PICCASO Awards – Data Protection Notice

Each year, PICCASO runs the PICCASO Awards for Europe.

We are a data controller for the purposes of the UK GDPR and this notice explains how we collect and use personal data specifically in
relation to the awards programme.

Our contact details

Name: PICCASO Limited

Registered Address: Wright Vigor Chartered Accountants, 15 Newland, Lincoln, Lincolnshire, LN1 1XG

E-mail: Hello@PICCASO.org

Who are the Awards for?

The PICCASO Awards aim to celebrate professionals who are making a difference in this industry.

Nominees and participants include:

• Data Protection Officers (DPOs)

• Chief Privacy Officers (CPOs)

• Chief Information Security Officers (CISOs)

• General Counsels and legal professionals

• Compliance and risk leaders

• Regulators and strategists

• Students and emerging professionals

• Innovators in AI, governance, ethics, and digital responsibility

If you are shaping how data is used responsibly across people, processes, technology, and society - the PICCASO Awards are for you.

Personal Information We Collect

We may collect and process the following personal data for awards-related purposes:

• Name

• Company Name

• Job title

• Headshot

• Email address

• Telephone Number

• Nomination details

• Event attendance details

• Communication preferences (email, web, social)

• Marketing communications (newsletters, updates, invitations to awards events)

• Media and press references related to awards

• Sponsor and partner engagement

How We Collect Personal Data

• Nomination process (directly or by someone else)

• Registration to attend an awards event

• Engagement with awards-related communications

We may also receive personal data from:

• Event registration platforms (e.g. Typeform, TicketTailor)

• Sponsors and partners who share registration details for awards-related events

• Publicly available sources (e.g. LinkedIn, professional directories)[

How We Use Personal Data

• Administration of awards nominations and attendance

• Updates about PICCASO news and events

Who We May Share Personal Data With

• We work in partnership with GRC World Forum to deliver theawards and have a contract in place for these purposes. They are responsible
for administering and managing all personal data relating to the awards on our behalf and act as a data processor on our behalf.

• Marketing and IT service providers (e.g. Mailchimp, Eventbrite)

• Professional advisers (e.g. legal, accouting)

We do not share your data for third-party marketing without your consent.

Lawful Bases for Processing

Under UK GDPR, we rely on:

• Consent and legitimate interests – for marketing (Consentfor third parties and legitimate interests for PICCASO)

• Contractual obligation – for awards registration andparticipation

• Legitimate interests – for administration of the awardsevents and associated communications

Data Retention

• Awards nominations and related data – retained for up to 60months after the awards cycle

• Award winners and judges – retained permanently as apublic record on the PICCASO website.

• Marketing and consent records – retained until youwithdraw consent or after 5 years of inactivity

Your Data Protection Rights

Under data protection law, you have the following rights in relation to your personal information:

• Right of access – you can request copies of the personal information we hold about you.
• Right to rectification – you can ask us to correct any information you believe is inaccurate, or to complete information you believe is incomplete.
• Right to erasure – you can request that we erase your personal information in certain circumstances.
• Right to restrict processing – you can ask us to restrict the processing of your personal information in certain circumstances.
• Right to object to processing – you can object to the processing of your personal information in certain circumstances, including where we rely on legitimate interests.
• Right to data portability – you can ask us to transfer the information you gave us to another organisation, or to you, in certain circumstances.
• Right to withdraw consent – where we rely on your consent (for example, to send you marketing communications or share your details with sponsors), you can withdraw this consent at any time.

You are not required to pay any fee for exercising your rights. We will respond to your request within one month.

If you would like to exercise any of these rights, please contact us at:

Email: Privacy@PICCASO.org

We may update this notice periodically to reflect changes in our practices or legal obligations. The most recent version will always be published on our website.

How to Complain

If you have any concerns about our use of your personal information, we encourage you to contact us first so that we can try to resolve the matter with you.

You can contact us at:

Email: Privacy@PICCASO.org

Write to: PICCASO, Wright Vigor Chartered Accountants, 15 Newland, Lincoln, Lincolnshire, LN1 1XG

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you can also complain to the UK’s independent regulator, the Information Commissioner’s Office (ICO):

Address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Website: www.ico.org.uk