Article 1 — Data Controller

The data controller for the Services is the Hong Kong AI International Film Festival Association. For privacy matters, contact our Data Protection Officer at privacy@hkaiiff.io.

Article 2 — What We Collect

2.1 Information you provide:

• account data: name, email address, and (optionally) username, bio, secondary email, phone, and region;
• date of birth or age confirmation (for age eligibility);
• asset and submission information you choose to register;
• transaction records when you purchase paid features.

2.2 Information collected automatically:

• device and browser information;
• IP address and network information;
• usage data (pages viewed, actions taken, session activity);
• cookies and similar technologies (see Article 7).

2.3 Email sign-in data. We use email-based sign-in. When you log in, we process your email address and the one-time verification codes (OTP) we send to it; we may use an email-delivery provider to deliver these codes. We do not collect sign-in data from Google, Apple, or other third-party identity providers.

2.4 Uploaded files and AI processing — no training. When you upload files to help complete a submission, our AI reads them only to extract and structure the information you are registering; the original uploaded content is then discarded and not retained for long-term storage. We do not use your uploaded works or their content to train AI models.

Article 3 — How We Use Your Data

• to create, verify, and manage your account;
• to provide the Services, including generating and maintaining INDEX records and public asset pages, and running the Festival and Hackathon;
• to process payments;
• to communicate with you about the Services (service notices; and, with your consent, activity updates);
• to comply with legal obligations, and to prevent fraud and protect platform security.

We rely on the legal bases of performance of a contract, our legitimate interests, your consent (where required), and compliance with legal obligations.

Article 4 — AI and Your Content

Consistent with Article 2.4: AI processing is limited to helping you organize and present what you submit. Your uploaded works and their content are not used to train AI models. AI usage logs (such as which capability was invoked) may be retained for a limited period to operate and secure the Services.

Article 5 — Sharing and Disclosure

We do not sell your personal data. We share it only:

• with service providers bound by contract (for example: cloud hosting, payment processing, and email delivery — including delivery of sign-in verification codes), who may use it only to perform services for us;
• where required by valid legal process or by a competent authority, and we will notify affected users to the extent permitted by law.

Article 6 — Security and Retention

6.1 Security. We use encryption in transit and at rest, access controls, and periodic security reviews. No system is perfectly secure; please protect your own credentials.

6.2 Retention. We keep personal data only as long as needed for the purposes described or as required by law:

• account data: for the life of the account and a reasonable period after closure;
• transaction records: as required for tax and accounting purposes;
• AI usage logs: a limited period;
• information necessary to maintain the integrity of an already-issued INDEX record may be retained as part of that record.

Article 7 — Cookies

• Essential cookies: required for the platform to function (cannot be disabled);
• Functional cookies: remember your preferences;
• Analytics cookies: help us understand usage (opt-out available where applicable).

You can control cookies through your browser settings; disabling some may affect functionality.

Article 8 — Your Rights

Subject to applicable law, you may:

• access and correct the personal data we hold about you (we aim to respond within 40 days);
• request deletion where the data is no longer needed, you withdraw consent, or it was unlawfully processed;
• opt out of marketing at any time (via the unsubscribe link or by emailing privacy@hkaiiff.io);
• request a copy of your data in a portable format;
• lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

Article 9 — Minors

The Services are not directed at persons under sixteen (16). If you believe a minor has provided us personal data without appropriate consent, contact privacy@hkaiiff.io and we will delete it promptly.

Article 10 — Cross-Border Transfers

Your personal data may be processed outside Hong Kong by our service providers. Where this occurs, we take steps intended to ensure a comparable level of protection, including appropriate contractual safeguards.

Article 11 — Changes

We may update this Policy. Material changes will be notified via the platform or by email. Continued use after changes take effect constitutes acceptance.

Article 12 — Contact

Data Protection Officer: privacy@hkaiiff.io