Privacy Notice

Code 2.1Who we are and what this notice covers#

This Privacy Notice explains how XMC (we, us, our) collects and uses personal data on thexmc.org and thexmc.com. XMC is the controller of that data. [Legal entity and address to be added.] You can contact us at official@thexmc.com.

Code 2.2The laws we follow#

We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (UK), and the Personal Data (Privacy) Ordinance (Cap. 486) and its six Data Protection Principles (Hong Kong). Where the two differ, we aim to meet the stricter standard.

Code 2.3Personal data we collect#

Account data: your username, email address, a salted hash of your password (never the password itself), your account status, and the dates you registered and confirmed your email.

Ticket data: the category, subject and messages of the Tickets you send, including the position you apply for and anything you tell us about yourself in an application.

Technical data: your IP address, browser and device information, and security logs, which our hosting provider Cloudflare records to deliver and protect the Sites.

Code 2.4Where the data comes from#

Mostly from you, when you register, sign in or send a Ticket. Technical data is collected automatically when you use the Sites. We do not buy personal data.

Code 2.5Why we use your data, and our legal bases#

To create and run your Account, and to approve it: providing the service you asked for (UK GDPR Article 6(1)(b)) and our legitimate interest in protecting our community from duplicate or false Accounts (Article 6(1)(f)).

To answer Tickets and consider applications: providing the service, or taking steps you ask for before any agreement (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)).

To keep the Sites secure and prevent abuse (Article 6(1)(f)), and to meet legal duties (Article 6(1)(c)). If we ever rely on consent (Article 6(1)(a)), we will ask first, and you can withdraw it at any time. In Hong Kong terms, we collect data only for a lawful purpose directly related to our activities, and use it for the purposes we tell you about (Data Protection Principles 1 and 3).

Code 2.6Children#

You must be 13 or older to create an Account, which is the age set for consent to online services by section 9 of the Data Protection Act 2018. We follow the Information Commissioner's Age Appropriate Design Code (the Children's Code) and the guidance of the Hong Kong Privacy Commissioner for Personal Data (PCPD) on children's data. We collect as little data as we can. If you are under 18, please involve a parent or guardian in decisions about your data.

Code 2.7Who we share data with#

We do not sell personal data. We use service providers to run the Sites: Cloudflare for hosting, network security and our database, and, if email confirmation is switched on, an email delivery provider. They process data for us under their own terms. Only authorised XMC members can see Account and Ticket data, and only as their role and access level allow. We may disclose data if the law requires it or to protect someone's safety.

Discord and Telegram are separate services with their own privacy policies.

Code 2.8Transfers outside the UK and Hong Kong#

Cloudflare operates a global network, so data may be processed in other countries. Where UK law requires, we rely on adequacy regulations or on approved safeguards such as the UK International Data Transfer Agreement or Addendum. As far as we are aware, section 33 of the Personal Data (Privacy) Ordinance on cross-border transfers is not yet in operation in Hong Kong, but we follow the PCPD's guidance on cross-border transfers as good practice.

Code 2.9How long we keep data#

[These periods are proposals to be confirmed.] Account data is kept while your Account exists. Rejected or unconfirmed Accounts are deleted after 90 days. Tickets are kept for 24 months after they are closed, then deleted. Email confirmation links expire after 72 hours. Security logs are kept for as long as our hosting provider's settings keep them. If you ask us to delete your Account, we delete your Account data, and we keep only what the law requires.

Code 2.10How we keep data safe#

Passwords are stored only as salted PBKDF2 hashes. The Sites use HTTPS, sessions last 8 hours, new Accounts need approval, and sign-in attempts are slowed down and can be rate-limited. Access is limited by role and access level. No system is perfectly secure, but we take reasonable steps as required by Article 32 of the UK GDPR and Data Protection Principle 4 of the PDPO.

Code 2.11Your rights under UK law#

You have the right to be informed, to access your data, to have it corrected or erased, to restrict or object to its use, to receive it in a portable form, and to withdraw consent. We do not make decisions about you based only on automated processing. We aim to reply within one month.

Code 2.12Your rights under Hong Kong law#

You may make a data access request (section 18 of the PDPO) and a data correction request (section 22). We will comply with a valid request within 40 days, as section 19 requires.

Code 2.13Cookies and browser storage#

We use only what is strictly necessary: a secure, HttpOnly sign-in cookie called xs; your language choice in local storage (xl); and a short-lived flag in session storage that stops the loading animation repeating. We do not use advertising or analytics cookies. Strictly necessary cookies are exempt from consent under regulation 6 of the Privacy and Electronic Communications Regulations 2003.

Code 2.14Direct marketing#

We do not send marketing messages. If that changes, we will follow the Privacy and Electronic Communications Regulations 2003 (UK) and the Unsolicited Electronic Messages Ordinance (Cap. 593) (Hong Kong), and ask for your consent first.

Code 2.15Data breaches#

If a breach is likely to put people at risk, we will tell the Information Commissioner's Office within 72 hours where the UK GDPR requires, tell the PCPD where appropriate, and tell the people affected.

Code 2.16Complaints and regulators#

Please contact us first at official@thexmc.com. You can also complain to the Information Commissioner's Office in the UK (ico.org.uk) or to the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk). [Whether we must register with the ICO or pay a data protection fee is to be confirmed.]

Code 2.17Changes to this notice#

We may update this notice. The version and date at the top show when it last changed, and we will tell Members about big changes.

Code 2.18Contact#

Email official@thexmc.com, or open a Ticket in your Dashboard.