This Privacy Policy explains how Global Innovation Forum Limited ("Innovation Forum") collects and uses personal data through the Innovation Forum × R1X hackathon website. It is a DRAFT template for legal review and is not legal advice.
1. Purpose and scope
This Privacy Policy (the "Notice") describes how personal data is collected, used, stored and protected when you visit and interact with the Innovation Forum × R1X hackathon microsite (the "Website"), and the rights you have under UK data protection law.
This Notice applies only to the hackathon microsite hosted at https://r1x.co.uk/public_hackathon/ and its associated pages, including /apply, /challenges, /insights and /sponsorship.
This Notice does not cover the separate R1X website at the r1x.co.uk root, which is operated by R1X and is out of scope. Where the Website links to any third-party website, this Notice does not apply to those websites, and you should review their own privacy notices.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and applicable guidance and codes of practice issued by the Information Commissioner's Office (ICO). The governing law is that of England and Wales.
- Effective date: [EFFECTIVE DATE]
- Version: [VERSION]
2. Who we are
Innovation Forum is the data controller responsible for the personal data collected through the Website. "Innovation Forum" is a trading name; the registered legal entity is set out below.
| Detail | Information |
|---|---|
| Data controller (trading name) | Innovation Forum |
| Registered legal name | Global Innovation Forum Limited |
| Company number | 10010132 |
| Registered office | Future Business Centre, Kings Hedges Rd, Cambridge, CB4 2HY, United Kingdom |
| Website | inno-forum.co.uk |
| General contact email | info@inno-forum.co.uk |
| ICO registration number | [ICO REGISTRATION NUMBER] |
R1X (r1x.co.uk) is our technology and hosting partner. The Website is hosted within a subfolder of the r1x.co.uk domain, and R1X provides hosting and related IT services to Innovation Forum as a processor and partner. Innovation Forum remains the data controller for personal data collected through the Website.
Data protection contact
If you have any questions about this Notice or how we handle your personal data, please contact:
- Name: The Data Protection Contact
- Email: [DATA PROTECTION EMAIL]
- Postal contact: Future Business Centre, Kings Hedges Rd, Cambridge, CB4 2HY, United Kingdom
3. What personal data we collect
We keep data collection to a minimum. The Website is a static site (built with Astro) that uses self-hosted fonts and does not load external font services, analytics or advertising tools by default.
This section describes the Website. It does not describe the participant workspace at https://if-hackathon-workspace.pages.dev, which is a separate, sign-in-only service used during an event and is covered by its own Workspace Privacy Notice. If you sign in there, that notice rather than this section tells you what is collected, who it is shared with and how long it is kept.
3.1 Registration data
The only place on the Website where we deliberately collect personal data is the registration form on the /apply page. When you submit that form, we collect:
- First name
- Last name
- Email address
- Challenge choice — which of the five hackathon challenges interests you ("One Farm, One Picture", "Mapping the Gaps", "Beyond the Mainframe", "Safe in the Open", "Ahead of the Heat")
The form also uses a hidden anti-spam "honeypot" field. This field is not visible to you, is intended to be left blank, and is used solely to detect and filter automated spam submissions. It is not used to identify or profile genuine applicants.
3.2 Technical and server-log data
Like most websites, the servers that host the Website may automatically record limited technical information as part of their normal operation and for security purposes. Depending on the hosting configuration, this may include:
- IP address (or a truncated/anonymised form of it)
- Browser type and version, and device/operating-system information
- The pages requested, and the date and time of the request
- Referring page or source, where provided by your browser
This technical data is generated by the hosting infrastructure operated by our hosting partner, R1X. The specific fields logged and their retention are subject to confirmation with R1X — see the retention table in section 9. [CONFIRM logging fields and retention with R1X.]
3.3 Cookies and similar technologies
We do not set analytics or advertising cookies on the Website by default. No cookies are set when the /apply page loads; the only network request made from that page is the form submission itself, sent when you choose to submit. Please see our separate Cookie Policy for full details of cookies and similar technologies.
4. How we collect personal data
We collect personal data in the following ways:
- Directly from you — when you complete and submit the registration form on the /apply page.
- Automatically — limited technical and server-log data generated by the hosting infrastructure when you visit the Website (see section 3.2).
We do not buy or obtain your personal data from third-party list providers or data brokers.
5. Why we use your personal data and our lawful basis
Under the UK GDPR we must have a lawful basis for processing your personal data. The table below sets out each purpose, the data involved and the lawful basis we rely on. Our legal team will confirm the final position on lawful bases.
| Purpose | Personal data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Administering your application and registering you for the hackathon (allocating a place, matching solo entrants, organising teams and logistics) | First name, last name, email, challenge choice | Legitimate interests — Art. 6(1)(f): running and administering the event you have applied to |
| Contacting you about your application and the Innovation Forum × R1X programme (updates, confirmations, event information) | First name, last name, email | Consent — Art. 6(1)(a) and/or legitimate interests — Art. 6(1)(f) |
| Sending you marketing or promotional communications about the programme | First name, last name, email | Consent — Art. 6(1)(a), in line with PECR |
| Detecting and preventing spam and misuse of the registration form | Honeypot field, submission metadata | Legitimate interests — Art. 6(1)(f): protecting the security and integrity of the Website |
| Maintaining the security and proper operation of the Website | Technical/server-log data | Legitimate interests — Art. 6(1)(f): network and information security |
When you submit the registration form, the on-page statement reads: "By submitting, you agree we can contact you about your application and the Innovation Forum × R1X programme. We won't share your details."
Where we rely on legitimate interests, we have considered your rights and interests and do not believe our processing overrides them. You may ask us for more information about our legitimate interests assessment using the contact details in section 14.
6. Consent and how to withdraw it
Where we rely on your consent (for example, for programme or marketing communications), you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.
You can withdraw consent or opt out of communications by:
- Using the unsubscribe link in any marketing email we send you; or
- Emailing us at [DATA PROTECTION EMAIL] or info@inno-forum.co.uk with your request.
If you withdraw consent for programme communications, we may still need to contact you about essential matters relating to your application on the basis of our legitimate interests, until your application is closed or withdrawn.
7. Who we share your personal data with
We do not sell your personal data, and we do not share it for third parties' own marketing purposes. We share it only with the following, and only as necessary:
- HubSpot — our customer relationship management (CRM) and marketing services provider, which acts as our data processor under a written data processing agreement. When you submit the registration form, your details are sent directly to the HubSpot Forms API and stored as a contact record in our HubSpot account (portal ID 148769491). The contact record holds your first name, last name, email address and challenge choice (stored in a custom "challenge_choice" property). HubSpot stores this data in its EU data centre (region "eu1", app-eu1.hubspot.com).
- R1X — our technology and hosting partner, which provides hosting and IT infrastructure for the Website and acts as a processor for hosting-related personal data (such as server logs).
- Professional advisers, service providers and authorities — for example IT, security or legal advisers, or where we are required to disclose data by law or to protect our legal rights.
We put appropriate contractual protections in place with our processors, requiring them to keep personal data secure and to process it only on our instructions.
8. International transfers
Your registration data is stored by HubSpot in its EU data centre (region "eu1"). Personal data may be processed in the United Kingdom and the European Economic Area (EEA).
Where any personal data is transferred outside the UK (for example, if a processor accesses data from, or hosts back-up or support functions in, a country outside the UK), we will ensure that an appropriate safeguard recognised under UK data protection law is in place. This may include:
- Transfers to a country covered by UK "adequacy regulations"; or
- The International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional safeguards required. [CONFIRM the specific transfer mechanism(s) used by HubSpot and any other processor.]
You can ask us for more information about the safeguards in place using the contact details in section 14.
9. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes set out in this Notice, after which it is securely deleted or anonymised. The retention periods below are placeholders to be confirmed by our legal team.
| Data | Retention period |
|---|---|
| Registration/contact data in HubSpot (name, email, challenge choice) | [RETENTION PERIOD — e.g. duration of the programme plus X months/years] |
| Marketing/consent records | [RETENTION PERIOD — retained to evidence consent, then deleted] |
| Server-log and technical data | [RETENTION PERIOD — confirm with R1X] |
| Records relating to under-18 applicants and parental/guardian consent | [RETENTION PERIOD — see Safeguarding & Under-18 policy] |
Where you withdraw consent or ask us to erase your data, we will act on your request as set out in section 10, subject to any legal obligation to retain certain records.
10. Your rights under UK GDPR
You have the following rights in relation to your personal data. Some rights apply only in certain circumstances.
- Right to be informed — to know how your personal data is used (this Notice).
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to have inaccurate or incomplete data corrected.
- Right to erasure — to ask us to delete your personal data in certain circumstances.
- Right to restrict processing — to ask us to limit how we use your data in certain circumstances.
- Right to data portability — to receive certain data in a structured, commonly used, machine-readable format, or to have it transmitted to another controller.
- Right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Right to withdraw consent — where we rely on consent (see section 6).
- Rights relating to automated decision-making — see section 11.
To exercise any of these rights, please contact us using the details in section 14. We will respond within one month, although this may be extended for complex requests as permitted by law. We do not usually charge a fee. We may need to verify your identity before acting on your request.
Complaining to the ICO
If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office. We would, however, appreciate the chance to address your concerns first.
- Information Commissioner's Office
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Website: ico.org.uk
- Helpline: 0303 123 1113
11. Automated decision-making and profiling
We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR. Places on the hackathon are administered by our team, and decisions about applications are not made solely by automated means.
12. Children and under-18 applicants
The hackathon is open to people aged 17 to 65. This means some applicants will be 17 years old and therefore minors (under 18) at the time they apply.
We take particular care with the personal data of under-18s and design our services with regard to the ICO's Age Appropriate Design Code (the Children's Code). Where an applicant is under 18:
- We expect a parent or guardian to be aware of, and involved in, the application, and we may require parental or guardian consent before confirming a place;
- We collect only the minimum personal data needed;
- We do not use their data for profiling or targeted marketing.
Please see our separate Safeguarding and Under-18 Participation Policy for full details of how we protect younger participants. If you are under 18 and have concerns about your data, please ask a parent or guardian to contact us.
13. How we keep your personal data secure
We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include:
- Serving the Website over an encrypted (HTTPS) connection;
- Sending registration data securely to HubSpot, which stores it in a professionally managed EU data centre with its own security controls;
- A privacy-first Website design with no analytics or advertising trackers loaded by default and self-hosted fonts (no external font calls);
- Restricting access to personal data to those who need it, and requiring processors to maintain appropriate security;
- Anti-spam controls on the registration form.
No method of transmission or storage is completely secure, but we work to protect your data and to keep our measures under review.
14. How to contact us and make a complaint
If you have any questions, wish to exercise your rights, or want to make a complaint about how we handle your personal data, please contact:
- Innovation Forum — Data protection contact: The Data Protection Contact
- Email: [DATA PROTECTION EMAIL] or info@inno-forum.co.uk
- Post: Future Business Centre, Kings Hedges Rd, Cambridge, CB4 2HY, United Kingdom
You also have the right to complain to the ICO at any time (see section 10).
15. Changes to this Notice
We may update this Notice from time to time to reflect changes in our practices or legal requirements. When we do, we will revise the effective date and version below and, where appropriate, notify you. Please check this page periodically for updates.
- Effective date: [EFFECTIVE DATE]
- Version: [VERSION]
This is a DRAFT template prepared for review by the client's legal team. It does not constitute legal advice.