SCIFI, Inc. is based in California, United States, and your data is stored in Amazon Web Services’ US East (Northern Virginia) region. If you are in the United Kingdom, the European Economic Area, Switzerland, or another non-U.S. country, your personal data will be transferred to the United States. We rely on AWS’s certification under the EU–US Data Privacy Framework (and its UK Extension and Swiss–US extension) and, where applicable, the European Commission’s Standard Contractual Clauses, as the safeguards for these transfers. You can request a copy of the relevant safeguards by contacting privacy@lacon.org.
LAcon V Data Protection: Definitions and Policies
Information Categories
The LAcon V Data Protection Policy follows California law as set forth in the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). LAcon V collects several categories of information on members, prospective and invited program participants. They are, ranked in order from fewest restrictions to most restrictions:
- Public Data
- LAcon V Confidential Data
- Personal Data
- Sensitive Personal Information
Details on information categories
Public Data
This is participant information that LAcon V publishes publicly through some channel. For example, biography and social media information is published by LAcon V as part of publicizing the program schedule and participants and is thus public once we publish it. Note that some Personal Data for these participants will be public, for example a person’s name where they have not supplied an alternative name such as a fan name or pseudonym.
LAcon V Confidential Data
In general, all data about all participants is considered LAcon V Confidential data unless and until it is deemed Public Data and then published. This includes data submitted by participants and also data created by LAcon V staff such as schedules.
Personal Data
Personal Data under California Law includes:
- Name (or nickname)
- Email address
- Postal address
- Purchase history
- Browsing history
- Location data
- Employment data
- IP address
- Profiles businesses create about you, including pseudonymous profiles (“user1234”)
LAcon V will only collect and maintain Name (or nickname), email and postal addresses, phone number (from the membership registration process), purchase history of obtaining a membership, and any profile created with LAcon V (which may include Sensitive Personal Information, if furnished).
Sensitive Personal Information
Sensitive Personal Information under California law includes:
- Social Security, Passport number, Driver’s license or State ID
- Financial account credentials
- A consumer’s precise geolocation
- Racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership
- Contents of messages (e.g. emails, texts, chats) unless it is directed to LAcon V or created by a staff member as part of their official duties for LAcon V
- Genetic data
- Biometrics like facial recognition
- Information concerning your health, sex life, or sexual orientation
LAcon V will not be collecting or storing any sensitive personal information from any participants (except as set forth above) and location from the address they provided when registering for LAcon V.
Rights
All LAcon V participants have the following rights under the CCPA and CPRA:
- Right to know: You can request that a business disclose to you: (1) the categories and/or specific pieces of personal information they have collected about you, (2) the categories of sources for that personal information, (3) the purposes for which the business uses that information, (4) the categories of third parties with whom the business discloses the information, and (5) the categories of information that the business sells or discloses to third parties. You can make a request to know up to twice a year, free of charge. LAcon V does not disclose to third parties other than possibly to a future seated Worldcon as set forth in this document. Nor will LAcon V ever sell your information to any person or entity.
- Right to delete: You can request that businesses delete personal information they collected from you and tell their service providers to do the same, subject to certain exceptions (such as if the business is legally required to keep the information).
- Right to opt-out of sale or sharing: You may request that businesses stop selling or sharing your personal information (“opt-out”), including via a user-enabled global privacy control. Businesses cannot sell or share your personal information after they receive your opt-out request unless you later authorize them to do so again. As stated above LAcon V will not be selling any data and only sharing limited information with future Worldcons as set out herein.
- Right to correct: You may ask businesses to correct inaccurate information that they have about you.
- Right to limit use and disclosure of sensitive personal information: You can direct businesses to only use your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) for limited purposes, such as providing you with the services you requested.
Sharing participant personal information within LAcon V
Data sharing within any particular Division or Area is almost entirely done through a variety of third-party commercial tools. Any staff person who needs access to Personal Data that is stored in one of these tools on an ongoing basis must request a personal login for that tool, and their request must be approved by their leadership (Division- or Area-Head, as appropriate). Each user must agree to the terms and conditions of those tools in order to use them and receive access to Personal Data.
Any and all communications between LAcon V staff and participants within these third-party are designated as Personal Data, and will be treated as such.
Select Personal Data will be shared with the seated 2027 and 2028 Worldcons. Program Participants will be contacted regarding the possibility of sharing additional information. Outside of this, no Personal Data/ Sensitive Personal information will be shared with any entity.
On occasion, a staff member who does not have access to one of these tools will need specific information for a participant in order to contact them. Before providing access, the requesting staff member will provide written acknowledgement of the obligation to maintain participant privacy. Only members of the leadership team responsible for the tool containing this information may retrieve this information and provide it to the requestee.
A partial list of tools being used by LAcon V staff includes, but may not be limited to:
- Planorama: used as the central source for all LAcon V membership data. Personnel who may have access (restricted or otherwise) to Planorama may include select members of the following teams:
- Accessibility
- Art Show
- Events
- Incident Response Team (IRT)
- Program
- Registration
- WSFS
- Jira Service Manager (by Atlassian): used as the private source of information related to any/all policy violation reports.
- All participants will be able to submit reports and track their own reports.
- Select Division or Area leadership members will be able to view and update reports that have been specifically assigned to their teams.
- Other Division or Area leadership members will be provided a limited one-time export of Personal Information that is specifically relevant to their teams.
- IRT leadership will have full read-write (but not delete) access to all reports.
Sharing participant information outside of LAcon V
On an opt-in basis, select Personal Data for program participants will be shared with the seated 2027 and 2028 Worldcons. The Program Division will query participants in two separate questions that specify the Worldcon that will receive the data and which particular data will be shared. These will be mandatory yes/no questions. Outside of the foregoing mechanism, no Personal Data/Sensitive Personal information will be shared.
The WSFS Division will collect names, email and postal addresses, and may collect phone numbers of voters in Site Selection. This information will be passed on to all bids for the 2028 Worldcon. Please refer to the WSFS Constitution, Section 4.4.1.
On an opt-in basis, membership data will be shared with the seated 2027 Worldcon for the purpose of Hugo Award nominations for that convention.
LAcon V Data Retention Policies
LAcon V will hold personal data no longer than December 31, two years after the convention unless explicitly granted permission to do otherwise.
The Listeners team will hold no personal data longer than three months after the convention, or three months after the last violation investigation closes, whichever is later.
All LAcon V divisions will liaise with the Chair if they receive a request to delete personal data. Our policy is to delete personal data covered by such a request in fewer than 30 days, or as soon as is practicable.
Any LAcon V participant may contact the Chair at privacy@lacon.org with any questions or requests for disclosure or deletion.
