Privacy policy

01. Who is responsible

DECODE is run under the brand name Fairsight SEE, which belongs to Sutic Advisory B.V. - the conference service provider, the operator of this website and the controller of the personal data described here. MISOLUTION doo Beograd, Bulevar Nikole Tesle 30a/1, 11080 Belgrade, Serbia (PIB 110355636), sells the tickets and is a separate controller for your ticket purchase; see section 06.

Controller

Sutic Advisory B.V. - brand name: Fairsight SEE

Registered address

Willem Parelstraat 254, 1018 KZ Amsterdam, Netherlands

KvK number

98679511

Privacy contact

info@decode-summit.com

Data protection officer

None appointed.

We are established in the Netherlands, so the GDPR applies to everything we do (Art. 3(1)) and the Dutch Autoriteit Persoonsgegevens is our lead supervisory authority. Because the summit takes place in Belgrade, Serbian data-protection law (ZZPL) applies in parallel for people in Serbia, and the Serbian Poverenik is an additional complaint route.

This policy covers www.decode-summit.com and email you send us. Sites we link to run under their own policies.

02. What we collect and why

The chat box is the only form on this site.

• Chat messages - the text you type and Deko’s answer, with a salted one-way hash of your IP address, your user-agent string and the time. To answer you, improve Deko and limit how often one source can send messages. Basis: consent for the text you choose to send (GDPR Art. 6(1)(a)); legitimate interest in keeping the chat secure for the technical data (Art. 6(1)(f)).
• Email - what you send to info@decode-summit.com and the replies. Basis: the contract, or the steps towards one, for tickets and partnerships (Art. 6(1)(b)); otherwise our legitimate interest in answering questions about our event (Art. 6(1)(f)).
• Ticket orders - the name, email address, company and order number that Tickets RS and the seller pass to us for each seat, to run the door and the badge list, confirm the dinner, handle seat transfers and send you practical information about the day. Basis: the contract (Art. 6(1)(b)); for an invoice and the bookkeeping record, legal obligation (Art. 6(1)(c)).
• Analytics - Google Analytics, only after “Accept all”. Basis: consent (ePrivacy Directive Art. 5(3); GDPR Art. 6(1)(a)).
• Web-server access logs - raw IP addresses in the host’s standard logs, for security. Basis: legitimate interest (Art. 6(1)(f)).
• Photography and video at the summit (section 09). Basis: legitimate interest (Art. 6(1)(f)).

We do not sell your data, profile you, make automated decisions, build advertising audiences or add you to a mailing list.

03. The chat assistant (Deko)

Deko is the optional chat panel on the content pages. It answers questions about the summit from a brief of what is already published here.

Opening the panel loads Google’s reCAPTCHA script (section 04). A message goes to our own server (api/chat.php), which adds the summit brief and asks OpenAI to write the answer, server to server. OpenAI receives the text, the conversation so far and the brief - not your IP address or cookies. It acts as our processor, does not train on the text and may keep it in abuse-monitoring logs for up to 30 days.

We store each exchange - question, answer, technical data about the request, the hashed IP address, the user-agent string and the time - in a database at our hosting provider. No name or email address is attached, and the raw IP address is never written to our database. Exchanges are deleted after 90 days. Your browser keeps the conversation in session storage under deko-thread until you close the tab or press the clear button.

04. Spam protection (reCAPTCHA)

The chat is protected by Google reCAPTCHA v3, which scores whether a person or a script is sending the message. Its script is fetched from Google only when you open the chat panel, never when a page merely loads.

From then on Google receives your IP address, browser and device characteristics and how you interact with the page, and sets its _GRECAPTCHA cookie on its own domain under Google’s privacy policy. When you send a message, our server also posts the reCAPTCHA token with your IP address to Google for verification. We receive only the score. Blocking reCAPTCHA does not lock you out.

05. Cookies and analytics

This site sets no cookies of its own. Every page loads Google’s tag: Google Analytics 4 (gtag.js, property G-NZF5RBKD44) and a Google Tag Manager container (GTM-P27LCWRX), in Consent Mode v2 with every consent type denied by default except security_storage. In that state no cookie is set and no analytics data is stored. Google does receive a cookieless consent-state ping on each page view: the page address, the time, coarse device and browser data, your IP address and the consent status.

• “Accept all” grants analytics_storage only; advertising storage stays denied. GA4 then sets _ga and _ga_NZF5RBKD44 for 13 months and Tag Manager receives a consent_granted event.
• “Essential only” keeps everything denied.
• Your choice is stored in local storage under decode-consent and decode-consent-at for 13 months, then the banner asks again. It is never sent to us.
• “Cookie settings” in the footer changes or withdraws the choice. Withdrawal deletes the two analytics cookies and reloads the page.

Consent can be withdrawn at any time (GDPR Art. 7(3)). Full list: cookie policy.

06. Tickets and partnerships

Tickets are sold on Tickets RS (tickets.rs) by MISOLUTION doo Beograd, the seller. The ticket desk on the summit page is our own markup and only links out: nothing is embedded from Tickets RS, no script of theirs runs here, and no name, email address, billing or payment detail is entered on this website. What you enter on tickets.rs - your name, email address, billing details and card - is processed by Tickets RS as a separate controller under its own privacy policy, and by the card acquirer it uses. We never see your card details.

The seller and Tickets RS pass us the order details we need to run the day: your name, email address, company, job title if given, and the order number. MISOLUTION doo Beograd is the controller for the sale itself and for the fiscal records Serbian law requires of a seller; Sutic Advisory B.V. is the controller for the attendee list and for everything else in this policy. Both are reached at info@decode-summit.com.

The links on the partners page open an ordinary email to us; nothing is submitted to this website. A partnership is agreed and invoiced separately.

07. Who receives your data

Access to what we hold is limited to the DECODE team at Sutic Advisory B.V. Who processes data for us, and the safeguard for each transfer outside the EU/EEA:

• WebHostingSrbija (Serbia) - hosts the site, the chat database and the access logs. Serbia has no EU adequacy decision; the transfer rests on the European Commission’s standard contractual clauses (Decision 2021/914; GDPR Art. 46(2)(c)) concluded with the host.
• OpenAI (United States) - the text you send Deko, under the same standard contractual clauses in its data-processing addendum.
• Google (United States) - the consent-state ping, Google Analytics after you accept, and reCAPTCHA, under the EU-US Data Privacy Framework.
• Microsoft (United States) - the mailbox on Microsoft 365, under the EU-US Data Privacy Framework.
• Tickets RS (Serbia) - the ticketing platform where you buy your seat, as a separate controller; and MISOLUTION doo Beograd (Serbia) - the seller, which receives your order from Tickets RS and shares the attendee details in section 06 with us. For people in the EU/EEA the transfer to Serbia rests on the European Commission’s standard contractual clauses (Decision 2021/914; GDPR Art. 46(2)(c)).

Data collected from people in Serbia that reaches OpenAI, Google or Microsoft is transferred under the standard contractual clauses issued by the Poverenik.

08. How long we keep it

• Chat exchanges - 90 days, then deleted.
• Email - 24 months in the mailbox, then deleted.
• Web-server access logs - 30 days, at the hosting provider.
• Analytics cookies and your banner choice - 13 months; withdrawing consent deletes the cookies at once.
• Ticket orders, invoices and partnership records - as long as Dutch bookkeeping law requires of Sutic Advisory B.V. and Serbian accounting and tax law of MISOLUTION doo Beograd; the door and attendee lists themselves are deleted twelve months after the summit.
• Photographs and video - five years from the day of the summit.

Ask us to erase what we hold earlier and we will, unless a legal obligation requires us to keep a record.

09. Photography and filming

The summit is photographed and filmed: the stage, the speakers, the panels and the audience. We use the material for the recap on this site and our own social channels and to invite people to the next summit. Basis: our legitimate interest in recording our own event (GDPR Art. 6(1)(f)). No facial recognition, no tagging, no attaching your name to an image without asking you first, and no passing the material to anyone for their own advertising.

You can opt out when you register, by email before the day, or at the entrance on the day. If something is published and you would rather it were not, write to us and we remove it from our own channels. The material is kept for five years from the day of the summit, then deleted.

10. Your rights

You can ask us to:

• Access what we hold about you and receive a copy (GDPR Art. 15).
• Rectify anything wrong or out of date (Art. 16).
• Erase it (Art. 17).
• Restrict its use while something is being sorted out (Art. 18).
• Port data you gave us in a machine-readable form (Art. 20).
• Object to processing based on our legitimate interest - the chat’s technical data, reCAPTCHA, the access logs and the photography (Art. 21). We stop unless compelling grounds override your interests.
• Withdraw consent at any time (Art. 7(3)): for analytics through “Cookie settings” in the footer; for the chat by asking us to delete your exchanges.

Write to info@decode-summit.com, from the address you used with us, so we can match your request. We answer within one month (Art. 12(3)). Chat exchanges carry no name, so tell us roughly when yours happened and what it said. For a ticket, we hold the attendee record and any invoice; Tickets RS and the seller hold the order and payment record.

11. Complaints

Please tell us first. You can also complain to a supervisory authority (GDPR Art. 77) - our lead authority, the authority where you live or work, or, in Serbia, the Poverenik - and go to court (Arts. 78 and 79).

Lead supervisory authority

Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag, Netherlands - autoriteitpersoonsgegevens.nl

Serbia

Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, 15 Bulevar kralja Aleksandra, 11120 Belgrade, Serbia - poverenik.rs

12. Changes to this policy

When this policy changes, the date at the top changes with it. If a change materially affects people who have already written to us, we tell them by email.

13. Contact

Privacy questions and rights requests: info@decode-summit.com.

Security issues: /.well-known/security.txt.

Related pages: Cookie policy and Terms & cancellation