Last updated: 21.09.2026
Controller
The controller responsible for processing personal data in connection with the registration process, the surveys and related research is:
Verein zur Veranstaltung und Förderung des Willem C. Vis International Commercial Arbitration Moot
(Association for the Organisation and Promotion of the Willem C. Vis International Commercial Arbitration Moot)
c/o Knoetzl Haugeneder Netal Rechtsanwälte GmbH
Herrengasse 1
1010 Vienna
Austria
ZVR number: 377017092
Privacy contact: imprint@vismootsurvey.org
The Association has not appointed a data protection officer. Privacy-related enquiries and requests should therefore be sent to the contact address above.
Administration and hosting
The surveys are administered by Tobias A. Strecker on behalf of the Association. He processes personal data in accordance with the Association’s instructions and for the purposes described in this Privacy Policy.
The website and survey platform are hosted by:
ALL-INKL.COM – Neue Medien Münnich GmbH
Hauptstraße 68
02742 Friedersdorf
Germany
Depending on the particular survey and the technical arrangements used, other service providers may also process personal data on behalf of the Association. These may include survey-platform providers, website and email-hosting providers, cloud-storage providers, providers of technical infrastructure and data-management services, providers of security, backup and support services, and AI and automated-processing service providers.
Purpose of the registration process and surveys
The registration process allows interested persons to provide their contact details and receive invitations to participate in Vis Moot surveys.
The surveys are intended to help us understand:
- how participants in the Willem C. Vis International Commercial Arbitration Moot assess different legal questions;
- how lawyers and other legally trained persons make legal decisions;
- which factors influence legal reasoning and decision-making; and
- how the Vis Moot may be improved in the future.
The data may also be used for scientific, academic, educational and related public-interest research concerning legal decision-making, legal reasoning and related topics.
We may publish or otherwise share survey results, analyses, extracts, aggregated results and, where legally permissible, pseudonymised datasets for these purposes.
Voluntary participation
Registration and participation in the surveys are entirely voluntary. Registering, declining to participate, not responding to an invitation, discontinuing participation or withdrawing consent will not affect your participation in, or success in, the Willem C. Vis International Commercial Arbitration Moot.
Some survey questions may be optional. This will be indicated in the relevant survey where applicable.
Personal data collected
Depending on the particular survey or registration process, we may process the following categories of personal data:
- name;
- email address;
- survey responses and assessments;
- age or age range;
- country or other geographical information;
- gender, where requested;
- years of professional experience;
- information concerning participation in the Vis Moot;
- responses concerning legal reasoning, legal decision-making and legal opinions;
- technical information required to operate, secure or administer the website or survey; and
- information provided in free-text responses.
Providing your name during registration is optional. If you provide your name, it will be used to address you appropriately in emails and other communications. Your name is not required merely to register for or participate in a survey.
The surveys are not intended to request special categories of personal data within the meaning of Article 9 GDPR, such as health data, political opinions, religious beliefs or trade-union membership. Legal opinions and assessments concerning legal questions are not, by themselves, political opinions or special-category data.
Please do not include your name, email address, contact details or unnecessary sensitive information in free-text responses. If a particular survey is designed to collect special categories of personal data, we will provide additional information and obtain any consent required by law before collecting those data.
Contact list
Email addresses provided during registration and email addresses retained because a participant has separately consented to future contact form part of the Association’s contact list. The contact list therefore includes both persons who registered to receive survey invitations and survey participants whose email addresses are retained for future contact.
The contact list is separate from the survey-response dataset. It may be used to:
- send invitations to participate in Vis Moot surveys;
- send results or summaries of surveys;
- invite participants to follow-up surveys; and
- send related information concerning the surveys, legal decision-making or related research.
The name provided during registration, where applicable, may be stored with the relevant email address so that communications can be addressed appropriately.
The contact list is not used as the operational source for matching survey responses across survey rounds. In particular, email addresses retained for future contact are not used by the Association to reconnect contact-list entries with survey responses.
The contact list will be retained until consent is withdrawn, deletion is requested or the future-contact purpose no longer applies. It will be reviewed periodically, including for inactive or undeliverable addresses.
Email addresses in the survey-response dataset
Email addresses submitted as part of a survey response are initially used to link a participant’s responses across different survey rounds. This allows us to analyse responses over time and carry out longitudinal research.
The email address associated with the relevant survey responses will be pseudonymised within one year after the participant submits those answers. The dates of the survey rounds do not determine the beginning of this period.
As part of the pseudonymisation process, the email address in the survey-response dataset is replaced by a pseudonymous hash generated using a secret salt. The original email address is then deleted from the survey-response dataset.
If the participant has separately consented to future contact, the email address may continue to be retained in the separate contact list. If the participant has not given that separate consent, the email address will be deleted after pseudonymisation and will not be retained in the contact list on that basis.
The email addresses in the contact list are not used to match or reconnect the survey responses with the participant’s identity. Nevertheless, because a contact-list email address may theoretically correspond to a pseudonymous hash, the possibility of indirect re-identification cannot be completely excluded.
Hashing and pseudonymisation
The hash may remain in the internal survey dataset indefinitely. It may be used to link responses submitted in future survey rounds with responses submitted in previous rounds.
The secret salt is kept under the Association’s control. Access to it is restricted and protected by appropriate technical and organisational measures intended to prevent unauthorised access or disclosure.
The use of a salted hash does not necessarily make the survey data anonymous. It replaces the email address with a pseudonymous identifier but may still permit responses to be linked across survey rounds. Pseudonymised data may therefore remain personal data under the GDPR.
Participants may also be indirectly identifiable from the survey responses themselves. For example, a participant could theoretically be identifiable if only one person in the dataset has a particular combination of country, gender, age range, professional experience and answers.
After pseudonymisation, participants will no longer be directly identifiable from their email address within the survey-response dataset. However, indirect identification may remain possible through the pseudonymous hash, additional information, publicly available information or unusual combinations of survey characteristics and answers.
Legal basis
The storage and use of contact details provided during registration are based on your consent under Article 6(1)(a) GDPR. This consent covers the storage of your email address, and, where provided, your name, in the contact list and the sending of survey invitations and related information.
The main consent requested before participation in a survey covers the purposes described in this Privacy Policy, including:
- participation in the survey;
- linking responses across survey rounds;
- pseudonymisation by hashing email addresses;
- retention of the pseudonymised survey data;
- scientific, academic, educational and related research;
- sharing with universities, researchers, practitioners and other interested recipients; and
- possible publication or public availability of pseudonymised data or parts of the dataset.
Where a participant separately consents to the retention of an email address for future contact, that consent covers the storage and use of the email address in the contact list for survey invitations, survey results and related information.
Where a particular survey exceptionally collects special categories of personal data, processing will additionally be based on explicit consent under Article 9(2)(a) GDPR, where required.
Withdrawal of consent and deletion
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
For operational purposes, the Association will provide a period of at least two weeks after submission of the relevant answers during which a participant may request withdrawal of consent and deletion of the identifiable survey data. To process a request, you must provide sufficient information to enable us to identify the relevant registration or survey data.
You may also contact us if you have entered an incorrect email address or believe that an incorrect email address has been associated with your survey submission. Please contact imprint@vismootsurvey.org and provide sufficient information for us to identify the relevant submission. We may contact you to verify which submissions should be deleted.
Once the original email address has been deleted from the survey-response dataset and the data have been pseudonymised, the Association may no longer be able to identify which survey responses belong to a particular participant. In that situation, the Association may be unable to amend, supplement or delete an individual participant’s responses unless the participant provides additional information that makes identification possible.
The Association will not retain additional identifying information solely to enable later identification where identification is no longer necessary for the stated purposes.
Retention periods
The Association applies the following retention rules:
- Email addresses provided during registration are stored in the contact list for the purpose of sending survey invitations and related information.
- Names provided during registration may be retained with the relevant contact-list entry for the purpose of addressing communications appropriately.
- Email addresses obtained through survey responses are deleted from the survey-response dataset within one year after the participant submits the relevant answers.
- If a participant has separately consented to future contact, the relevant email address may remain in the same contact list.
- If a participant has not consented to future contact, the email address will be deleted after pseudonymisation and will not be retained in the contact list on that basis.
- The pseudonymous hash may be retained indefinitely to link responses across survey rounds and support longitudinal research.
- Pseudonymised survey responses may be retained indefinitely for scientific, academic, educational and related public-interest research purposes.
- The contact list will be reviewed periodically, including for inactive or undeliverable addresses.
- Technical records and temporary copies will be retained only for as long as necessary for the relevant operational, security or administrative purpose, unless a longer period is required by law.
Because the pseudonymous hash may remain in the dataset, the Association may continue to treat the dataset as personal data where identification remains reasonably possible.
Recipients and service providers
Survey data may be processed by the Association and persons acting on its behalf, including Tobias A. Strecker.
Depending on the particular survey and the technical arrangements used, personal data may also be processed by:
- survey-platform providers;
- website and email-hosting providers;
- cloud-storage providers;
- providers of technical infrastructure and data-management services;
- providers of security, backup and support services;
- AI and automated-processing service providers; and
- universities, academic and other research institutions, individual researchers, legal practitioners, professional organisations and other persons or organisations interested in legal decision-making and related topics.
Where a service provider processes personal data on behalf of the Association, the Association will seek to ensure that the required contractual arrangements under Article 28 GDPR are in place.
AI services
Where necessary for data management, organisation, review or analysis on behalf of the Association, AI service providers may process personal data contained in the survey materials, including:
- names;
- email addresses;
- pseudonymous hashes;
- survey responses;
- age, country, gender and professional-experience data; and
- free-text responses.
AI services will be used only for the authorised purposes described in this Privacy Policy. The Association will not intentionally submit survey data to AI service providers for model training, advertising, profiling or unrelated commercial purposes.
AI service providers will be instructed and, where applicable, contractually required not to use the data for their own unrelated purposes. The Association will implement appropriate contractual, technical and organisational safeguards where required.
International transfers
Some technical service providers, universities, researchers or other recipients may be located outside the European Economic Area. Survey data may therefore be processed or accessed internationally.
The Association will make personal data available outside the European Economic Area only where this is permitted under the GDPR and where the applicable requirements for international transfers are satisfied.
Depending on the recipient, country and form of access, safeguards may include:
- an adequacy decision of the European Commission;
- Standard Contractual Clauses;
- supplementary technical or organisational measures;
- restricted or controlled access;
- confidentiality obligations; or
- other safeguards recognised under Chapter V GDPR.
The applicable safeguards may differ depending on the recipient and the country concerned. You may request further information about the safeguards applicable to a particular transfer by contacting imprint@vismootsurvey.org.
Sharing and publication of survey data
We may share the full pseudonymised dataset, parts of it, extracts, analyses or aggregated results with universities, academic and other research institutions, individual researchers, legal practitioners, professional organisations and other persons or organisations interested in legal decision-making and related topics.
Depending on the particular dataset and the applicable legal requirements, data may be:
- shared directly with selected recipients;
- made available through controlled access;
- published in an aggregated or generalised form;
- published as selected variables or extracts; or
- made available to the public through the Association’s website.
The internal pseudonymous hash may be retained indefinitely. Depending on the particular dataset and the results of a privacy and re-identification assessment, a public version may contain:
- the same hash;
- a publication-specific identifier;
- a transformed or shortened identifier; or
- no persistent identifier.
The Association may remove, generalise, aggregate or withhold variables, free-text responses, pseudonymous identifiers or unusual combinations of data where appropriate. Public publication of the full dataset, including a hash, will take place only where compatible with applicable data-protection law and appropriate safeguards have been considered and implemented.
No form of pseudonymisation can eliminate all risk of re-identification. Identification may be possible where a participant has an unusual combination of characteristics or answers, or where the dataset is combined with other information.
Security
The Association takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure.
These measures may include:
- access restrictions;
- confidentiality obligations;
- secure storage;
- separation of email addresses from survey responses;
- protection of the secret salt;
- controlled access to the pseudonymised dataset;
- secure transmission and authentication procedures; and
- contractual safeguards for service providers.
No method of storage or transmission is completely secure. The Association cannot guarantee absolute security but will review and adapt its safeguards where appropriate.
Cookies and technical data
The website and survey platform may use technically necessary cookies, session identifiers or similar technical mechanisms required to operate, secure and administer the website and surveys.
The website does not intentionally use advertising cookies or behavioural tracking for advertising purposes. If analytics, tracking technologies or other non-essential cookies are introduced, the relevant information and, where required, a consent mechanism will be provided before those technologies are used. The website may provide a separate cookie notice where appropriate.
Technical data may include IP address, date and time of access, browser type, operating system, referring page, requested resources and information concerning successful or unsuccessful access. Such data may be processed for technical operation, security, troubleshooting and abuse prevention.
Your rights
Subject to the applicable GDPR conditions and limitations, you may have the following rights:
- access to your personal data under Article 15 GDPR;
- rectification of inaccurate personal data under Article 16 GDPR;
- erasure under Article 17 GDPR;
- restriction of processing under Article 18 GDPR;
- data portability under Article 20 GDPR, where the statutory conditions are satisfied;
- objection to processing under Article 21 GDPR, where applicable; and
- withdrawal of consent at any time where processing is based on consent.
The rights to erasure, restriction and correction may be subject to statutory exceptions, including exceptions relevant to scientific or statistical research.
If the Association no longer has sufficient information to identify you or your responses after pseudonymisation, it may be unable to fulfil a request relating to those responses unless you provide additional information enabling identification.
To exercise your rights, contact imprint@vismootsurvey.org. We may request information reasonably necessary to verify your identity and locate the relevant data. We will generally respond within one month. Where legally permitted, this period may be extended by up to two further months because of the complexity or number of requests.
Complaints
You have the right to lodge a complaint with a data-protection supervisory authority. You may contact the supervisory authority in the country of your habitual residence, place of work or alleged infringement.
In Austria, the competent supervisory authority is:
Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria
Changes to this Privacy Policy
We may update this Privacy Policy where the purposes, technical arrangements, service providers, survey design or applicable legal requirements change.
The version published on vismootsurvey.org will apply to processing carried out after the relevant update, subject to any additional information or consent required by law. Where a change materially affects the processing of data already collected, we will take appropriate steps to provide any further information required under the GDPR.