Privacy policy

Who is responsible

The Monaco Ocean Protection Challenge Organization, a non-profit organisation in the Principality of Monaco, runs this platform. The Challenge is organised jointly with the International University of Monaco, the Oceanographic Institute (Prince Albert I of Monaco Foundation), Monaco Impact and the Prince Albert II of Monaco Foundation, who are joint controllers of participant data.

For any question about your data, write to gdpr@monaco-opc.com.

What we collect

• Your account: email address, name and role, and if you add them, phone number and photo. A password, if you set one, is stored only as a hash.
• Your application: project details, team members and their email addresses, country, institution, your answers and the files you upload.
• Jury and mentoring work: scores, comments and notes, linked to the person who wrote them.
• Technical data: IP address, browser details and a record of important actions, kept for security.

Please do not put health or other sensitive personal information in your answers. No field asks for it.

Why we use it

• To run the competition: receive applications, organise jury evaluation, announce results and send you the emails that go with it. This is needed to take part.
• To keep the platform secure and stop spam and abuse, which is in our legitimate interest and yours.
• To send our newsletter and opening alerts, only if you ask for them. You can unsubscribe from any of them at any time.

Who else receives it

The platform, its database, file storage and email server run on our own servers in Germany (EU). Visits to our public website, www.monaco-opc.com, are counted by Umami, a statistics tool we run on the same servers. It sets no cookie and does not keep IP addresses. Our administrators can look at single visits (the pages opened and buttons clicked, in order, with the approximate place, device, browser, screen size and browser language). The board sees totals and a live list of the last half hour's page views and clicks, each with its time, page, country, device and browser, but no visitor id. Results for very small groups are withheld from the board. Neither ever sees a name, email address or IP address, because Umami does not have them, and we never try to work out who a visitor is. We do not sell your data. These services receive some of it:

• The joint controllers named above, to organise the Challenge.
• OpenAI, which helps our team sort and review applications, for example by tagging projects, summarising jury feedback and suggesting jury matches. Before anything is sent we replace project IDs with codes and remove email addresses, phone numbers and web links, but names or other details written in your answers or documents can still be included. OpenAI does not train its models on this data and may keep it for up to 30 days to check for abuse. People make every decision.
• Cloudflare (Turnstile), which checks that the sign-in, password reset, application email and opening alert forms are used by a person. It receives your IP address and browser details.
• Microsoft, when you preview a Word or PowerPoint file in the platform. It receives the file and your IP address. You can download files instead.
• Amazon Web Services (Amazon SES, Paris), which delivers newsletter emails.

OpenAI, Cloudflare and Microsoft may process data in the United States. These transfers rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

Email sign-in codes

24 hours after the code expires (a code works for 10 minutes)

An application you started but did not send, with its files

Deleted 30 days after applications close

The working copy of a sent application

Cleared 30 days after applications close; the project keeps what you sent

Projects, team details and jury evaluations

10 years, then anonymised

Security and audit records

5 years; IP address and browser details removed after 12 months

Applicant and audience accounts with no sign-in for 2 years

We email you, then anonymise the account 30 days later unless you sign in

Error logs

30 days

Backups

90 days

Cookies

We only use the cookies needed to sign you in and protect forms against cross-site attacks (authjs.session-token, authjs.csrf-token, authjs.callback-url). If you arrive through a link from a partner, our newsletter or our website and agree when asked, we also keep mopc_via, which holds only that link's code, until applications close, and mopc_via_consent, which remembers your answer for 180 days. There are no analytics, advertising or tracking cookies, so there is no cookie banner.

Your rights

You can ask to see, correct, export or delete your data, to limit how we use it, or object to a use based on our legitimate interest. No decision about you is made by a machine alone. Write to gdpr@monaco-opc.com and we will reply within one month. We may ask you to confirm your identity first.

If you are not satisfied, you can complain to the Autorité de Protection des Données Personnelles (APDP) in Monaco, or to the data protection authority where you live in the EU.

Age

The Challenge is for adults. You must be 18 or older, or have the consent of a parent or guardian.

Changes

When this policy changes we update the date at the top. If a change affects how we use data you already gave us, we will tell you by email.