Privacy Policy

We collect only the information required to assess an application, run the conference safely, and communicate with participants.

• Identity and contact details: name, date of birth, gender (optional), email, phone, country, city and nationality.
• Academic details: institution, grade or year of study, course, and prior Model UN experience.
• Application content: committee and country preferences, motivation statement and areas of interest.
• Emergency contact details, provided so we can reach a responsible adult during the conference.
• Documents you upload, such as a photograph or institutional identification.
• Technical data: IP address and browser user agent, recorded with security-relevant events.

Application data is processed to evaluate and administer your participation — a step you request when you submit an application.

Emergency contact and accessibility information is processed to protect the vital interests of delegates during the conference.

Security logs are processed on the basis of our legitimate interest in protecting the platform and the people whose data it holds.

Access inside the organisation is restricted by a per-user permission matrix. A staff member can only see the modules they have been explicitly granted, and every administrative action against an application is recorded in an audit log.

We do not sell personal data, and we do not share it with sponsors or partners for marketing purposes.

• The registration team, to review your application.
• Committee directors, to assign committees and countries.
• The finance team, where a payment record exists.
• Service providers who host our database, send our email and store our files, bound by contract.

Application records are retained for the duration of the conference cycle and for a period afterwards to support certificate verification, alumni records and statutory reporting. Uploaded documents are deleted once they are no longer required for the purpose they were collected for.

You may request earlier deletion at any time, subject to any records we are legally required to retain.

Passwords are hashed with bcrypt and never stored in readable form. Sessions are carried in HTTP-only cookies backed by revocable server-side records. Uploaded files are validated by content, not by filename, and private documents are served only through an authorisation-checked route.

Administrative credentials are supplied through deployment secrets and are never present in our source code.

You may request access to the personal data we hold about you, ask for it to be corrected, request its deletion, object to processing, or ask for a copy in portable form.

To exercise any of these rights, write to youthdiplomacyforum14@gmail.com. We respond within thirty days.

Applicants under 18 must provide the name of a parent or guardian and confirm that guardian consent has been given. We collect no more information from minors than from any other delegate, and guardian details are used solely for consent and emergency contact.

If we change how we handle personal data, we will update this page and, where the change is material, notify affected participants by email.