Privacy Notice
This is the plain-language privacy notice required by the award operating rules (clause 12.4). It explains what personal data the award collects, why, and how it is handled, and it names the data controller. It covers both the interest list (open from July 2026) and the nomination flow (open when nominations open in mid-August 2026). It is linked before any personal data is collected.
1. Who is responsible for your data
The AIPM AI Project of the Year Award is a non-commercial, community-run recognition initiative. It is free to enter and free to win (operating rules clause 1.3.2).
- Data controller of record: Ricardo Vargas, the initiative's operator, resident in Portugal (European Union). The controller decides why and how your personal data is processed and is the accountable party for it, and other named founders of the initiative do not determine the purposes or means of processing your personal data. If a legal entity is established to run the initiative before launch, that entity is substituted here as the controller.
- Build and test environment: while the platform is being built and validated, a reference version runs in a separate environment operated by Vitor Rodovalho. That environment holds no real personal data. Your personal data is only ever processed in the live award run by the controller, and data is never copied from the live award into the build environment (only the software structure moves, and only toward production).
- Contact: for any question about this notice or your personal data, or to exercise the rights in Section 8, contact the controller at info@pmairevolution.com.
Because the award is global and the controller is established in the European Union, this notice is written to a General Data Protection Regulation (GDPR) standard. If you are in a jurisdiction with its own data-protection rules, those rules may also give you rights; the controller aims to honor the broadest reasonable protection.
2. What this notice covers
This one notice covers two collection points (operating rules clause 12.4):
- The interest list (open from July 2026). A short form for people who want to hear when nominations open, and who may want to nominate, judge, or help spread the word.
- The nomination flow (open from mid-August 2026). The full entry process: the nomination form, the evidence pack, the short video, and the declarations and consents an entry requires.
3. What personal data we collect
3.1 The interest list
When you join the interest list, we collect only what the list needs: your full name; your email address; your country; your organization (optional); your role (optional); how you want to take part (nominate a project, be considered as a judge, help spread the word, or just be kept posted); and any optional message you add. We record the date and time you joined, the version of this notice shown to you, and that you agreed your details are used only for award communications. We do not require an account.
3.2 The nomination flow (from mid-August 2026)
When you submit an entry, we collect the personal data needed to run and judge it: the Lead Nominator's name, email, role or authority, and organization; the region proposed for the entry; the structured people-and-organization roster behind the entry, limited to what conflict-of-interest checks need; and the declarations and consents an entry requires (a signed authorization to submit, a truthfulness declaration, a case-study publication willingness indication (the binding publication consent is sought later, from finalists and winners), consent to forward a promoted entry to the global jury, an AI-use disclosure, and a warrant that any third-party personal data was lawfully included and unnecessary personal data redacted). Each consent is recorded with its timestamp and the exact consent text shown.
3.3 Personal data about other people
An entry and its evidence can contain personal data about people other than the entrant. The Lead Nominator is required to have a lawful basis to include any such data and to redact or anonymize personal data that is not necessary for judging (operating rules clause 12.5). See Section 9.
3.4 Technical data
The public forms use Cloudflare Turnstile to tell humans from bots and to protect the forms from abuse. This may involve Cloudflare processing limited technical signals from your browser for that security purpose. We do not use the interest form for advertising or behavioral tracking. These security signals rely on the controller's legitimate interest in protecting the forms from abuse (Article 6(1)(f)). The forms set no advertising or analytics cookies, so no cookie-consent banner is shown; any cookie used is strictly necessary for security or to keep your session.
3.5 Is providing this data required?
Joining the interest list is voluntary, and you can ask us to remove you at any time. For the nomination flow, the fields and consents listed above are necessary to submit and judge an entry, except case-study publication, which is not required to enter and is not an eligibility condition: publication consent is sought from finalists and winners before their case study is published.
Taking part in the award is never conditioned on joining the interest list or on any marketing consent. You can withdraw interest-list consent in one click from any email we send; withdrawing it stops further award communications but does not by itself withdraw a submitted entry, which we process to run the award.
4. Why we use your data, and our lawful basis
| What | Why | Lawful basis (GDPR Article 6) |
|---|---|---|
| Interest list | To tell you when nominations open, send award communications matched to how you want to take part, and seed the call for judges from the judge segment | Your consent (Article 6(1)(a)), which you can withdraw at any time |
| Nomination flow | To receive, screen, judge, and administer your entry, and to communicate with you about it | The controller's legitimate interest in running a fair, well-administered community award, which you reasonably expect when you submit (Article 6(1)(f)). Publishing a finalist or winner case study is done only with that finalist's or winner's consent obtained before publication; forwarding a promoted entry to the global jury is a term of taking part; you may withhold specified confidential details and object at any time. |
| Integrity and security | To run conflict-of-interest checks, keep an audit trail, and protect the forms from abuse | The controller's legitimate interest in a fair, secure award (Article 6(1)(f)) |
Entry is free and voluntary; we do not treat it as a contract.
We do not sell your personal data. We do not add you to an unrelated newsletter or reuse your details for anything outside the award without asking you separately.
5. Who can see your data
- The organizing team (a named, limited group) can see entry and interest-list data to run the award. Organizers are bound by the same conflict-of-interest standard as jurors for any act that affects a result (clause 13.7).
- Jurors see entry content in order to score it, not the entrant's private contact details beyond what the entry legitimately contains. Entrants never see juror identities. Jurors are bound by confidentiality undertakings (clause 12.3).
- Our technology providers process data on our behalf under contract. The platform runs on Cloudflare (hosting, database, file storage, and the anti-abuse check). Email is sent through a transactional email provider on a dedicated sending domain. These providers act as processors and may not use your data for their own purposes.
- No public exposure of raw data. Any public results are names and projects only, with no scores (the platform's public-results design), and only for finalists and winners who consented to case-study publication, with agreed confidential details withheld (clauses 12.1, 10.6).
6. Where your data is processed, and international transfers
The controller engages its technology providers, including Cloudflare, under their standard data processing terms, which include the European Commission's standard contractual clauses where a transfer outside the European Union takes place. Where available, European Union data residency is enabled. You can obtain a copy of the safeguards the controller relies on, or find out where they are available, by contacting the controller at info@pmairevolution.com.
7. How long we keep your data
- Interest list: kept for edition 1 and its communications, then deleted or anonymized within 12 months of the edition closing, or earlier if you withdraw consent or ask us to remove you.
- Nomination data and evidence: kept through the edition and the defined post-edition window for feedback reports, recognition issuance, and case-study publication (December 2026 into January 2027). We then delete or anonymize it no later than 12 months after the edition closes, or earlier on a valid erasure request, unless your case-study consent covers a specific published item or we must keep it to meet a legal obligation.
- Audit trail: a security and integrity log is kept longer than the operational data it describes, but it holds only the record of what happened (who did what, when), not your substantive personal data, and personal identifiers in it are removed or rendered unreadable on a verified erasure.
8. Your rights
Subject to the applicable law, you have the right to: ask what personal data we hold about you and get a copy (access); correct data that is wrong or incomplete (rectification); ask us to delete your data (erasure), subject to any lawful retention; ask us to restrict or object to certain processing; receive the data you gave us in a portable form (portability); withdraw any consent at any time, without affecting processing done before you withdrew it; and lodge a complaint with a data-protection supervisory authority.
To exercise any of these, contact the controller at info@pmairevolution.com. Every email we send you also carries a one-click way to unsubscribe and to be removed from the interest list. We verify that a request comes from you (through the email you gave us, or your signed-in identity) before we act on it.
You may lodge a complaint with your local data-protection supervisory authority. In Portugal, where the controller is established, this is the Comissao Nacional de Protecao de Dados (CNPD). This does not remove your right to complain to the authority in your own country.
9. If your entry contains other people's data
If an entry or its evidence names or describes other people (for example team members, a client contact, or customers in an outcomes report), the Lead Nominator warrants that they have a lawful basis to include that personal data, and must redact or anonymize any personal data that is not necessary for judging. Redaction of unnecessary personal data is a required step, not an optional one (clause 12.5). The organizers spot-check for unredacted third-party personal data during screening and may hold an entry and require redaction before it proceeds.
Where an entry lawfully includes personal data about other people, the controller processes it only to judge and administer the entry, on the basis of its legitimate interest in a fair award (Article 6(1)(f)), and keeps it to the minimum needed. Because the controller usually has no direct relationship with, or contact details for, these individuals, giving each of them individual notice would involve disproportionate effort (Article 14(5)(b)); this published notice, together with the required redaction, serves that transparency function. The authorizer, whom the entry does identify, receives a direct notice.
Entries must not include special-category personal data about other people, for example data revealing health, racial or ethnic origin, religion, trade-union membership, or sexual orientation. Any such data that is submitted is redacted, or the entry is held until it is removed.
If you believe your personal data was included in an entry without a basis, you can object and ask us to remove it: contact the controller at info@pmairevolution.com and we will act on it.
10. Changes to this notice
We may update this notice as the award progresses (for example when the nomination flow opens). We record a version number and date at the top. If a change is significant, we make it visible at the point of collection. The version shown to you when you submitted is recorded with your entry or interest-list record.
Back to the interest list