Privacy policy

Next Step Organization is an education initiative registered in the Kurdistan Region of Iraq, based in Sulaimani. We organise Next Step Fair and the Day 1 conference, and we are the data controller for everything described here.

We collect only what the registration form asks for. Nothing is bought from third parties and nothing is inferred about you.

• Fair registration: name, date of birth, phone number, city, preferred language, school and stream, intended field of study, days attending, and the sessions you save.
• Conference RSVP: name, title, institution, official email, mobile number, city, delegation size and interpretation needs.
• Optional: email address, gender, and how you heard about the fair.
• Automatically: page views and referral source through GA4 and the platform pixels, in aggregate.

Your phone number is the delivery channel for your badge, so it has to be verified before a ticket is issued. Your city and school let us plan shuttle routes and staffing. Session picks drive the reminder you receive 15 minutes before a saved session, and tell us which rooms to make larger next year.

• Issuing and re-issuing your QR badge.
• Sending event reminders and day-of directions on WhatsApp or by email.
• Check-in at the gate, and counting attendance per day.
• Aggregate reporting to partners, ministries and in the annual impact report.

You give consent explicitly, per purpose, with a timestamp recorded against your registration. Consent to WhatsApp updates is required because it is how the badge reaches you. Consent to appear in event photography is optional and can be withdrawn at any time. For anyone under 18, written release from a parent or guardian is required before any identifiable photograph is published.

Your personal data is never sold, and never shared with exhibitors, universities or sponsors. Partners receive counts and aggregates only — never a list of names or numbers.

• Our own staff, under role-based access, for registration and check-in.
• Meta WhatsApp Cloud API, to deliver your badge and reminders.
• Our email provider, for conference confirmations.
• Our hosting and database provider, where the data is stored encrypted.

Registration records are kept for 24 months after the edition, so that a returning student does not start from scratch and so that year-on-year attendance can be reported. Check-in logs are kept for 12 months. After that, records are deleted or irreversibly anonymised.

You can ask to see the data we hold on you, correct it, or have it deleted, and we will respond within 30 days. Deleting your registration cancels your badge. You can stop WhatsApp messages at any time by replying STOP, which does not cancel your registration.

Personal data is encrypted at rest. Badge downloads use signed, expiring links. QR codes contain a signed ticket identifier only — never your name, phone number or ID — so a leaked badge image cannot expose your details.