1
Data Controller & Data Protection Officer (DPO)
The designated Data Controller for all personal data collected through this symposium portal is:
ITI
Food Technology Section & Herbal Technology Division, Industrial Technology Institute (ITI)
No. 503A, Halbarawa Gardens, Thalahena, Malabe.
2
Categories of Personal Data Collected
Delegate Identification
Full academic title, legal name, institutional affiliation, department, postal country, and verified email address for credentialing and name badge issuance.
Research Manuscripts
Abstract titles, co-author lists, scientific session selections, and uploaded document files (.docx / .pdf) for blind/double-blind peer-review.
Financial Verification
Remittance reference numbers, payment transaction timestamps, and uploaded bank deposit receipt slips (processed exclusively for reconciliation by the treasury).
Preferences & Safety
Dietary selections (Vegetarian, Halal, Gluten-Free), accessibility requirements, and student accreditation credentials for verified student discounts.
3
Scientific Intellectual Property (IP) & Unpublished Research Shield
AFOB recognizes that submitted abstracts contain proprietary, novel, and preliminary scientific research. We enforce a Zero-Leakage Academic Protection Protocol:
- Strict Confidentiality: Reviewers and session chairs sign non-disclosure commitments prohibiting the distribution, citation, or commercial exploitation of unpublished manuscripts prior to formal symposium publication.
- Air-Gapped Document Serving: Uploaded manuscripts and peer-review evaluation scores are stored in protected server repositories blocked from direct public URL access and web crawlers.
- Author Ownership: Authors retain 100% intellectual property ownership of their submitted research. Only accepted abstracts are published in the official ARS 2027 Book of Abstracts with ISSN accreditation.
4
Financial Data & Bank Slip Verification Security
Because bank deposit slips contain confidential banking coordinates, depositor names, and branch stamps:
Zero Public Access: Bank remittance slips are protected by cryptographic access-control gateways. Slips can only be inspected by authorized organizing treasury officers and the individual verified delegate via their authenticated 3-day secure token. Web crawlers and unauthenticated visitors cannot view or download payment files.
5
Lawful Bases for Processing (PDPA / GDPR)
- Performance of a Contract: Processing is essential to execute your symposium registration, deliver conference materials, allocate banquet seats, and coordinate technical excursion logistics.
- Explicit Consent: Explicit user consent is gathered via interactive opt-in checkboxes during abstract submission, registration, and newsletter signups.
- Legal & Financial Compliance: Maintenance of transactional financial logs in compliance with Sri Lankan banking and tax audit statutes.
- Legitimate Academic Interest: Peer-review coordination, scholarly accreditation, and certificate verification.
6
Data Retention & Secure Disposal
We retain personal data strictly as long as necessary to fulfill the symposium purposes:
Uploaded Bank Slips
Retained for 180 days post-symposium for financial audit, then cryptographically purged.
Unpublished Drafts
Rejected or withdrawn manuscripts are permanently deleted within 60 days of the decision date.
Certificate Records
Registration codes and verification hash tokens are preserved for ongoing academic credential checks.
7
Your Data Protection Rights (PDPA & GDPR)
Under the Sri Lanka PDPA No. 9 of 2022 and EU GDPR, delegates and authors hold the following enforceable rights:
Right of Access
Request a copy of your stored personal and registration records.
Right to Rectification
Update or correct inaccuracies in your affiliation or presentation details.
Right to Erasure
Request deletion of personal data when lawful retention periods expire.
Right to Object
Withdraw consent for non-essential academic mailings at any time.
To exercise any of these rights, email our Data Protection Officer at dpo@afobslrb.lk with your registration or abstract tracking code. Requests are processed within 14 business days.
8
Technical Safeguards & Cyber Defense
- Transport Layer Security (TLS 1.3 / HTTPS): All data in transit between your browser and our server is encrypted with 256-bit modern SSL/TLS ciphers with HTTP Strict Transport Security (HSTS).
- CSRF & Rate-Limiting Protection: Cryptographic anti-CSRF token verification on all POST requests and sliding-window rate limiting on OTP and login endpoints.
- Parameterized SQL Queries: 100% prepared PDO statements eliminating SQL injection vulnerabilities.
- Audit Logging: Administrative actions, evaluations, and verifications are recorded in immutable audit logs with timestamp and operator identity.
- Strict Cookie Hardening: Session cookies configured with
HttpOnly, SameSite=Lax, and Secure flags. Zero third-party advertising cookies or cross-site tracking scripts.
