// Legal
Privacy Notice
HACKATHON HAARLEM — PRIVACY NOTICE
Controller: Digilize Agency B.V., Nassaulaan 68a, 2011 PE Haarlem, Netherlands
KvK: 96975903 | VAT: NL867857572B01
Co-organizer: The Social Club (Curiosity Connects)
Contact: info@digilize.agency
Last updated: June 2026
This Privacy Notice explains how Digilize Agency B.V. ("Organizer", "we", "us") collects and uses your personal data when you register for or attend AI Hackathon Haarlem (the "Event") on 6 June 2026 at De Koepel, SRH Haarlem. This notice is provided in accordance with Articles 13–14 of the General Data Protection Regulation (GDPR / AVG).
1. What We Collect
We collect only the personal data necessary for running the Event. This includes:
- Registration data: full name, email address, skills, and optional bio
- Team data: team name and names and email addresses of team members
- Platform account data: login credentials, Q&A submissions, mentor requests, vibe poll interactions
- Submission data: project links, code repositories, presentation decks, and build instructions
- Payment data: processed via Luma / Stripe (we do not store card details)
- Media: photographs and video recordings taken during the Event, where consent is given
- Post-event feedback: anonymous survey responses (see Section 4)
- Website analytics: anonymised usage data via Google Analytics and Microsoft Clarity, where consent is given
2. Purposes and Legal Bases
We process your personal data for the following purposes, each on the legal basis indicated:
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Registration & attendance management | Contract performance — Art. 6(1)(b) |
| Team formation | Contract performance — Art. 6(1)(b) |
| Judging, scoring & prize administration | Contract performance — Art. 6(1)(b) |
| Anti-cheating audit & submission verification | Legitimate interest — Art. 6(1)(f) (protecting competition integrity) |
| Safety & logistics | Legal obligation — Art. 6(1)(c) |
| Event archiving & portfolio | Legitimate interest — Art. 6(1)(f) |
| Photography & video for publicity | Consent — Art. 6(1)(a) ✦ |
| Future event marketing & newsletters | Consent — Art. 6(1)(a) ✦ |
| Sponsor follow-up connections | Consent — Art. 6(1)(a) ✦ |
| Website analytics (GA, Clarity) | Consent — Art. 6(1)(a) ✦ |
| Tax & financial record-keeping | Legal obligation — Art. 6(1)(c) (7-year Dutch tax obligation) |
✦ You may withdraw consent at any time (see Section 6). Withdrawal does not affect the lawfulness of processing before withdrawal.
3. Recipients of Your Data
We share your personal data only where necessary with the following categories of recipients:
- The Social Club (Curiosity Connects) — co-organizer; joint controller for event operations
- Supabase Inc. — database, authentication, and realtime infrastructure (data processor; see Section 4 for transfer details)
- Vercel Inc. — website and platform hosting (data processor)
- Luma / Stripe — event ticketing and payment processing (data processor)
- Challenge Providers (Neno Technology B.V., Altis Groep B.V., Maverx B.V.) — receive team submission data for evaluation under the evaluation license in the Terms & Conditions
- Judges & mentors — receive submission data for judging purposes
- Sponsors — only where you have explicitly opted in to share your profile via the post-event sponsor connections feature
- Public authorities — where required by law
We do not sell your personal data.
4. International Data Transfers
Our primary infrastructure provider, Supabase, stores data in the EU (Frankfurt, Germany) AWS region. Supabase Inc. is a US-based entity; where any data access occurs from outside the EEA, it is governed by Standard Contractual Clauses (SCCs) as included in Supabase's Data Processing Addendum.
Vercel Inc. and Stripe Inc. are also US-based entities operating under SCCs or the EU–US Data Privacy Framework.
No personal data is transferred to countries without an adequate level of protection without the appropriate safeguards in place.
5. Retention Periods
| Data Category | Retention Period |
|---|---|
| Registration & participant profiles | Deleted 30 days after the Event |
| Team data | Deleted 30 days after the Event |
| Submissions & code repositories | Retained indefinitely for archiving & portfolio purposes; may be deleted on request |
| Photography & video | Up to 3 years; deleted on withdrawal of consent |
| Survey responses | Anonymised immediately on submission; no personal data retained |
| Sponsor connection profiles | Sponsor access expires 30 days after the Event; data deleted on revocation of opt-in |
| Financial & payment records | 7 years (Dutch tax law — Art. 52 AWR) |
| Consent records | 5 years (to demonstrate compliance) |
6. Your Rights
Under the GDPR you have the following rights in relation to your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — request deletion of your data ("right to be forgotten"), subject to our legal retention obligations
- Restriction — ask us to limit how we use your data while a dispute is resolved
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — at any time where processing is based on consent, without affecting prior lawful processing
To exercise any of these rights, email us at info@digilize.agency. We will respond within 30 days. We may need to verify your identity before processing your request.
7. Cookies
We use cookies and similar tracking technologies on this website. All non-essential cookies (analytics and behavior tracking) require your explicit consent, which is requested via the cookie banner when you first visit the site.
| Cookie / Provider | Purpose | Consent Required |
|---|---|---|
| Google Analytics (GA4) | Anonymised page-view statistics | Yes |
| Microsoft Clarity | Session recordings and heatmaps | Yes |
| Google Consent Mode (internal) | Stores your consent choice in localStorage | No (strictly necessary) |
You can change your cookie preference at any time by clearing your browser's localStorage for this site. Ad storage is always denied. No profiling or cross-site tracking cookies are used.
8. Automated Decision-Making
We do not use any fully automated decision-making (including profiling) that produces legal or similarly significant effects on you.
9. Complaints
If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the Dutch supervisory authority:
Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl
We would, however, appreciate the opportunity to address your concern directly first — please contact us at info@digilize.agency before filing a complaint.
10. Changes to This Notice
We may update this Privacy Notice where necessary. Material changes will be communicated to registered participants by email before they take effect. The date of the most recent revision is shown at the top of this page.