NATOData Protection

SHAPE Data Protection Notice

Online Registration to Events and Conferences – Partnerships Directorate · December 2025

As per ACO Data Protection Directive 015-026, SHAPE (the 'Data Controller') is ultimately responsible for how information about these individuals is processed. Hence, this notice explains what personal information we in SHAPE collect about you, why we process it, and what we do with it during events and conferences organised by Partnerships Directorate, in other words:

1. How is your Personal Data being collected?

1-1. We collect personal information about you:

  • • when you register for the conference on our dedicated webpage, and
  • • during the conference, when you use our event app.

1-2. Once SHAPE has received your information, we will ensure that it is treated with the highest integrity throughout the process.

2. What type of Personal Data is processed about you?

2-1. The personal information we collect and process about you is strictly limited to what is directly relevant and necessary to fulfil our purposes. It may include:

  • a. Identifying: first name, last name, nationality, passport nr, photo, event enrolments.
  • b. Contact: professional or private email address and phone number.
  • c. Professional: organisation, rank and function.
  • d. Location: country of residency and travel booking details.
  • e. Technical: password, device information, application ID (e.g. Skype…), application usage, geographic location.
  • f. Content: presentation material, chat, video, in-app interactions.
  • g. Transactional: bank account, credit or debit card details (e.g. number, holder name, expiry date), payment method and reference.

3. Why is your Personal Data being processed?

3-1. We process your personal data to:

  • a. register you to the event we organize
  • b. further manage your access to areas within the premises, together with transport, accommodation or catering
  • c. allow you to access our app through your device, further authenticate you, thereby enhancing the event experience by facilitating engagement, exchange of content, and enable various related features
  • d. process payment of attendance fees

3-2. We may also use and share aggregated data derived from your personal data but as a general rule, your personal data will not be used for any other purpose than that for which they were provided to us.

3-3. Rest assured that your information will be treated lawfully and confidentially at all times.

4. Will SHAPE share your Personal Data with anyone else?

4-1. When we need to share your personal data, it is done sensitively and always respecting the 'need-to-know' principle. As a general rule, your personal data will only be accessible insofar as it is necessary to fulfil the purpose for which it was collected.

4-2. The information you are willing to share may be passed on to appropriate and trained specialist teams within SHAPE, in particular designated staff in the Partnerships Directorate in the unit authorised to proceed with payment.

4-3. Outside of SHAPE, besides NCU Global that provides the system designed to manage highly sensitive information, your information will not be shared with any third parties.

4-4. We do comprehensive checks on any contractors before we work with them. We always put a contract in place that sets out how they manage personal data they collect or have access to.

5. How is your Personal Data being kept and for how long?

5-1. We use appropriate technical and organizational measures and precautions in order to protect your personal data and to prevent any loss, misuse or alteration. Your information will be stored securely within NATO territory.

5-2. Additionally, we only retain your information for as long as it is necessary in connection with the purposes defined above or to comply with our obligations.

  • a. All event data are disposed automatically by the Cisco Webex application within 6 months of completion of the event
  • b. payment data are deleted right after the payment is successfully collected
  • c. registration data (full name, function, organisation and e-mail address) is kept for a maximum period of 2 years after the event's completion, unless you object
  • d. event material (e.g. presentations, photos and video recording) is kept for a maximum period of 10 years

6. What rights do you have?

6-1. If you have further questions concerning your privacy, if you wish to access the information we hold about you, delete, update, and – depending on the rights of others – restrict or refuse the use of your information please contact the ACO Data Protection Office at:

aco.dpo@shape.nato.int

or at this address:

Data Protection Office
Rue Grande, 7010 SHAPE, Belgium