1. Introduction

This Privacy Policy explains how [Organizer Name] (the "Organizer" or "we") collects, uses, shares, and protects your personal data when you participate in MAIHS (the "Hackathon"). We are committed to protecting your privacy and ensuring compliance with the General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218).

By registering for or participating in the Hackathon, you consent to the processing of your personal data as described in this Privacy Policy.

2. Data Controller and Contact Information

The Data Controller for your personal data is:

[Organizer Name]
[Street Address]
[Postal Code, City, Sweden]
Organization Number: [XXXXXX-XXXX]
Email: [dpo@organizer.se]
Phone: [+46 XX XXX XX XX]

For all questions regarding the processing of your personal data or to exercise your rights, please contact us at the email address above.

3. Data Protection Officer (DPO)

If applicable, the Organizer has appointed a Data Protection Officer. You can reach our DPO at:

[DPO Name]
Email: [dpo@organizer.se]

4. Categories of Personal Data We Collect

We may collect and process the following categories of personal data:

• Registration Data: Name, email address, phone number, affiliation (e.g., company or university), and team information.
• Technical Data: IP address, browser type, device information, and cookies (if applicable).
• Submission Data: Project titles, descriptions, code repositories, and other materials submitted as part of the Hackathon.
• Communication Data: Emails, messages, or other correspondence between you and the Organizer.

5. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each with its corresponding legal basis under GDPR:

Registration and participation in the Hackathon:
We process your data to manage your registration, participation, and communication related to the event.
Legal Basis: Performance of a contract (GDPR Art. 6(1)(b)).
Retention Period: Until the end of the Hackathon + 1 year.

Communication and event updates:
We may send you updates, announcements, and other information about the Hackathon.
Legal Basis: Consent (GDPR Art. 6(1)(a)) or Legitimate Interest (GDPR Art. 6(1)(f)).
Retention Period: Until you withdraw consent or object to the processing.

Promotion and reporting:
We may use your data (e.g., team name, project title) for promotional materials, reports, or post-event communications.
Legal Basis: Legitimate Interest (GDPR Art. 6(1)(f)).
Retention Period: Until the end of the Hackathon + 2 years.

Compliance with legal obligations:
We may process your data to comply with applicable laws or regulatory requirements.
Legal Basis: Legal obligation (GDPR Art. 6(1)(c)).
Retention Period: As required by law.

6. Data Processors

We may use third-party service providers (Data Processors) to assist in organizing the Hackathon. These providers process personal data on our behalf and under our instructions. We ensure that all Data Processors comply with GDPR and have entered into Data Processing Agreements (DPAs) with us.

Examples of Data Processors we may use:

• Event management platforms (e.g., Eventbrite, Devpost)
• Cloud storage providers (e.g., Google Drive, GitHub)
• Communication tools (e.g., Slack, Microsoft Teams)

7. Sharing of Personal Data

We will not sell or share your personal data with third parties for marketing purposes. Your data may be shared in the following circumstances:

• With your consent (e.g., for promotional activities).
• With Data Processors as described above.
• With sponsors or partners (only aggregated, anonymized data or with your explicit consent).
• As required by law (e.g., to comply with a legal obligation or court order).

8. International Data Transfers - would leave this out 

If your personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy Decisions for countries recognized by the EU as providing an adequate level of data protection.

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your data, subject to legal limitations.
• Right to Restriction of Processing: Request that we restrict the processing of your data.
• Right to Data Portability: Request a machine-readable copy of your data.
• Right to Object: Object to the processing of your data based on legitimate interest.
• Right to Withdraw Consent: Withdraw your consent at any time (if processing is based on consent).

To exercise any of these rights, please contact us at [dpo@organizer.se]. We will respond to your request within one month.

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specifically:

• Registration and participation data: Retained until the end of the Hackathon + 1 year.
• Promotional and reporting data: Retained until the end of the Hackathon + 2 years.
• Legal compliance data: Retained as required by Swedish law.

After the retention period, your data will be permanently deleted or anonymized.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of sensitive data.
• Access controls and authentication.
• Regular security audits.

12. Cookies and Tracking Technologies

If our website or platforms use cookies or similar tracking technologies, we will:

• Inform you about the types of cookies used (e.g., necessary, analytical, marketing).
• Obtain your explicit consent for non-necessary cookies, in compliance with the Swedish Electronic Communications Act (2003:389) and the ePrivacy Directive.

For more details, please refer to our Cookie Policy.

13. Supervisory Authority

If you believe your data has been processed in violation of GDPR or Swedish data protection laws, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm
Sweden
Website: www.imy.se

14. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we will notify you of significant updates via email or through the Hackathon platform.

15. Contact Us

For any questions or concerns about this Privacy Policy or the processing of your personal data, please contact us at:

[Organizer Name]
Email: [dpo@organizer.se]
Phone: [+46 XX XXX XX XX]