Data of Educational Programs and Events

1.1. The controller of participants’ personal data is NGO “HandS Lab” (full registered name: NON-GOVERNMENTAL ORGANIZATION “Human & Synthetic Lab”), EDRPOU code 46189265, registered office: Ukraine, 03035, Kyiv, 13 Vasylia Mytropolyta Lypkivskoho Street, email: [email protected] (the “Organizer”).

1.2. This document supplements the Privacy Notice and applies to lectures, webinars, workshops, educational programs, community participation, and related recordings and materials.

1.3. Questions about data processing can be sent to [email protected].

2.1. Registration data: name, email address, organization name and position (if you provide them), and the chosen event or program.

2.2. Participation data: attendance records, completion of assignments, questions and messages in chat or the shared space, and answers to feedback questionnaires.

2.3. Event recordings: audio, video, and text of the speaker’s talk; where needed, participants’ voice, image, or questions, which is announced before the start.

2.4. Certificate data: name and information about participation or completion of a program.

2.5. Payment data (for paid participation): processed by the payment service. The Organizer receives confirmation of payment without full payment details.

2.6. Do not send real client stories, consultation records, medical documents, or personal data of third parties through forms, chat, or the shared space.

3.1. Registration and organizing participation, communication about the event: performance of a contract or steps taken at the person’s request before concluding it.

3.2. Issuing a certificate, recording participation, meeting legal requirements: performance of a contract and the Organizer’s legitimate interest.

3.3. Payment: performance of a contract and legal requirements.

3.4. Feedback and improving programs: legitimate interest; in anonymized form.

3.5. Recording participants and publishing recordings: the participant’s consent, which may be withdrawn.

3.6. Sending notes: separate consent.

3.7. Use of data for research or scientific publications: only with a separate informed consent and a protocol. Buying training or taking part in a program is not consent to take part in research.

4.1. By default, the speaker’s talk and materials are recorded, not automatically every participant.

4.2. Before an event we state whether it will be recorded, what will enter the recording, who will have access, for how long, and which services are used.

4.3. Participation with a camera, voice, or a personal story is not blanket permission for any later publication. A separate consent is required if a participant’s voice, image, or question may enter a recording that is published outside live participation.

4.4. Where possible we offer ways to take part without identification: text questions without a public name, questions read out by a moderator, and a part of the meeting without recording.

4.5. A participant may withdraw consent to recording and publication. After withdrawal the Organizer, within a reasonable time and as a rule within 14 days, deletes or anonymizes the relevant fragment where technically possible; copies already distributed by third parties cannot be withdrawn by the Organizer.

4.6. Participants are not allowed to make their own recordings without the Organizer’s permission.

5.1. If participation is ordered by an organization, the organization does not automatically obtain rights to personal statements, answers, or results of individual participants.

5.2. The organization may receive anonymized generalized summaries (number of participants, completion, generalized feedback) if participants were notified before the start. Passing participants’ personal data to the ordering organization is allowed only with their consent or on another lawful ground.

6.1. To run events and communicate, we may use: the online event platform named in the announcement; an email and mailing service; a payment service; and website hosting and security services. The list of providers is given in the Privacy Notice.

6.2. Some providers may process data outside Ukraine, including in the EU and the US, under their own policies and applicable transfer mechanisms.

6.3. We do not sell participants’ data and do not use it for advertising.

7.1. We keep registration and participation data for 3 years after the end of the program or event unless the law requires a longer period.

7.2. We keep data for confirming a certificate while the certificate may need to be verified, but no longer than 5 years after issue.

7.3. We keep event recordings for the period stated in the announcement or until consent is withdrawn under Section 4.

7.4. After generalization we keep answers to feedback questionnaires only in anonymized form.

7.5. We keep payment data for the periods set by accounting legislation.

8.1. You have the right to know what data about you is processed, to require its correction or deletion, to restrict processing, to object to processing, to withdraw consent and, if the GDPR applies, to receive data in a portable format.

8.2. To use your rights, write to [email protected]. We will reply within 30 days.

8.3. You may also complain to the Ukrainian Parliament Commissioner for Human Rights or, if the GDPR applies, to the supervisory authority of the country where you live.

9.1. We apply organizational and technical data protection measures proportionate to the risks, including access restriction, encryption in transit, and staff training.

9.2. Programs and the community are intended for adults. If we learn that we hold data of a minor without the consent of a legal representative, we delete it.

9.3. We may update this document. We notify of material changes on the website and, where possible, by email.

9.4. This document is made in Ukrainian. The English translation is provided for convenience; in case of discrepancies the Ukrainian text prevails.