Last updated: [17/09/2026]

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights (LOPDGDD), and Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE), we inform you about the processing of your personal data when you use the website of the ESERA (https://esera2027.org/) and its contact form or chatbot (the “Chatbot”).

Your data are processed by a company established in Spain, and processing takes place in Spain, without prejudice to the specific international transfers described in section 7 in connection with the use of the Chatbot (Google Gemini).

1. Data Controller

Company name	Argos Proyectos Educativos, S.L.
Tax ID (NIF/CIF)	B91230235
Registered address	Calle Industria 6, planta 2, oficina 20, 41927, Mairena del Aljarafe, Sevilla, Spain
Contact email	argos@educa.org
Data Protection Officer (DPO)	“Not applicable / Not appointed”
DPO contact	argos@educa.org

2. What personal data do we process?

Depending on how you interact with the Website and the Chatbot, we may process the following categories of data:

• Identification and contact data: name, surname, email address, phone number, company/organization, job title.
• Conference registration data: billing details, ticket type, attendance preferences (in-person/online), accessibility needs if voluntarily provided.
• Data derived from Chatbot use: content of conversations held, queries submitted, date and time of interaction, session identifier.
• Contact form data: email address submitted through the Website’s contact form, and any additional information you choose to include in your message.
• Technical and browsing data: IP address, browser type, device, language, pages visited, cookies (see section 8).
• Data you voluntarily provide through contact forms, surveys, or information requests.

We do not request or process special categories of data (health, ideology, religion, sexual orientation, etc.) through the Chatbot or the contact form. Please do not include this type of information in your conversations with the assistant or in your messages.

3. What is the purpose of processing your data?

Registration management	To process your registration, ticket, and participation in the ESERA conference.
Chatbot user support	To answer questions and provide information about the program, speakers, schedule, venue, etc.
Contact form / email inquiries	To respond to questions, requests, or messages submitted through the Website’s contact form, using the email address you provide for that sole purpose.
Informational communications	To send information about the conference (updates, schedule changes, reminders), provided a legitimate basis or consent exists.
Commercial communications	Newsletter or promotion of future editions, only if you give explicit consent.
Service improvement	To analyze use of the Website and Chatbot to improve their operation (on an aggregate and, where possible, anonymized basis).
Legal compliance	To meet tax, accounting, or regulatory obligations.

4. What is the legal basis for processing?

• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR): to manage your registration and participation in the conference.
• Consent of the data subject (art. 6.1.a GDPR, and art. 21 LSSI-CE for electronic commercial communications): for sending commercial communications, for submitting the contact form, and, where applicable, for Chatbot use that involves data processing beyond what is strictly necessary to answer your query.
• Legitimate interest of the controller (art. 6.1.f GDPR): for service improvement, Website security, fraud prevention, and responding to inquiries submitted through the contact form, provided such interest does not override your rights and freedoms.
• Compliance with a legal obligation (art. 6.1.c GDPR): for tax, accounting, or other regulatory purposes.

5. Specific information about the Chatbot

Note: the processing described in this section — including the use of Google Gemini and any related data transfer — takes place exclusively when you interact with the Chatbot. It does not apply to your general browsing of the Website, to the contact form, or to any other feature of the Website.

• The Chatbot uses Google Gemini (provided by Google Ireland Limited / Google LLC, as applicable), an artificial intelligence provider, to process the text you enter into the Chatbot and generate automated responses. Access to Gemini is provided through the paid (“Prepay”) tier of the Gemini API. Under Google’s Gemini API Additional Terms of Service, the use of Paid Services automatically incorporates the Data Processing Addendum for Products Where Google is a Data Processor, without the need for a separately negotiated agreement. Google therefore acts as a data processor on our behalf under that Data Processing Addendum, in accordance with art. 28 GDPR.
• Data use by Google: because the Chatbot operates on the paid tier of the Gemini API, Google does not use the prompts or responses submitted through the Chatbot to improve or train its models. Prompts and responses may nonetheless be logged for a limited period for safety, abuse-detection, and legal-compliance purposes, in accordance with Google’s Data Processing Addendum.
• Location of processing: Google processes data through its global infrastructure. Processing may take place in the European Union/European Economic Area and, where applicable, may involve transfers to the United States or other countries where Google or its sub-processors operate data centers. This applies only to the text and data you submit through the Chatbot, not to other data collected via the Website (e.g., the contact form).
• International transfers: where data submitted through the Chatbot is transferred outside the European Economic Area in connection with the use of Google Gemini, such transfer is covered by the safeguards included in Google’s Data Processing Addendum, namely the European Commission’s Standard Contractual Clauses (SCCs) and/or Google’s adherence to the EU-U.S. Data Privacy Framework (DPF).
• Retention on our own systems: conversations held through the Chatbot are stored on our own systems for a maximum of 1 year, after which they are deleted, without prejudice to Google’s own retention of the data submitted through the API (see above).
• The Chatbot does not make automated decisions with legal effects on users, nor does it build profiles for purposes other than improving the response within the conversation itself.
• We recommend you do not share sensitive personal data, passwords, or confidential third-party information with the Chatbot.

6. How long do we keep your data?

• Registration data will be kept for the duration of the conference and, subsequently, for a minimum of 4 years, as legally required to meet tax and accounting obligations.
• Data derived from Chatbot conversations will be kept for 1 year or until you request its deletion.
• Data submitted through the contact form (including your email address) will be kept only for as long as necessary to handle your inquiry, and subsequently deleted or anonymized, unless a longer retention period is required to comply with a legal obligation or to establish, exercise, or defend legal claims.
• Data processed on the basis of your consent (e.g., newsletter) will be kept until you withdraw such consent.

7. Who will your data be shared with?

Your data may be shared with:

• Technology providers that provide website hosting, communication delivery, or Chatbot services, acting as data processors (art. 28 GDPR), under the corresponding data processing agreement, including:
  • SiteGround (website hosting).
  • Google Ireland Limited / Google LLC, which powers the Chatbot’s automated responses through the Gemini API and receives data solely when you interact with the Chatbot, and provides the Website’s analytics service (Google Analytics).
  • Oxford Abstracts (provided by Oxford Abstracts Ltd, United Kingdom), the platform through which attendees create an account, submit their abstracts, and complete the conference registration form. The information you enter into Oxford Abstracts is accessed by us as the conference organizers in order to manage your registration and participation. Oxford Abstracts also processes certain data (e.g., your account credentials and platform usage) under its own terms and privacy policy, in its capacity as the operator of the platform. We recommend that you also review Oxford Abstracts’ own Privacy Policy before registering.
• Collaborating or organizing entities of the ESERA conference: the European Science Education Research Association (ESERA) (https://esera.org/), as the international association under whose auspices the conference is held, and the University of Málaga, the University of Jaén, and the University of Almería, as co-organizing institutions, all for purposes strictly related to the organization and management of the event.
• Public authorities, when there is a legal obligation to do so.

Data will not be shared with third parties for commercial purposes unless you expressly authorize it.

International transfers

Regarding the Chatbot only, data processed through Google Gemini (paid/Prepay tier) may be transferred outside the European Economic Area (e.g., to the United States), depending on Google’s infrastructure and the specific service configuration used. As indicated in section 5, this processing is covered by Google’s Data Processing Addendum, which incorporates the European Commission’s Standard Contractual Clauses and/or Google’s adherence to the EU-U.S. Data Privacy Framework. This does not apply to data collected through other parts of the Website, such as the contact form.

Google Analytics (see section 8) is also provided by Google and may involve a similar transfer of technical/browsing data outside the European Economic Area, covered by the same type of safeguards (Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework).

Other than as described above, no international transfers of data outside the European Economic Area are carried out. SiteGround and the collaborating entities (ESERA and the universities) process data within the EU/EEA.

8. Cookies

In accordance with art. 22.2 of Law 34/2002 (LSSI-CE), this section informs you about the cookies used on the Website.

What cookies do we use?

• Necessary/technical cookies: essential for the Website to function correctly (e.g., enabling navigation, remembering your cookie preferences, ensuring security). These cookies do not require your consent, as they are strictly necessary for the service you have requested.
• Analytics cookies: used to understand how visitors use the Website (e.g., pages visited, time spent, general navigation patterns), so that we can improve its content and performance. These are used on an aggregate basis and require your prior consent.

We do not use advertising or marketing cookies. The Website does not use cookies for behavioral advertising, ad targeting, or sharing data with advertising networks.

Consent: except for necessary/technical cookies, the use of cookies requires your prior consent, which you can grant, reject, or withdraw at any time through our cookie banner/settings panel available on the Website.

Third parties: analytics cookies are provided by Google Analytics, a service of Google Ireland Limited / Google LLC, which acts as a data processor and only uses the data for the purposes described above (understanding aggregate use of the Website). Use of Google Analytics may involve a transfer of data outside the European Economic Area, covered by appropriate safeguards (see section 7, “International transfers”).

You can also manage or delete cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website.

9. What are your rights?

As a data subject, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure of your data when it is no longer necessary.
• Request restriction of processing in certain circumstances.
• Object to the processing of your data.
• Request portability of your data.
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

You may exercise these rights by writing to [contact email] or to the postal address indicated in section 1, enclosing a copy of a document proving your identity.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) — www.aepd.es — if you believe the processing of your data does not comply with applicable law.

10. Minors

In accordance with art. 7 of the LOPDGDD, the processing of personal data of minors requires their own consent from the age of 14 years old. Below that age, consent must be given by the minor’s parents or legal guardians. The Website and Chatbot are intended for an audience over 14 years of age. We do not knowingly collect data from minors under 14 without the consent of their parents or legal guardians. If you become aware that a minor under 14 has provided us with their data without such consent, please contact us so we can proceed with its deletion.

11. Security measures

We apply appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with art. 32 GDPR, including encryption of communications, access controls, and backups.

12. Changes to this Privacy Policy

We may update this Privacy Policy to adapt it to legislative developments or changes in our services. Any modification will be published on this same page, indicating the date of update.

13. Applicable law and jurisdiction

This Privacy Policy is governed by Spanish law, in particular by the GDPR, the LOPDGDD, and the LSSI-CE. For any dispute arising from the processing of your personal data, and without prejudice to your right to lodge a complaint with the AEPD (section 9) or with the data protection authority of your habitual residence, the parties submit to the courts and tribunals of Seville, Spain, unless mandatory consumer-protection rules establish a different competent jurisdiction (e.g., the courts of the consumer’s domicile, where applicable).

14. Contact

For any questions related to this Privacy Policy, you can write to us at esera@educa.org or by postal mail to Argos Proyectos Educativos SL, Calle Industria 6, planta 2, oficina 20, 41927, Mairena del Aljarafe, Sevilla, Spain.