What Works Summit 2027

Version of 19 August 2026

This notice describes how personal data are processed on the conference site of the What Works Climate Solutions Summit 2027 at summit2027.whatworksclimate.solutions. This site is operated with Indico, conference management software developed by CERN. It is separate from the website at whatworksclimate.solutions, which has its own privacy policy.

1. Name and Address of the Controller

The Controller within the meaning of the EU General Data Protection Regulation (“EU GDPR”) and other national data protection laws of the member states as well as other data protection regulations is:

2. Name and Address of the Data Protection Officer

3. Provision of the Website and Creation of Log Files

3.1 Description and Scope of Data Processing

With every visit to this website, our system automatically collects data and information from the computer system of the visiting computer. In particular, the following data are hereby collected:

• the visited address (URL);
• the IP address of the requesting computer;
• the date and the time of the request;
• the description of the web browser type used and/or the operating system used;
• the address (URL) of the website from which the file was requested;
• the access status (file transferred, file not found, etc.);
• the data volume transferred.

The data shall also be stored in the log files of our system. This data shall not be stored together with other personal data of the user.

This website is not operated on PIK’s own servers. It is hosted on our behalf by Elestio Limited, 66 Fitzwilliam Square, Dublin, D02 AT27, Ireland, on server infrastructure of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, in a data centre in Nuremberg, Germany. Both act as processors under Art. 28 EU GDPR and process the data exclusively on our instructions. No data are transferred to a third country.

3.2 Legal Basis and Purpose of the Processing

Legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) EU GDPR which is required for safeguarding the legitimate interests of the PIK.

The temporary storage of the IP address through our system is necessary to allow the delivery of the website to the computer of the user. For this purpose, the IP address of the user must be stored for the duration of the session.

The data are stored in log files to ensure the functionality of the website. In addition, we use the data to ensure the safety of our information technology systems, in particular to detect and investigate attacks and abuse. In this context, the data shall not be evaluated for marketing purposes.

Our legitimate interest in the processing pursuant to Art. 6 (1) (f) EU GDPR lies also in these purposes. You may request additional information on the balancing of interests under datenschutz@pik-potsdam.de.

3.3 Duration of Data Recording

The data shall be deleted as soon as they are no longer necessary for the purpose for which they are collected. Where data are collected for the provision of the website, this is the case when a session ends.

In case data are stored in log files, this is the case no later than after six months.

3.4 Requirement to Provide Data

The provision of data is neither legally nor contractually prescribed and required. The collection of data for the provision of the website and the storage of data in log files is, however, urgently necessary for the operation of the website. You will not incur any legal disadvantages from the failure to provide such data.

4. Use of Cookies

4.1 Description and Scope of Data Processing

This website uses cookies. Cookies are text files that are stored on the internet browser and/or through the internet browser on the computer system of the user. This cookie contains a distinctive sequence of characters which facilitates an unequivocal identification of the browser when the website is accessed again.

We use only cookies that are technically necessary for the operation of the site. We do not use cookies for analysis, advertising or profiling, and no cookies of third parties are set.

4.2 Cookies Used on this Website

The user data collected by technically necessary cookies shall not be used to create user profiles.

4.3 Legal Basis and Purpose of the Processing

The storage of and access to information on your terminal equipment is permitted under § 25 (2) no. 2 TDDDG without your consent, because it is strictly necessary in order to provide the service you have expressly requested. The subsequent processing of the personal data concerned is based on Art. 6 (1) (f) EU GDPR.

The purpose of the application of technically necessary cookies is to make the use of the site possible at all: signing in and submitting an abstract cannot be offered without recognising the browser after a page change.

Our legitimate interest in the processing of personal data pursuant to Art. 6 (1) (f) EU GDPR lies also in these purposes. You may request additional information on the balancing of interests under datenschutz@pik-potsdam.de.

4.4 Duration of the Storage, Possibility to Object and to Dispose

Cookies are stored on the user’s computer and are transmitted from this computer to our website. Therefore, as user you also have full control over the use of cookies. You may deactivate or limit the transfer of cookies by changing the settings of your internet browser. Cookies already stored may be deleted at any time. Where cookies are deactivated for this website, you will not be able to sign in or to submit an abstract.

5. Use of Plausible Analytics

5.1 Description and Scope of Data Processing

We use Plausible Analytics to obtain statistics on the use of this website. Plausible is operated by Plausible Insights OÜ, Västriku tn 2, Tartu, Estonia, on servers located in Germany, as our processor under Art. 28 EU GDPR. No data are transferred to a third country.

If individual pages of this website are visited, the following data will be recorded:

• the called address (URL), consisting of host name and path without query parameters;
• the address (URL) of the website from which you followed a link, if any;
• the description of the web browser type used, the operating system used and the device type;
• your country and region, derived from your IP address.

Plausible does not use cookies, local storage or any comparable technology, it does not create persistent identifiers, and it does not recognise you across other websites. Your IP address is neither stored nor logged. It is used only momentarily to derive the approximate location and to generate a one-way hash which allows repeat page views to be recognised within one day. That hash is calculated with a random value that is replaced and deleted every 24 hours, so the resulting statistics cannot be traced back to you or connected across days. The data are not disclosed to third parties and are not used for advertising or profiling.

The administration area, the sign-in, account registration and password reset pages are excluded from this measurement.

5.2 Legal Basis and Purpose of the Processing

The legal basis for the use of Plausible is Art. 6 (1) (f) EU GDPR, our legitimate interest in observing the visitor figures of this website in order to organise and improve it in a more user-friendly manner. Because Plausible neither stores information on your terminal equipment nor accesses information stored there, § 25 TDDDG does not apply and your consent is not required. Your interests are adequately accounted for by the fact that no personal data are stored.

You may request additional information on the balancing of interests under datenschutz@pik-potsdam.de. Further information on the service is available at https://plausible.io/data-policy.

5.3 Duration of Data Recording

The random value used for hashing is deleted every 24 hours. The resulting statistics contain no personal data and are retained for as long as they are useful for the evaluation of the Summit’s web presence.

5.4 Requirement to Provide Data

The provision of personal data is neither legally nor contractually prescribed and required. You will not incur any legal disadvantages from the failure to provide such data, and all functions of this website remain fully available.

6. User Accounts

6.1 Description and Scope of Data Processing

Submitting an abstract and taking part in the review process require a user account on this site. When you create an account, the following data are processed:

• your email address, which we verify by sending you a link;
• your first name and family name;
• your affiliation;
• your password, which is stored only as a cryptographic hash and is never visible to us;
• your language and time zone preference;
• optionally, further details you add to your profile yourself, such as additional email addresses, a telephone number or a postal address.

Your name and affiliation are visible to the organisers and, where you appear as an author or speaker, in the public programme of the event. To prevent automated account creation, the account form includes a challenge-response test (CAPTCHA) which runs on our own server; no third-party service is involved.

6.2 Legal Basis and Purpose of the Processing

The legal basis is Art. 6 (1) (b) EU GDPR, since the account is necessary for the performance of the participation relationship you request, and Art. 6 (1) (f) EU GDPR with regard to the security of the account and the prevention of abuse.

6.3 Duration of Data Recording

Account data are stored until you delete the account or ask us to delete it, and are erased at the latest 12 months after the end of the Summit. Where data are part of the scientific record of the event — in particular authorship of accepted contributions — they are retained beyond that point in accordance with section 7.

6.4 Requirement to Provide Data

The provision of these data is required in order to create an account. Without an account you cannot submit an abstract or review abstracts. You will not incur any other legal disadvantages from the failure to provide such data.

7. Call for Abstracts and Contributions

7.1 Description and Scope of Data Processing

If you submit an abstract, we process the information you enter in the submission form. This comprises the following.

The submission itself

• the title and the content of the abstract;
• the names, affiliations and email addresses of all authors you name, and which of them is the presenting author;
• the contribution type you propose — poster, talk or session;
• the focus areas and methods to which you submit;
• where your abstract belongs to a proposed session, the title of that session or, for a session proposal, the speakers and talk titles you list;
• any comments you add for the organisers.

Information about your presentation and your participation

• whether you would prefer to present in a language other than English, and which language;
• whether you or your co-presenters would require financial support in order to attend if your submission is selected. This information is indicative. It does not influence the review and selection of submissions, nor your eligibility for support.

Voluntary information about yourself

The form asks how you would describe yourself in terms of gender, your country of nationality, your current country of residence, your affiliation and your career stage. These questions are optional and each of them can be left unanswered; the question on gender also offers the answer “I prefer not to say”. We ask for this information so that we can seek submissions from a wide variety of backgrounds. It is used internally for that purpose only. It is not published, it is not shown at the conference, and it is not passed to third parties. Please note that everyone you name as an author can see it, as described in section 7.2.

Correspondence about the submission

We also process the correspondence relating to your submission, including the judgements and comments of the reviewers.

If you name co-authors, you provide us with their personal data. Please make sure that they are aware of this notice.

7.2 Who Can See Your Submission

Your submission is visible to the organisers, to the conveners of the focus area or method concerned and to the reviewers appointed for it. Reviewers see the submission in order to assess it; whether they see the authors’ names depends on the review settings of the event. The voluntary information about yourself described above is not part of what reviewers assess.

Everyone whom the submitting person names as an author or co-author can see the submission in full, including every answer given in the submission form. If you name co-authors, please bear this in mind before entering the voluntary information about yourself described in section 7.1.

For the final stage of the review, submissions are exported from this website and processed on servers operated on behalf of the Summit organisers in Germany. No data are transferred to a third country.

If your abstract is accepted, it becomes a contribution to the programme, and title, authors, affiliations and abstract text are published on the public pages of this website and may appear in the book of abstracts and in the conference programme.

When you submit, your name and email address are transferred to Brevo, the service we use to send updates about the review process and about the Summit. Brevo is operated by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, acting as our processor under Art. 28 EU GDPR.

7.3 Legal Basis and Purpose of the Processing

The legal basis for processing your submission and conducting the review is Art. 6 (1) (b) EU GDPR, as it is necessary for the performance of the participation relationship you request.

The storage of your submission, its export for the final review, its use in the context of the Summit and the transfer of your name and email address to Brevo take place on the basis of the declaration of consent that forms part of the submission form, Art. 6 (1) (a) EU GDPR. The voluntary information about yourself is likewise processed on the basis of your consent, Art. 6 (1) (a) EU GDPR, and insofar as any of it concerns a special category of personal data within the meaning of Art. 9 EU GDPR, on the basis of your explicit consent, Art. 9 (2) (a) EU GDPR.

You may withdraw a consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to that point. To withdraw it, contact the addresses given in section 1 or section 2; every email we send about the Summit also contains an unsubscribe link.

The publication of accepted contributions is based on Art. 6 (1) (f) EU GDPR; our legitimate interest, and that of the scientific community, lies in documenting and communicating the scientific programme of the Summit.

7.4 Duration of Data Recording

Submissions that are not accepted, and the associated review correspondence, are erased 12 months after the end of the Summit. Accepted contributions remain published as part of the permanent record of the conference. The voluntary information about yourself is erased once the composition of the programme has been evaluated, at the latest 12 months after the end of the Summit.

7.5 Requirement to Provide Data

The title, content, authors, contribution type, focus areas and methods, the answers on presentation language and on financial support, and the declaration of consent are required in order to submit an abstract. If you do not provide them, a submission is not possible. All remaining questions are voluntary, and no disadvantage arises for you if you leave them unanswered.

8. Email Communication

8.1 Description and Scope of Data Processing

This website sends you emails in connection with your account and your submission — for example to verify your address, to reset your password, or to notify you of the outcome of the review.

Outgoing email is sent through the mail servers of Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany, acting as our processor under Art. 28 EU GDPR. Updates about the review process and about the Summit as a whole are sent through Brevo, as described in section 7.2. If you reply to us by email, the data contained in your email including your address will be processed in order to deal with your enquiry.

8.2 Legal Basis and Purpose of the Processing

The legal basis is Art. 6 (1) (b) EU GDPR for messages that are necessary for your account or your submission, Art. 6 (1) (a) EU GDPR for the updates you consented to when submitting, and Art. 6 (1) (f) EU GDPR for correspondence arising from an enquiry you send us.

8.3 Duration of Data Recording

Email correspondence is erased as soon as it is no longer required to deal with the matter concerned, at the latest 12 months after the end of the Summit, unless statutory retention obligations apply.

8.4 Requirement to Provide Data

A valid email address is required for an account and for a submission, since we must be able to contact you about your submission.

9. Rights of the Data Subject

If your personal data are processed, then you are a data subject within the meaning of the EU GDPR and you shall have the following rights vis-à-vis the Controller. To exercise them, contact datenschutzanfrage@pik-potsdam.de or the data protection officer named in section 2.

9.1 Right of Access (Art. 15 EU GDPR)

You have the right to obtain confirmation as to whether personal data concerning you are being processed and, if so, to be informed of those data and of the purposes of the processing, the categories of data, the recipients, the envisaged storage period, your rights of rectification, erasure, restriction and objection, the source of the data, and the existence of automated decision-making. Where personal data are transferred to a third country, you have the right to be informed of the appropriate safeguards pursuant to Art. 46 EU GDPR.

9.2 Right to Rectification (Art. 16 EU GDPR)

You have the right to obtain the rectification of inaccurate personal data concerning you and to have incomplete data completed. Most of the data held in your account can be corrected by you directly in your profile.

9.3 Right to Restriction of Processing (Art. 18 EU GDPR)

You have the right to obtain the restriction of processing where you contest the accuracy of the data, where the processing is unlawful and you oppose erasure, where we no longer need the data but you require them for legal claims, or where you have objected under Art. 21 (1) EU GDPR pending verification.

9.4 Right to Erasure (Art. 17 EU GDPR)

You have the right to obtain the erasure of personal data concerning you where the data are no longer necessary for the purposes for which they were collected, where you withdraw a consent on which the processing was based, where you object under Art. 21 EU GDPR and no overriding legitimate grounds exist, or where the data have been processed unlawfully. The right does not apply insofar as processing is necessary for compliance with a legal obligation, for the establishment, exercise or defence of legal claims, or for archiving, scientific or historical research purposes in accordance with Art. 89 (1) EU GDPR.

9.5 Right to Data Portability (Art. 20 EU GDPR)

Where the processing is based on consent or on a contract and is carried out by automated means, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format and to transmit them to another controller.

9.6 Right to Object (Art. 21 EU GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) EU GDPR. We shall then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

9.7 Right to Withdraw Consent (Art. 7 (3) EU GDPR)

Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent up to the withdrawal remains unaffected.

9.8 Automated Individual Decision-Making (Art. 22 EU GDPR)

No automated decision-making, including profiling, takes place on this website. Decisions on the acceptance of abstracts are taken by people.

9.9 Right to Lodge a Complaint with a Supervisory Authority (Art. 77 EU GDPR)

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the EU GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 EU GDPR.