Privacy notice

Draft. This notice describes what the site actually does today, but it has not yet been reviewed by a lawyer and the operating legal entity is not named below. Both are being sorted before entries open.

This notice explains how Hebocon Sarawak handles personal data, in line with the Personal Data Protection Act 2010 (Act 709) of Malaysia.

Who is responsible

Hebocon Sarawak is organised by Sarawak Digital Economy Corporation and delivered by The Learning Curve (TLC Kuching Centre PLT). The data user for the purposes of the Act is the organising entity named here once registration details are finalised.

What we collect

If you join the mailing list: your email address, the language you were reading in, the date and time you consented, and the IP address the consent came from. The IP address and timestamp exist to prove the consent was given, which the Act requires us to be able to do.

If you enter a robot or book a workshop seat: your name, team name, age band, school if you name one, email address, phone number, and — where the builder is under 18 — an emergency contact. Also the robot's details, any photograph you upload, and whether you consented to being photographed.

If you pay for anything: the payment is handled by Stripe on their own pages. We never see or store your card number. We keep the order reference, what was bought, and the amount.

If you put a score on the Heboi Rumble leaderboard: the name you type into the box, your score, and the IP address it was submitted from. Nothing else — there is no account and we do not ask for an email. Use a nickname if you would rather not be identifiable; nothing checks it against anything.

When you browse: we use Plausible Analytics, which is cookieless and does not build a profile of you or track you across sites. We do not use Google Analytics and there is no advertising or social-network tracking on this site. Because nothing here stores a cookie for analytics, there is no cookie banner.

Why we collect it

To run the event: to tell you when entries open, to contact you about your entry or your workshop seat, to reach someone if a child is hurt, to judge robots against the declared high-tech features, and to take payment.

We do not sell personal data. We do not share it with anyone for marketing.

Who else sees it

Only the organisers and the delivery partner, and the service providers we need to operate: our payment processor (Stripe), our email delivery provider, and our hosting provider. Each of them sees only what they need.

Children

Anyone under 18 may enter with a parent or guardian's involvement. Where the builder is a minor we collect an emergency contact, and consent for photography is given by the parent or guardian rather than the child. We do not collect any more data about minors than about anyone else, and we do not send marketing email to a minor's address.

How long we keep it

• Mailing list: until you ask us to remove you, or until the chapter stops running, whichever comes first. Every email we send carries a way out.
• Entries and workshop bookings: for the edition they relate to, plus two years, so we can settle disputes and produce the following year's archive.
• Payment records: seven years, because Malaysian tax law requires it.
• Leaderboard entries: for the edition they belong to, plus one year, so the previous board can sit in the archive. Ask us and we will remove yours sooner.
• Photographs: indefinitely, where consent was given, since they become the event's own archive. Withdraw consent and we remove them from the site.

Your rights

Under the Act you may ask us to give you a copy of the personal data we hold about you, correct anything that is wrong, limit how we use it, or delete it. You may withdraw consent at any time, including consent to email and consent to photography.

Ask through the address on the contact page. We will respond within 21 days, which is the period the Act sets.

Security

Data is held on servers in Singapore, encrypted in transit. Access is limited to the organisers who need it. Uploaded photographs have their embedded metadata stripped before storage, so a photo you send us does not quietly carry your location with it.

Changes

If this notice changes materially we will say so on this page and email anyone on the mailing list before the change takes effect.