Privacy Notice
Last updated: 16 September 2026
This notice explains what Chronos Security does with your personal data when you register for and take part in CSCTF 2026. It is the page linked from the registration form.
Who we are
ASOCIAȚIA CHRONOS SECURITY, a Romanian non-governmental organisation, registered at Strada Ciprian Porumbescu Nr. 2, Bl. 14, Sc. A, Ap. 11, Camera 1, Ploiești, Prahova County, Romania, CIF 54457045, is the controller for CSCTF 2026.
Privacy contact: privacy@chronos-security.ro
General contact: contact@chronos-security.ro
What we collect
Your name, age band, affiliation, division, country and email address. Your competition activity, meaning submissions, solves, score and team. The optional consents you choose at registration, and any optional sponsor trial you ask for.
Why, and on what legal basis
We process this data to run and report on CSCTF 2026.
Operating the competition, maintaining the public scoreboard and results archive, and producing aggregate reports rests on our legitimate interest in running and documenting the event, subject to a documented balancing assessment.
Sharing your name, contact details and performance with sponsors happens only if you gave both sponsor consents at registration, under Article 6(1)(a) GDPR. Both are optional, unticked by default, offered only to participants aged 18 or over, and withdrawable at any time.
Any institution-specific matching or non-public individual report uses a separate process and legal basis, communicated to you before that processing begins. It is never inferred from the affiliation field you fill in at registration.
What is public
The public scoreboard and results archive may display your chosen public username, team name and membership, division, score, ranking, solved challenges, first bloods, awards and certificate status. These public results may also appear in event recaps and partner reports.
Your contact details and non-public account data are not included in standard partner reporting.
Who receives your data
The Chronos organising team. Our platform and hosting processors, under contract. Sponsors, only if you gave both sponsor consents. A specific product sponsor, only for a trial you asked for.
Standard partner reports contain aggregate statistics and the public competition outputs described above, not contact details and not non-public account data.
We never sell your data.
How long we keep it
Public results and certificate-verification records stay in the event archive while that archive is maintained, subject to your rights below.
Non-public account and competition-activity data is kept until 30 November 2027, then deleted or irreversibly anonymised, unless it is needed for an unresolved security incident, a dispute, or a legal obligation.
Security logs are kept for up to 90 days unless needed for an incident. Consent and disclosure records are kept for three years after the last related disclosure. Backups expire on a rolling cycle of no more than 90 days.
Your rights
You can request access, correction, deletion, restriction or portability, withdraw a consent, or object, as applicable. Write to privacy@chronos-security.ro.
You can also complain to the Romanian supervisory authority, ANSPDCP, or to the supervisory authority where you live.
Participants under 18
Participants under 18 are excluded from any sponsor shortlist, and the sponsor consents are not shown to them.
Where an optional processing activity relies on consent, participants under 16 require verifiable parent or guardian authorisation.
Changes
If this notice changes before the event, the updated version is published here and the date at the top changes with it.