This privacy notice tells you what to expect us to do with your personal information when you use the HackTheBurgh XIII website or take part in the event. CompSoc, the University of Edinburgh’s technology society, organises HackTheBurgh and is responsible for this information as its data controller.
Contact details
For questions, requests or complaints about your personal information, email hello@hacktheburgh.com.
What information we collect, use, and why
We collect or use the following information to receive applications and organise the event:
- Account details: your name, username, email address, verification status and a securely hashed password when you use password sign-in.
- Application details: your name, pronouns, university, year of study, university email, country, CV, portfolio, experience, project interests and travel requirements.
- Eligibility and application records: your age and student declarations, application status, and the agreements and sharing choices you submit.
- Participation details: team membership, project submissions, dietary requirements, T-shirt size, meal choices and answers to event forms.
- Event updates: your name, email address and subscription preferences when you register interest.
- Service records: sign-in methods and times, account security records, email delivery records and information needed to prevent abuse and investigate technical problems.
Required fields are marked with an asterisk. Without the details needed to assess your application or organise your attendance, we may be unable to provide the relevant service. Please do not include information about other people unless you have their permission to provide it.
We use these records to review applications, communicate decisions, organise teams and projects, arrange catering and clothing, handle travel requests, answer queries and keep the website secure. Organisers make application decisions; the website also checks required answers, eligibility criteria and deadlines.
Where we get personal information from
Most information comes directly from you. We also create records when you use the website, and organisers record application decisions and event administration.
If you continue with Discord, GitHub, Google or Microsoft, we receive the account identifier and available profile and email details needed to sign you in. We do not receive your password for that provider. Accounts may be linked after email ownership has been established. Your provider also handles information under its own privacy notice.
Team members can see each other’s names and team membership, and share access to their team’s project. Do not put confidential information into a project intended for judging or publication.
Our lawful bases
Under UK data protection law, we must have a lawful basis for collecting and using your personal information.
- Legitimate interests: assessing applications, organising a student hackathon, providing account access, preventing misuse and handling routine enquiries. These interests must be balanced against your rights and reasonable expectations.
- Consent: sending updates you subscribe to and sharing your CV with sponsors for recruitment. These choices are separate from applying to the event.
- Legal obligations: keeping or disclosing information where a specific legal duty requires it, including responding to data protection requests.
Health-related dietary or access requirements need your explicit consent before we use them to arrange catering or support. Please provide only the details needed for those arrangements; you do not need to provide a medical history or explain a religious belief.
Reading or acknowledging this notice does not give blanket consent to every use of your information.
Who we share personal information with
Authorised organisers use the information needed to run the event. The website runs on servers managed by CompSoc, with access for authorised technical administrators. Google’s email service handles event correspondence, including email addresses and message contents. Caterers and support providers receive only the details needed for their arrangements. Judges receive the team and project information needed to assess submissions.
We share your CV with event sponsors for recruitment only if you agree. A CV may itself contain your contact details and education or employment history. Declining this choice does not prevent you from applying. Sponsors receiving information for their own recruitment are responsible for their subsequent use of it and should explain that use in their privacy notices.
We may also share relevant information where required by law or necessary to respond to a serious safety concern. This does not give sponsors general access to application or catering records.
Where a provider processes information outside the UK, the transfer needs an applicable UK adequacy decision or another permitted safeguard. You can contact us for details of the destinations and safeguards used for your information.
Cookies and sign-in
The website uses cookies to keep you signed in, protect forms and complete provider sign-in. Sign-in sessions normally last up to seven days; temporary provider sign-in cookies last up to ten minutes. The form-security cookie lasts for the browser session. Blocking these cookies may prevent those features from working.
A separate cookie remembers your last successful sign-in method for up to 180 days. It records the method, not your name or email address. You can clear it using “Forget this hint” on the sign-in page. A later successful sign-in records the method again. Your account also keeps its 20 most recent successful sign-ins so you can review recent access.
The current website does not load advertising or analytics tracking code. Links to external websites, including sign-in providers, are subject to those websites’ own cookie and privacy information.
How long we keep information
We keep information only for as long as it is needed for the purposes described here. For applications, CVs and attendance details, this includes reviewing applications, running the event and resolving outstanding questions or travel claims. Catering and support details are needed for the relevant arrangements and any issues arising from them.
Account and security records are needed while you use the service and to investigate misuse. Subscription records are needed while you receive updates, with a limited record retained where necessary to respect an unsubscribe request. A longer period may be needed for a legal obligation or an unresolved complaint or claim.
When information is no longer needed, it should be deleted or anonymised, including organiser exports. Backup copies must follow their own deletion cycle. You can contact us to ask about the retention period applying to your information or request earlier deletion.
Your data protection rights
Depending on the information and why we use it, you can ask us to:
- provide a copy of your personal information and explain how it is used;
- correct inaccurate or incomplete information;
- delete information we no longer have a reason to keep;
- restrict how we use information; or
- provide information in a portable format where that right applies.
You can object to processing based on legitimate interests. You can always object to direct marketing.
Where we rely on consent, you can withdraw it at any time. Use the unsubscribe link in an update email, change your CV-sharing choice while your application is editable, or contact hello@hacktheburgh.com. Withdrawal does not affect the lawfulness of earlier use. If information has already been shared, we will explain who received it and help you direct your request to them. Withdrawing consent for a particular arrangement may mean we can no longer provide that arrangement.
To exercise your rights, email hello@hacktheburgh.com. We may need to check your identity. We will respond without undue delay, normally within one month. If a permitted extension or clarification changes that deadline, we will explain why and when you can expect a response. Some rights have exceptions; we will explain any that apply to your request.
How to complain
If you have concerns about our use of your personal information, email hello@hacktheburgh.com. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and explain the outcome.
You can also complain to the Information Commissioner’s Office. The ICO’s helpline is 0303 123 1113 and its postal address is Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this notice
Updates will be published on this page. If we introduce a new use of your information, such as event photography or recording, we will explain it before that use begins and seek consent where required.
Last updated 14 September 2026.