Privacy Policy & DPDP Notice
Designed with reference to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025
This notice explains how IAMMTAPC 2026 collects, uses, stores, shares, protects, and retains personal data. It also describes the mechanisms available to Data Principals for exercising applicable privacy rights.
Version: v1.1-2026-DPDP•Effective Date: 20 August 2026•Last Updated: 20 August 2026
Need to exercise your privacy rights?
Submit a request relating to access, correction, erasure, consent withdrawal, or grievance.
1Data Fiduciary Identity & Contact Details
This Privacy Policy applies to the processing of digital personal data in connection with the XXIX IAMM TAPC Chapter Annual Conference 2026 ("IAMMTAPC 2026"), including its registration, abstract submission, communication, payment, badge, certificate, and related conference services.
The conference organising body acts as the entity responsible for determining the purposes and means of processing personal data for the conference services described in this notice.
Data Fiduciary: Organising Committee, IAMMTAPC 2026 (XXIX IAMM TAPC Chapter Annual Conference)
Host Institution & Venue: All India Institute of Medical Sciences (AIIMS) Mangalagiri, Andhra Pradesh - 522503, India
Official Contact Email: iammtapc2026@gmail.com
Technical Support & Platform Provider: Eventtrix (eventtrix.in) may process information on documented instructions to support registration, QR badges, and conference communications.
2Categories of Personal Data Collected
We aim to follow the principle of data minimisation and collect personal data that is reasonably necessary for the specific conference services and purposes described in this notice.
A. Identity & Contact Data
Full name, title/designation, institution/organisation, email address, mobile number, city, and state, where required for registration or communication.
B. Professional & Registration Data
Professional registration information, IAMM TAPC membership status, delegate category, and related eligibility information where required.
C. Scientific & Abstract Data
Abstract title, author/co-author names, affiliations, scientific content, HOD endorsement letters, presentation files, and related submission information.
D. Payment & Invoice Data
Order ID, transaction reference, payment timestamp, amount, payment status, and invoice references. We do not intentionally store card numbers, CVV, UPI PINs, or banking credentials.
E. Event Operations & Badging
Registration ID, QR/badge identifier, check-in information, attendance records, certificate information, and accompanying-person information where applicable.
F. Technical & Consent Records
IP address, browser/device information, session information, consent records, notice/policy version, timestamps, and security/audit information where required.
3Purpose of Processing
Personal data is processed only for specified conference, operational, legal, security, and communication purposes. Depending on the processing activity, the applicable legal basis may include consent or processing permitted/required by applicable law.
Conference Registration & Ticketing: Creating and managing delegate registrations, validating eligibility, allocating workshops or sessions, and generating badges.
Payment & Invoicing: Processing and verifying payments through the applicable payment gateway, issuing invoices/receipts, and maintaining financial records.
Scientific Abstract Management: Receiving, reviewing, evaluating, communicating decisions on, and managing scientific abstracts and presentation materials.
Transactional Communications: Sending registration confirmations, login or account-related messages, payment confirmations, abstract notifications, event schedules, reminders, and other necessary service communications.
Event Access & Certificate Issuance: Verifying registrations at the venue, managing attendance/check-in, and issuing participation or attendance certificates.
Legal, Accounting & Security Requirements: Meeting applicable legal obligations, maintaining financial and operational records, preventing misuse, protecting the platform, and investigating security incidents.
4Privacy Notice, Consent & Withdrawal
Where processing is based on consent, we aim to obtain consent through clear, specific, informed, and affirmative actions. The privacy notice provided at the point of collection is intended to explain the personal data being collected and the specific purpose for which it is processed.
- No pre-selected consent: Consent controls should require an affirmative user action where consent is required.
- Purpose-specific choices: Optional promotional communications should be distinguishable from communications necessary to provide the requested service.
- Withdrawal: Where processing is based on consent, you may withdraw consent through the available privacy mechanism or by contacting us.
- Effect of withdrawal: Withdrawal does not invalidate processing lawfully carried out before withdrawal and may not affect processing that is independently permitted or required by law.
5Third-Party Service Providers
We use selected third-party service providers to support payment processing, document storage, email/SMS/WhatsApp communications, hosting, and other conference operations. Personal data is shared only where necessary for the relevant purpose. Appropriate contractual, confidentiality, security, and data-protection safeguards are sought where applicable.
| Service Provider | Purpose | Personal Data Shared | Security / Safeguards |
|---|---|---|---|
Razorpay Software Pvt. Ltd. | Payment processing and payment-status verification | Name, email, mobile number, registration/order reference, amount, and transaction-related information | Encrypted transmission and payment-security controls provided by the payment service |
Cloudinary Inc. | Storage and delivery of abstracts, documents, and presentation materials | Uploaded abstract files, HOD letters, presentation files, and related file metadata | HTTPS transmission and access-controlled/private delivery mechanisms where configured |
Email / SMTP Service Provider | Transactional emails, invoices, receipts, registration and conference communications | Recipient name, email address, registration information, and relevant communication/document information | Encrypted transmission and provider-level email security controls |
SMS / WhatsApp Messaging Provider | Transactional alerts, notifications, reminders, and event communications | Name, mobile number, registration ID, and message-related information | Encrypted transmission and applicable messaging-provider security controls |
Vercel / Railway Infrastructure | Website hosting, application execution, networking, and infrastructure services | IP address, request metadata, technical headers, session/technical information, and other data processed through the hosted application | Infrastructure access controls, encryption in transit, monitoring, and provider security controls |
Important: The service-provider list above must reflect the providers actually used by the production application. If a provider is replaced or no longer used, this notice should be updated accordingly.
6Protection of Children's Personal Data
Conference Eligibility: IAMMTAPC 2026 is intended for medical professionals, faculty, postgraduates, researchers, delegates, and other eligible conference participants.
The conference website is not intended to knowingly collect or process personal data of children for ordinary conference participation. We do not use children's personal data for behavioural tracking or targeted advertising.
If we become aware that personal data relating to a child has been collected where the applicable requirements have not been satisfied, we will take appropriate steps consistent with applicable law.
7Data Retention & Deletion
Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, to provide requested services, to maintain required records, or to comply with applicable legal, accounting, security, or dispute-resolution requirements.
| Data Category | Retention Approach | Disposal Approach |
|---|---|---|
| Registration & Badge Data | For the conference lifecycle and the period reasonably required for post-event administration, certificate verification, dispute handling, or other legitimate operational needs. | Deletion or anonymisation when no longer required, subject to applicable retention obligations. |
| Financial & Invoice Records | For the period required by applicable tax, accounting, financial, or other legal obligations. | Deletion or anonymisation when the applicable retention requirement expires, subject to legitimate archival requirements. |
| Scientific Abstracts & Proceedings | For conference proceedings, scientific/academic archival, publication, or other purposes communicated to participants, as applicable. | Deletion, archival, or anonymisation depending on the publication/archival purpose and applicable requirements. |
| Transactional Delivery Logs | For the period reasonably required for delivery verification, troubleshooting, security, and operational purposes. | Periodic deletion or anonymisation according to the platform's operational retention schedule. |
| Consent & Privacy Request Records | For as long as reasonably necessary to demonstrate consent status, process requests, resolve disputes, and meet applicable legal requirements. | Secure deletion or anonymisation when no longer required. |
We do not represent any particular retention period as a statutory requirement unless that period has been verified against the applicable law and the organisation's documented retention schedule.
8Your Rights as a Data Principal
Subject to the applicable provisions of the DPDP framework, you may have rights including the following:
1
Access / Information: Request information about whether your personal data is being processed and obtain the information that the applicable law requires the Data Fiduciary to provide.
2
Correction & Updating: Request correction, completion, or updating of inaccurate, incomplete, or outdated personal data, subject to applicable requirements.
3
Erasure: Request erasure of personal data where it is no longer necessary for the purpose for which it was processed, subject to legal or other applicable retention requirements.
4
Grievance Redressal: Use the available grievance mechanism to raise concerns about the processing of your personal data.
5
Nomination: Where applicable under the DPDP framework, nominate one or more individuals to exercise your rights in accordance with the prescribed procedure.
6
Consent Withdrawal: Where processing is based on consent, withdraw that consent through the available mechanism or by contacting us.
9Security Safeguards & Incident Response
We implement reasonable technical and organisational measures appropriate to the nature of the personal data and the risks associated with its processing.
Encryption in Transit
HTTPS/TLS is used for protected communication between users, the application, and applicable service providers.
Access Control
Role-based and authenticated access controls are used for administrative and operational systems.
Credential Protection
Authentication credentials are protected using appropriate password hashing and security practices.
PII Protection
Personal information should be minimised and masked in logs and operational diagnostics where practical.
File Protection
Uploaded documents are subject to access controls and secure delivery mechanisms where configured.
Incident Response
Security incidents are investigated, contained, documented, and escalated in accordance with applicable requirements.
Personal Data Breach: Where a personal data breach occurs, we will follow our incident-response procedure and make notifications to affected Data Principals and the competent authority/Board in the form, manner, and timeframe required by applicable law and the DPDP Rules.
10Privacy & Data Request Process
You can submit a privacy request through the available online mechanism or by contacting the conference privacy/grievance contact.
01
Submit
Submit your request with sufficient information for us to identify and process it.
02
Verify
We may take reasonable steps to verify the identity of the requester.
03
Review
We assess the request against applicable legal, operational, security, and retention requirements.
04
Respond
We communicate the outcome and any applicable next steps.
11Cookies, Analytics & Privacy Settings
The website may use cookies or similar technologies for essential functionality, security, session management, preferences, analytics, or other purposes depending on the services enabled on the website.
Necessary
Required for core website functionality, security, authentication, and session management.
Functional / Preferences
Used to remember choices and improve the user experience where applicable.
Analytics / Optional
Optional measurement or analytics technologies may be controlled through the available privacy settings.
12Third-Party & Cross-Border Processing
Some technology and infrastructure providers used by the conference platform may operate infrastructure or process data in locations outside India. The applicable location and processing arrangements depend on the services actually configured for the production platform.
Where applicable, we will implement contractual, technical, and organisational safeguards and comply with any requirements imposed under applicable Indian law concerning processing or making personal data available outside India.
13Abstracts, Authors & Public Information
Abstract submissions may contain personal information relating to authors, co-authors, institutions, and scientific work. Access to submissions is restricted according to the conference workflow.
Author email addresses, mobile numbers, login credentials, payment information, and other non-public personal information should not be displayed on public abstract, speaker, or conference pages unless there is a valid and appropriately communicated basis for doing so.
14Grievance Redressal & Contact
If you have a question, concern, or grievance relating to the processing of your personal data, please contact the conference secretariat using the details below.
Conference Secretariat / Privacy & Grievance Contact
Institution: Department of Microbiology, AIIMS Mangalagiri, Vijayawada, Andhra Pradesh - 522503, India
Email: iammtapc2026@gmail.com
Helpline / Technical Support: +91 93985 18364 / 99864 15211
Privacy-related grievances should first be submitted through the conference grievance mechanism. Further escalation may be available under the applicable DPDP framework and procedures.
15Updates to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the conference services, technology, applicable law, third-party services, or data-processing practices.
When material changes are made, we will update the version and last-updated date shown at the top of this page and, where appropriate, provide an additional notice or obtain consent where required.
16DPDP Readiness Statement
The conference platform is being designed and operated with privacy-by-design principles and with reference to the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
This notice describes the platform's current privacy practices and should not be interpreted as a legal certification or guarantee of statutory compliance. Organisational policies, contractual arrangements, retention schedules, processor agreements, and other compliance matters should be reviewed by the appropriate legal/privacy authority before making a formal compliance representation.