Privacy Policy — ISCoC App

Last updated: April 19, 2026

1. Data Controller

The ISCoC application is developed and maintained as part of the International School of Crystallography (Erice, Sicily). For any privacy-related inquiries, please contact us at: lodosaps@gmail.com

2. Types of Data Collected

Data provided directly by the user

• Login credentials: email address and password, used solely for authentication purposes.
• Profile data: first name, last name, course track, assigned group, poster number (if applicable), event name and year.
• Booking data: selections for workshops, excursions, and PC reservations.

Data collected automatically

• GPS location (only upon explicit user consent): latitude and longitude, used to display the user's position on the map and calculate walking routes to event venues. Location data is not permanently stored by the app nor transmitted to our servers.

Local data

• Announcement read status: a local file is saved on the device recording which announcements the user has already viewed. This file contains no personal data.

3. Purposes of Processing

Data is processed for the following purposes:

• Authentication and access management.
• Display of the personalised conference schedule based on course track and group.
• Management of bookings (workshops, excursions, PC reservations).
• Display of event announcements and lecture notes.
• Route calculation and event map display.

4. Legal Basis for Processing

Processing is based on:

• Performance of a contract/service: necessary to provide app features to registered school participants.
• Consent: for GPS location access, explicitly requested on first use of the map screen.

5. Data Sharing with Third Parties

The app does not sell or transfer personal data to third parties for commercial purposes. Data is shared only in the following limited cases:

Service	Data Sent	Purpose
crystalerice.org API	Email, session token, booking selections	Official event backend
OpenStreetMap / Valhalla	GPS coordinates (route start and end)	Walking route calculation
CartoDB	No personal data (map tile coordinates only)	Map tile display
Apple Maps / Google Maps	Coordinates of selected location	External navigation (on user request)

6. Data Retention

• The session token is stored in memory only during the active app session. It is deleted upon logout or when the app is closed. Users must re-authenticate each time the app is launched.
• Profile and booking data are managed by the event server (crystalerice.org) according to its own retention policies.
• GPS location data is not stored by the app and is not transmitted to the event servers.

7. Permissions Requested

Permission	Reason
Internet	Required for all online app features
Precise location (GPS)	To display the user's position on the map and calculate walking routes
Approximate location	Low-precision fallback if precise location is not granted
Remote notifications (iOS)	For urgent communications from the event organisers

Users can revoke permissions at any time via device settings. Revoking location access does not affect any other app functionality.

8. Security

All data is transmitted over encrypted HTTPS connections. Passwords are never stored locally on the device. The authentication token is invalidated upon logout.

9. User Rights (GDPR)

Users in the European Union have the right to:

• Access: request a copy of the personal data being processed.
• Rectification: correct inaccurate data.
• Erasure: request the deletion of their personal data.
• Portability: receive their data in a structured, machine-readable format.
• Objection: object to processing in certain circumstances.

To exercise these rights, please contact: lodosaps@gmail.com

10. Minors

The app is intended exclusively for registered participants of the International School of Crystallography. We do not knowingly collect data from individuals under the age of 16.

11. Changes to This Policy

Any changes will be published within the app and on the crystalerice.org website. Continued use of the app after changes are published constitutes acceptance of the updated policy.