​1. Who we are

IntLaw Foundation (“IntLaw Foundation”, “we”, “us” or “our”) is responsible for the organisation and administration of the IntLaw Investment Arbitration Moot (the “IntLaw Moot”) and related educational activities.

​

For the purposes of applicable data protection law, IntLaw Foundation is the controller of the personal data described in this Privacy Policy, unless we expressly state otherwise.​​

​

• IntLaw Foundation

• Lytchett House

• Unit 13 Freeland Park

• Wareham Road

• Lytchett Matravers

• Poole BH16 6FA

• United Kingdom

• Email: directorate@intlawmoot.org

• Website: www.intlawmoot.org

​

This Privacy Policy explains how and why we collect, use, disclose, store and otherwise process personal data in connection with the IntLaw Moot and our related activities.

 

2. Scope of this Privacy Policy

​

This Privacy Policy applies to personal data we process in connection with:

​

• participation in, organisation of and administration of the IntLaw Moot;

• students, coaches, university representatives and other members of participating teams;

• arbitrators and prospective arbitrators;

• Ambassadors, Chief Ambassadors, Board members, speakers, experts and other contributors;

• universities, academic institutions and institutional contacts;

• sponsors, supporters, partner organisations, venues and service providers;

• applications, registrations and account creation;

• memoranda, competition submissions and other competition materials;

• hearings, events, educational activities and related logistics;

• the IntLaw Moot Portal and website;

• communications with participants and other stakeholders;

• invoicing, registration fees, payments, refunds and financial administration;

• newsletters, invitations and other communications where permitted by law;

• persons who contact us or interact with our websites or social-media channels; and

• other persons whose personal data we reasonably need to process in connection with the activities of IntLaw Foundation.

 

This Policy applies where IntLaw Foundation acts as a controller. Where another organisation independently determines how and why it processes personal data, that organisation is responsible for its own processing.

 

3. Personal data we may collect

 

The personal data we process depends on how you interact with us.

 

A. Identification and contact information

 

We may process:

​

• name;

• title;

• postal address;

• email address;

• telephone number;

• nationality or country of residence where relevant to competition administration;

• university, employer or organisational affiliation; and

• other contact information you provide to us.

 

B. Participant and competition information

 

We may process:

​

• university and team information;

• student or coach status;

• team role;

• participant number or identifier;

• competition registration information;

• memoranda and other competition submissions;

• hearing assignments and schedules;

• scores, rankings and competition results where applicable;

• awards and distinctions;

• attendance information;

• photographs or recordings where applicable; and

• correspondence concerning participation in the Moot.

 

C. Account, portal and technical information

 

Where you use our website or Portal, we may process:

​

• username or account identifier;

• login information;

• IP address;

• device and browser information;

• date and time of access;

• technical logs;

• Portal activity;

• security information; and

• cookie or similar technology information.

​

We do not request or store your payment-card credentials where payment is handled directly by an independent payment service provider.

​

D. Financial and transaction information

​

We may process:

​

• billing details;

• invoice information;

• registration-fee information;

• payment status;

• transaction references;

• refund information;

• amounts paid or outstanding;

• payer details; and

• correspondence concerning payments.

​

Pending the opening of a bank account in IntLaw Foundation's own name, IntLaw LLP may receive limited payment-related personal data when acting as IntLaw Foundation's temporary collection agent and custodian for Foundation funds.

​

E. Professional and academic information

​

For certain roles or activities, we may process:

​

• CV or résumé;

• professional biography;

• job title;

• employer;

• academic institution;

• qualifications;

• professional experience;

• areas of expertise;

• language abilities;

• application information;

• interview or assessment notes; and

• publicly available professional information.

​

F. Communications

​

We may process information contained in:

​

• emails;

• forms;

• enquiries;

• support requests;

• messages;

• feedback;

• complaints; and

• other correspondence with us.

​

G. Preferences and marketing information

​

We may process:

​

• communication preferences;

• subscriptions;

• records of consent;

• opt-out or objection requests; and

• records necessary to ensure that we respect communication preferences.

​

H. Special-category personal data

​

We do not routinely seek special-category personal data.

​

However, limited health or similar information may be processed where reasonably necessary, for example to accommodate:

​

• accessibility requirements;

• serious allergies;

• dietary requirements that disclose health or religious information;

• medical or emergency requirements; or

• other reasonable adjustments.

​

Where we request special-category personal data for these purposes, we will normally rely on your explicit consent in addition to an appropriate lawful basis under Article 6.

​

In a genuine emergency, we may process health information where necessary to protect your or another person's vital interests and where the applicable legal requirements are satisfied.

​

Please do not provide special-category information unless it is reasonably necessary for the relevant purpose.

​

I. Criminal-offence and compliance information

​

We do not routinely process criminal-offence data.

​

Where particular circumstances make compliance or due-diligence checks necessary, we will process such information only where permitted by applicable law and subject to appropriate safeguards.

 

4. How we obtain personal data

 

We may obtain personal data:

 

Directly from you

 

For example when you:

​

• register for the Moot;

• create or use a Portal account;

• complete a form;

• submit competition materials;

• apply to become an arbitrator, Ambassador, Board member or contributor;

• register for an event;

• make or arrange a payment;

• communicate with us;

• subscribe to communications;

• interact with us through social media; or

• otherwise provide information to us.

​

From universities and organisations

​

A university, team representative, employer, institution or other organisation may provide information about you where this is reasonably necessary to register a team, nominate participants, arrange a hearing, facilitate an event or otherwise interact with the Moot.

​

From other participants and contributors

​

For example, team representatives may provide the names and contact details of team members, or Board members may recommend potential arbitrators or contributors.

​

From publicly available sources

​

Where appropriate, we may obtain limited professional information from:

​

• institutional websites;

• law-firm or chambers websites;

• professional directories;

• academic websites;

• professional networking platforms; and

• other legitimate publicly available sources.

​

We may use such information, for example, to identify and invite potential arbitrators, academic contacts, institutional supporters or other persons relevant to the educational activities of the Moot.

​

Where applicable law requires us to provide additional information because personal data was obtained indirectly, we will do so within the legally required period unless an exemption applies.

​

5. Why we use personal data and our lawful bases

​

We process personal data only where we have a lawful basis. Depending on the circumstances, the following purposes and lawful bases may apply.

​

A. Registration and participation in the Moot

​

We process information to:

​

• register universities and teams;

• create participant accounts;

• administer participation;

• verify eligibility;

• organise hearings;

• communicate schedules and procedural information;

• receive memoranda and submissions;

• administer competition results; and

• provide related services.

​

Lawful basis: performance of a contract or steps taken at your request before entering into a contract, where applicable; and/or our legitimate interests in organising and administering the Moot and providing a professionally managed educational competition.

​

B. Administration of arbitrators, Ambassadors, Boards and contributors

​

We process information to:

​

• receive and assess applications;

• appoint or invite participants;

• allocate roles;

• organise availability and assignments;

• communicate about activities; and

• administer the relevant programme or relationship.

​

Lawful basis: our legitimate interests in organising the Moot, securing qualified contributors and administering our educational activities; and, where applicable, steps taken before or performance of an agreement.

​

C. Communications and enquiries

​

We use personal data to:

​

• respond to enquiries;

• provide information;

• correspond with participants and stakeholders;

• provide support; and

• manage our relationships.

​

Lawful basis: our legitimate interests in communicating with persons interested in or involved with our activities; and/or steps taken at your request before entering into an agreement.

​

D. Payments, invoices and financial administration

​

We process personal data to:

​

• issue invoices;

• receive and reconcile registration fees;

• process refunds;

• maintain payment records;

• perform accounting and financial administration; and

• comply with legal and financial record-keeping requirements.

​

Lawful basis: performance of a contract; compliance with legal obligations; and our legitimate interests in administering and safeguarding IntLaw Foundation's finances.

​

E. Operational communications

​

We may send communications concerning:

​

• registration;

• Portal access;

• deadlines;

• hearings;

• procedural developments;

• competition documents;

• security;

• technical issues;

• events; and

• other matters directly connected with participation or involvement.

​

These are operational communications rather than direct marketing.

​

Lawful basis: performance of a contract where applicable and/or our legitimate interests in properly administering the Moot.

​

F. Outreach and invitations

​

We may contact universities, academics, practitioners, arbitrators, institutions and other professional stakeholders where we reasonably believe that the Moot or a related educational initiative may be relevant to them.

​

Lawful basis: our legitimate interests in promoting and developing the educational activities of IntLaw Foundation, subject to applicable electronic-marketing rules and the rights and reasonable expectations of recipients.

​

G. Newsletters and direct marketing

​

Where permitted by law, we may send information about:

​

• future editions of the Moot;

• educational events;

• announcements;

• publications;

• Foundation activities; and

• related opportunities.

​

We will rely on consent where consent is legally required. Where applicable law permits another basis, including an applicable direct-marketing exception, we may rely on that basis.

​

Every electronic marketing communication will provide an appropriate means of opting out.

​

You may object to direct marketing at any time..

​

H. Website and Portal operation

​

We process technical data where necessary to:

​

• provide website and Portal functionality;

• maintain security;

• authenticate users;

• diagnose technical problems;

• prevent misuse; and

• understand and improve our services.

​

Lawful basis: our legitimate interests in operating secure and effective online services and, where applicable, consent for technologies for which consent is required.

​

I. Safety, security and prevention of misuse

​

We may process information to:

​

• protect participants;

• maintain information security;

• prevent fraud or misuse;

• investigate suspected breaches of competition rules;

• protect our systems; and

• protect the rights of IntLaw Foundation or third parties.

​

Lawful basis: our legitimate interests in protecting our activities, systems, participants and legal rights; and compliance with legal obligations where applicable.

​

J. Legal and regulatory obligations

​

We may process personal data where necessary to:

​

• comply with applicable law;

• maintain statutory or accounting records;

• respond to competent public authorities;

• comply with court orders or other lawful requests; and

• meet governance and regulatory obligations.

​

Lawful basis: compliance with a legal obligation.

​

K. Legal claims

​

We may process and retain information where reasonably necessary to establish, exercise or defend legal claims or resolve disputes.

​

Lawful basis: our legitimate interests in protecting our legal position and rights and, where applicable, compliance with legal obligations.

​

Where special-category information is involved, an additional Article 9 condition will be identified where required.

​

L. Photography, recordings and publicity

​

We may take or use photographs, video or recordings of Moot events for legitimate educational, archival, reporting or promotional purposes where lawful and appropriate.

​

Where consent is required in the circumstances, we will seek consent.

​

We will take particular care where an individual has raised a reasonable objection or where additional safeguards are appropriate.

​

6. Legitimate interests

​

Where we rely on legitimate interests, those interests may include:

​

• organising and administering the IntLaw Moot;

• providing legal education;

• communicating with participants and professional stakeholders;

• maintaining relationships with universities and institutions;

• identifying suitably qualified arbitrators and contributors;

• promoting future editions and educational activities;

• maintaining the security and integrity of our systems;

• preventing misuse;

• protecting participants and Foundation property;

• maintaining appropriate governance and records; and

• establishing or protecting our legal rights.

​

Before relying on legitimate interests, we consider whether the processing is necessary and whether your interests, rights or freedoms override those interests.

​

You have the right to object to processing based on legitimate interests in the circumstances described in section 13.

​

7. When providing personal data is required

​

In some circumstances, we need certain personal data in order to:

​

• register you or your university;

• provide access to the Portal;

• administer your participation;

• enter into or perform an agreement;

• process a payment;

• arrange a hearing or event; or

• comply with a legal obligation.

​

Where required information is not provided, we may be unable to complete the relevant registration, provide the requested service, administer participation or proceed with the relevant relationship.

​

Where providing information is optional, this will normally be apparent from the context.

​

8. Who we share personal data with

​

We disclose personal data only where reasonably necessary and subject to appropriate safeguards.

​

Recipients may include:

​

• authorised members of the IntLaw Moot Directorate;

• members of relevant Moot Boards;

• Chief Ambassadors and Ambassadors where necessary for their functions;

• arbitrators;

• university and team representatives;

• event and venue personnel;

• website and Portal service providers;

• email and communications providers;

• cloud and document-storage providers;

• form and survey providers;

• videoconferencing providers;

• payment-service providers;

• accounting and administrative service providers;

• IT and cybersecurity providers;

• professional advisers;

• insurers;

• institutional partners and supporters where necessary for a particular activity;

• service providers assisting with the organisation of the Moot; and

• public authorities, courts or regulators where disclosure is legally required.

​

Access within the Moot organisation is provided on a need-to-know basis having regard to the individual's role.

​

Where a service provider acts as a processor on our behalf, we require appropriate contractual and organisational protections consistent with applicable data-protection law.

​

IntLaw LLP and registration payments

​

While IntLaw Foundation does not operate its own bank account, IntLaw LLP may process limited payer and transaction information while acting as the Foundation's temporary collection agent and custodian in respect of Foundation funds.

​

Such information is limited to what is reasonably necessary to receive, identify, reconcile and account for payments.

Where IntLaw LLP processes personal data solely on documented instructions from IntLaw Foundation in that capacity, appropriate data-processing arrangements apply. Where IntLaw LLP is independently required to process particular information to comply with its own legal obligations, it may act as a separate controller for that limited processing.

​

We do not sell personal data.

​

9. International transfers

​

The IntLaw Moot is international. Our participants, contributors and service providers may be located in different countries.

As a result, personal data may in some circumstances be transferred to, stored in or accessed from a country outside the United Kingdom or, where the EU GDPR applies, outside the European Economic Area.

​

Where an international transfer is restricted by applicable law, we use an appropriate lawful transfer mechanism.

For transfers governed by UK data-protection law, this may include:

​

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved EU Standard Contractual Clauses;

• another appropriate safeguard permitted by UK law; or

• an applicable statutory exception where permitted.

​

Where the EU GDPR applies, relevant mechanisms may include:

​

• a European Commission adequacy decision;

• approved Standard Contractual Clauses;

• other safeguards permitted under Article 46 GDPR; or

• an applicable Article 49 derogation in appropriate circumstances.

​

Where required, we also assess the protections applicable to the transferred data and adopt supplementary measures where appropriate.

​

You may contact us for further information about safeguards relevant to a particular transfer.

​

10. How long we retain personal data

​

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, accounting, governance and limitation requirements.

​

Retention periods depend on the nature of the information and the purpose for which it is processed.

​

As a general guide:

​

Participant and team administration records: generally for the relevant competition cycle and for up to two years afterwards, unless a longer period is reasonably required for a dispute, complaint, governance matter or legal claim.

​

Competition submissions, memoranda and evaluation materials: generally for the relevant competition cycle and a reasonable period afterwards where needed for competition administration, appeals, integrity or records. Materials retained for educational, archival or publication purposes will be handled separately where appropriate.

​

Financial, invoice, payment and accounting records: normally for up to six years following the relevant accounting period, or for any longer period required by law.

​

Arbitrator, Ambassador, Board or contributor records: for the duration of the relationship and for a reasonable period afterwards. Unsuccessful applications will ordinarily not be retained for more than two years unless there is a specific reason to retain them or the individual agrees to continued contact.

​

Portal accounts: for the competition cycle and a reasonable period after its conclusion, following which accounts may be disabled or deleted unless continued access is justified.

​

General correspondence: for as long as reasonably necessary having regard to the subject matter and any continuing relationship.

​

Marketing information: until you opt out or we otherwise determine that continued processing is no longer appropriate. We may retain limited suppression information after an opt-out so that we can respect your preference.

​

Technical and security logs: for a period proportionate to operational and security requirements.

​

Complaints and rights requests: for a period reasonably necessary to demonstrate that the request or complaint was properly dealt with and to protect legal rights.

​

We may retain information for longer where reasonably necessary to:

​

• comply with law;

• resolve a dispute;

• investigate misconduct;

• establish, exercise or defend legal claims; or

• comply with a lawful regulatory requirement.

​

At the end of the applicable retention period, personal data will be deleted, anonymised or securely archived where continued retention is legally justified.

​

11. Cookies and similar technologies

​

Our website and online services may use cookies and similar storage or access technologies.

​

Certain technologies are necessary for the website or Portal to function, for example for:

​

• security;

• authentication;

• session management;

• remembering essential user choices; and

• delivering a service requested by the user.

​

Where applicable law permits the use of a technology without consent, we may rely on the relevant exemption.

​

Where consent is legally required for a non-essential cookie or similar technology, we will obtain consent before using it.

​

You can manage available cookie preferences through the relevant website controls and, where applicable, through your browser settings.

​

Disabling certain technologies may affect the functionality of the website or Portal.

​

12. Direct marketing

​

You have the right to object at any time to the use of your personal data for direct marketing.

​

Where required, we obtain consent before sending electronic direct marketing.

​

Where applicable law permits electronic marketing without prior consent, we will nevertheless provide an easy method of opting out and respect objections.

​

Operational communications relating directly to your participation, account, application or relationship with the Moot are not treated as marketing simply because they are sent by email.

​

13. Your data-protection rights

​

Depending on the applicable law and the circumstances, you may have the following rights.

​

Right of access

​

You may ask whether we process your personal data and request access to personal data we hold about you.

​

Right to rectification

​

You may ask us to correct inaccurate personal data or complete incomplete information.

​

Right to erasure

​

You may ask us to erase your personal data in circumstances in which the law provides a right to erasure. The right is not absolute, and we may retain information where there is a lawful reason to do so.

​

Right to restriction

​

You may ask us to restrict processing in certain circumstances.

​

Right to data portability

​

Where the statutory conditions are met, you may request certain personal data in a structured, commonly used and machine-readable form or request its transmission to another controller.

​

Right to object

​

Where we process personal data on the basis of legitimate interests, you may object on grounds relating to your particular situation. We will stop the relevant processing unless we can demonstrate a lawful reason to continue that overrides the relevant interests, rights and freedoms, or processing is required for legal claims.

​

Absolute right to object to direct marketing

​

You may object to direct marketing at any time. If you do so, we will stop using your personal data for that purpose.

​

Right to withdraw consent

​

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

​

Rights relating to automated decisions

​

Applicable law may provide rights concerning decisions based solely on automated processing that produce legal or similarly significant effects. As explained below, we do not currently use solely automated decision-making for participant selection, competition scoring, arbitrator appointment or similar significant decisions.

​

Exercising your rights

​

To exercise a data-protection right, contact: directorate@intlawmoot.org

​

We may ask for information reasonably necessary to verify your identity and understand your request.

​

We will respond within the time required by applicable law.

​

Rights may be subject to statutory exemptions and limitations.

​

14. Data-protection complaints

​

If you have a concern or complaint about how IntLaw Foundation uses your personal data, you may submit a data-protection complaint to: directorate@intlawmoot.org

​

Please include sufficient information for us to understand the issue.

​

We will:

​

• provide a means for you to raise the complaint;

• acknowledge receipt within the period required by applicable UK law, currently 30 days;

• take appropriate steps to investigate the complaint without undue delay;

• keep you appropriately informed where necessary; and

• notify you of the outcome without undue delay.

​

We encourage you to contact us first so that we have an opportunity to consider and address your concern.

​

You also have the right to complain to the Information Commissioner's Office (ICO) in the United Kingdom.

​

15. Security

​

We maintain technical and organisational measures appropriate to the nature of the information and the risks associated with processing.

​

Measures may include, as appropriate:

​

• access controls;

• role-based permissions;

• authentication controls;

• secure cloud storage;

• encryption;

• restricted access to participant information;

• confidentiality requirements;

• data minimisation;

• secure payment arrangements;

• vendor due diligence;

• backups;

• system monitoring; and

• procedures for responding to security incidents.

​

Access to personal data is limited to persons who reasonably require it for their responsibilities. No electronic system or method of transmission can be guaranteed to be completely secure. Users should therefore also protect passwords and account credentials and use appropriate care when communicating sensitive information.

​

16. Artificial intelligence and automated decision-making

​

We do not use solely automated processing to make decisions concerning:

​

• admission to or registration for the Moot;

• participant eligibility;

• competition scores or rankings;

• appointment of arbitrators;

• Ambassador selection; or

• other decisions that produce legal or similarly significant effects on an individual.

​

Material decisions of this nature involve human review.

​

We may use appropriately selected AI-assisted tools for administrative and operational purposes, including:

​

• assisting with draft communications;

• summarising or organising information;

• translation;

• administrative research;

• workflow support; and

• improving operational efficiency.

​

Where AI-assisted tools are used in connection with personal data, we apply the same data-protection principles that apply to our other processing. In particular, we seek to:

​

• minimise the personal data provided;

• avoid unnecessary use of special-category or highly sensitive information;

• use appropriate contractual, technical and organisational safeguards;

• consider international-transfer requirements where relevant;

• restrict access appropriately; and

• maintain meaningful human review.

​

We do not permit an AI system to make significant decisions about participants or applicants without meaningful human involvement.

​

17. Children and participants under 18

​

The IntLaw Moot is primarily intended for university students, coaches, academics and legal professionals, most of whom are adults. It is nevertheless possible that a university-level participant may be under 18.

​

Where we process personal data relating to a person under 18, we take the individual's age and circumstances into account and apply appropriate safeguards.

​

Where consent is relied upon and applicable law requires consent or authorisation from a person with parental responsibility, we will take appropriate steps to obtain that authorisation.

​

We do not knowingly use information about children for behavioural advertising or other inappropriate purposes.

​

If you believe that we have collected information relating to a child in circumstances in which we should not hold it, please contact us.

​

18. Social media and third-party websites

​

Our website or communications may contain links to third-party websites or social-media platforms. Those third parties may independently collect and process personal data and have their own privacy policies.

​

This Privacy Policy does not govern processing independently carried out by those organisations. We encourage users to review the privacy information provided by the relevant third party.

​

19. Changes to this Privacy Policy

​

We may update this Privacy Policy from time to time to reflect:

​

• changes in our activities;

• changes in the Moot or Portal;

• new service providers or technologies;

• changes in applicable law;

• regulatory guidance; or

• improvements to our privacy practices.

​

The current version will be made available through the IntLaw Moot website or Portal.

​

Where a change is material and it is appropriate to do so, we may also notify affected persons by email or another appropriate communication method.

​

The date at the beginning of this Policy identifies when it was most recently updated.

​

20. Contact us

​

Questions about this Privacy Policy, our use of personal data, a data-protection right or a data-protection complaint may be sent to:

​

IntLaw Foundation
Lytchett House
Unit 13 Freeland Park
Wareham Road
Lytchett Matravers
Poole BH16 6FA
United Kingdom

Email: directorate@intlawmoot.org
Website: www.intlawmoot.org