsers allow you to control cookies through their settings, including blocking or deleting cookies. Please note that disabling certain cookies may affect the functionality of the Website, including your ability to log in to the participant portal.

04Legal Basis for Processing

We process personal information in accordance with the laws in force in the Kurdistan Region of Iraq and the Republic of Iraq, including the right to personal privacy guaranteed by Article 17 of the Constitution of the Republic of Iraq. Where the data protection laws of another jurisdiction apply to you, we rely on one or more of the following: (a) your consent, (b) the necessity of processing to manage your registration, portal account and participation, (c) our legitimate interests in organising, securing, documenting and promoting the Summit, and (d) compliance with legal obligations. For participants under eighteen (18), we rely on the consent of their parent, legal guardian or first-degree relative.

05How We Share Your Information

We do not sell, rent or trade your personal information. We may share your information only in the following circumstances:

• Within the Summit’s organising structure: with Kurdistan Foundation staff, members of the Summit’s organising committee and authorised volunteers who need the information to manage registration, workshops, accreditation and events
• Service providers: with trusted third parties who perform services on our behalf, such as website and portal hosting, email delivery, analytics, badge production, photography and video production, and IT support, under obligations of confidentiality and data protection
• Event security and accreditation: with security personnel at Summit venues and, where required, the competent authorities of the Kurdistan Region of Iraq, for the purposes of accreditation, security screening, protocol and safety
• Partners and sponsors: only in aggregated or anonymised form, such as overall attendance statistics, unless you separately and expressly consent to the sharing of your identifiable details
• Public display: your name, organisation and attendee category appear on your badge, and photographs and recordings of the Summit may be published as described in Section 2
• Legal requirements: where disclosure is required by law, regulation, court order or governmental request, or where necessary to protect the rights, property or safety of the Summit, its participants or the public
• Organisational changes: in connection with any reorganisation or transfer of the Summit’s operations, in which case we will require the recipient to honour the commitments of this Privacy Policy.

06International Transfers

The Summit attracts international participants, and some of our service providers, such as hosting and email platforms, may store or process information on servers located outside the Kurdistan Region of Iraq. Where personal information is transferred internationally, we take reasonable steps to ensure it receives an adequate level of protection consistent with this Privacy Policy.

07Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this Policy, including:

• Portal account and registration data: for the duration of your participation and for a reasonable period afterwards to manage future editions of the Summit, unless you request deletion earlier
• Identification document details: deleted after the Summit once they are no longer needed for accreditation, security or legal purposes
• Consent forms for participants under eighteen (18): for as long as needed for safeguarding, legal and audit purposes
• Emergency contact, dietary and accessibility information: deleted after the Summit once they are no longer needed
• Badge scan and check-in records: for as long as needed for security, attendance reporting and planning future editions
• Communications data: for as long as needed to respond to and document your enquiries
• Photographs and video: kept in the Summit archive for documentary and historical purposes
• Analytics data: in aggregated form for statistical purposes.

We may retain certain information for longer periods where required by law, for security and audit purposes, or to establish or defend legal claims. When information is no longer needed, we take reasonable steps to securely delete or anonymise it.

08Data Security

We implement reasonable technical and organisational measures designed to protect your personal information against unauthorised access, alteration, disclosure, loss or destruction. These measures include access controls, encrypted transmission, secure hosting environments, and restricting access to personal information to personnel who need it to perform their duties.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for keeping your portal login details confidential.

09Your Rights and Choices

Subject to applicable law, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information, much of which you can also update in your participant portal
• Deletion: request that we delete your personal information or close your portal account, subject to legal and legitimate retention needs
• Objection and restriction: object to or request restriction of certain processing of your information
• Images: ask us to remove a specific image of you from the Website or our social media channels, removal may not be possible for printed materials already distributed or for coverage by independent media
• Withdrawal of consent: withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
• Opt out of communications: unsubscribe from newsletters and promotional emails at any time by using the unsubscribe link in our emails, updating your portal preferences or contacting us directly. We may still send you essential messages about your registration, workshops, agenda or badge.

To exercise any of these rights, please contact us using the details in Section 13. We may need to verify your identity before acting on your request. A consenting adult may exercise these rights on behalf of a participant under eighteen (18). We will respond within five (5) days of receiving your request.

10Participants Under 18

As eighteen (18) is the age of majority under the Iraqi Civil Code, participants under eighteen (18) may take part in the Summit only with the written consent of a parent, legal guardian or first-degree relative aged eighteen (18) or over. Participants under eighteen (18) do not register through the participant portal, the consenting adult must contact us at [email protected] to register them.

We collect only the information needed to register and safely host the participant, and we use their image only in line with the consent given. If we learn that a person under eighteen (18) has created an account or registered without the required consent, we will close the account, cancel the registration and delete the information, except where we are required by law to keep it.

11Third-Party Websites

The Website may contain links to, or embedded content from, external websites and social media platforms that are not operated by us. This Privacy Policy applies only to our Website. We encourage you to review the privacy policies of any third-party websites you visit, as we are not responsible for their content or privacy practices.

12Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies or legal requirements. The updated Policy will be posted on this page with a revised “Last updated” date. Where changes are material, we will take reasonable steps to bring them to your attention, including through the participant portal. Your continued use of the Website after changes are posted constitutes your acceptance of the updated Policy.

13Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or the handling of your personal information, please contact:

Organiser: Kurdistan Foundation, World Youth Summit-Kurdistan 2026

Email: [email protected] (please mark your message “Privacy request”)

Address: Kurdistan Foundation, Erbil, Kurdistan Region of Iraq