MLH and your personal information
HackTheBurgh works with Major League Hacking (MLH). Before routinely sharing registration or project details with MLH, we will explain how they will be used and ask you to accept the separate MLH agreements. Earlier agreement to our policies does not cover this sharing. The MLH Privacy Policy governs MLH’s handling of information it receives; the DEV Privacy Policy applies to DEV services. This notice continues to govern CompSoc’s handling of your information. Your legal data protection rights still apply.
This privacy notice tells you what to expect us to do with your personal information when you use the HackTheBurgh XIII website or take part in the event. CompSoc, the University of Edinburgh’s technology society, organises HackTheBurgh and is responsible for this information as its data controller.
Contact details
For questions, requests or complaints about your personal information, email hello@hacktheburgh.com.
What information we collect, use, and why
We collect or use the following information to receive applications and organise the event:
- Account details: your first and last name, email address, verification status and a securely hashed password when you use password sign-in.
- Application details: your name, pronouns, university, year of study, university email, country, CV, GitHub and portfolio links, experience, project interests and travel requirements.
- Eligibility and application records: your age and student declarations, application status, and the agreements and sharing choices you submit.
- Registration details: age, phone number, country of residence and level of study where requested for event registration, together with your MLH agreements and marketing preferences.
- Participation details: team membership, project submissions, dietary requirements, T-shirt size, meal choices and answers to event forms.
- Event updates: your name, email address and subscription preferences when you register interest.
- Service records: sign-in methods and times, account security records, email delivery records and information needed to prevent abuse and investigate technical problems.
- Conduct and competition records: reports, relevant evidence, investigation outcomes and restrictions needed to respond to concerns and safeguard the event.
Required fields are marked with an asterisk. Without the details needed to assess your application or organise your attendance, we may be unable to provide the relevant service. Please do not include information about other people in applications or projects without their permission, except where reasonably needed to report a concern.
We use these records to review applications, communicate decisions, organise teams and projects, arrange catering and clothing, handle travel requests, answer queries and keep the website secure. Organisers make application decisions; the website also checks required answers, eligibility criteria and deadlines.
Where we get personal information from
Most information comes directly from you. We also create records when you use the website, and organisers record application decisions and event administration.
If you continue with Discord, GitHub, Google or Microsoft, we receive the account identifier and available profile and email details needed to sign you in. We do not receive your password for that provider. Accounts may be linked after email ownership has been established. Your provider also handles information under its own privacy notice.
Team members can see each other’s names and team membership, and share access to their team’s project. Do not put confidential information into a project intended for judging or publication.
Our lawful bases
Under UK data protection law, we must have a lawful basis for collecting and using your personal information.
- Legitimate interests: assessing applications, organising a student hackathon, providing account access, preventing misuse, responding to conduct or competition concerns and handling routine enquiries. These interests must be balanced against your rights and reasonable expectations.
- Consent: sending updates you subscribe to and sharing your CV with sponsors for recruitment. These choices are separate from applying to the event.
- Legal obligations: keeping or disclosing information where a specific legal duty requires it, including responding to data protection requests.
Health-related dietary or access requirements need your explicit consent before we use them to arrange catering or support. Please provide only the details needed for those arrangements; you do not need to provide a medical history or explain a religious belief.
Reading or acknowledging this notice does not give blanket consent to every use of your information.
Before routinely sharing registration, attendance or project information with MLH, or arranging linked-account creation, we will explain the information involved, recipients, purposes, lawful basis, retention periods or criteria, and any international-transfer arrangements. Accepting event terms does not by itself establish consent for every use of your information.
Who we share personal information with
Authorised organisers use the information needed to run the event. The website runs on servers managed by CompSoc, with access for authorised technical administrators. Google’s email service handles event correspondence, including email addresses and message contents. Caterers and support providers receive only the details needed for their arrangements. Judges receive the team and project information needed to assess submissions.
We will only send routine registration, attendance and project information to MLH once the required agreements have been recorded and the sharing arrangements explained. This includes the people named in team submissions. Registration exports will be limited to the agreed event-registration information and your recorded choices. This may include your name, email, school, age, phone number, country of residence and level of study, together with attendance and check-in information. MLH uses this for event administration, rankings, checks for prior confirmed conduct or cheating violations, and MLH/DEV administration, including linked-account creation.
Where applicable, project exports include the project title and description, team members’ names, emails and schools, project or code links, technologies, prize categories and results. We do not add CVs, dietary or access requirements, passwords or account-security records to routine exports.
The MLH registration agreement covers the MLH Contest Terms and Conditions and MLH Privacy Policy. The choice to receive MLH and DEV marketing through this registration is separate and optional. We will record and pass on your choice with the agreed registration details. Declining marketing does not prevent you from taking part; necessary event and account messages are separate from marketing. These permissions are separate from CV sharing with sponsors.
We share your CV with event sponsors for recruitment only if you agree. A CV may itself contain your contact details and education or employment history. Declining this choice does not prevent you from applying. Sponsors receiving information for their own recruitment are responsible for their subsequent use of it and should explain that use in their privacy notices.
We share the information needed to investigate conduct or competition concerns with the MLH representative and relevant MLH incidents or cheating team, separately from routine registration exports. We only share what is needed for the case and must meet any additional legal requirements for sensitive information. We may also share relevant information where required by law or necessary to protect someone’s safety. This does not give sponsors general access to application or catering records.
Where a provider processes information outside the UK, the transfer needs an applicable UK adequacy decision or another permitted safeguard. You can contact us for details of the destinations and safeguards used for your information.
Photography and recording
Organisers and MLH may photograph or record the event for coverage and promotion, including on websites and social media. Before photography or recording begins, we will explain how to indicate your preferences, which photographers must respect, and seek consent where required. Speak to an organiser if you do not wish to be included or have a concern.
Cookies and sign-in
The website uses cookies to keep you signed in, protect forms and complete provider sign-in. Sign-in sessions normally last up to seven days; temporary provider sign-in cookies last up to ten minutes. The form-security cookie lasts for the browser session. Blocking these cookies may prevent those features from working.
A separate cookie remembers your last successful sign-in method for up to 180 days. It records the method, not your name or email address. You can clear it using “Forget this hint” on the sign-in page. A later successful sign-in records the method again. Your account also keeps its 20 most recent successful sign-ins so you can review recent access.
A cookie remembers that the application deadline reminder has appeared, so it is not repeated for 12 hours. It contains no account details. You can clear or block it through your browser’s cookie settings.
The current website does not load advertising or analytics tracking code. Links to external websites, including sign-in providers, are subject to those websites’ own cookie and privacy information.
How long we keep information
We keep information only for as long as it is needed for the purposes described here. For applications, CVs and attendance details, this includes reviewing applications, running the event and resolving outstanding questions or travel claims. Catering and support details are needed for the relevant arrangements and any issues arising from them.
Account and security records are needed while you use the service and to investigate misuse. Subscription records are needed while you receive updates, with a limited record retained where necessary to respect an unsubscribe request. A longer period may be needed for a legal obligation or an unresolved complaint or claim.
When information is no longer needed, we will delete or anonymise it, including organiser exports. Backup copies must follow their own deletion cycle. You can contact us to ask about the retention period applying to your information or request earlier deletion. MLH and DEV are responsible for their own retention under their privacy policies. Their records remain under their control; we can help you direct requests to them.
Your data protection rights
Depending on the information and why we use it, you can ask us to:
- provide a copy of your personal information and explain how it is used;
- correct inaccurate or incomplete information;
- delete information we no longer have a reason to keep;
- restrict how we use information; or
- provide information in a portable format where that right applies.
You can object to processing based on legitimate interests. You can always object to direct marketing.
Where we rely on consent, you can withdraw it at any time. Use the unsubscribe link in an update email, change your CV-sharing choice while your application is editable, or contact hello@hacktheburgh.com. Withdrawal does not affect the lawfulness of earlier use. If information has already been shared, we will explain who received it and help you direct your request to them. Withdrawing consent for a particular arrangement may mean we can no longer provide that arrangement.
To exercise your rights, email hello@hacktheburgh.com. We may need to check your identity. We will respond without undue delay, normally within one month. If a permitted extension or clarification changes that deadline, we will explain why and when you can expect a response. Some rights have exceptions; we will explain any that apply to your request.
How to complain
If you have concerns about our use of your personal information, email hello@hacktheburgh.com. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and explain the outcome.
Complaints about MLH’s handling of your information
For questions or complaints about MLH’s use of your personal information, contact hi@mlh.io, as set out in the MLH Privacy Policy.
You can also complain to the Information Commissioner’s Office. The ICO’s helpline is 0303 123 1113 and its postal address is Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this notice
Updates will be published on this page. We will explain material changes and new uses of your information before they begin, and seek new agreements or consent where required. Previous acknowledgements do not authorise additional sharing or marketing.
Acknowledgements
Related policies and agreements:
Last updated 7 October 2026.