Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for your personal data is Esports World Cup Foundation, Riyadh, Kingdom of Saudi Arabia. For any question or request regarding your personal data, contact us at support@hemmtk.com.

2. Scope of This Policy

This Policy applies to all users of the Platform, whether you access it through our website or our mobile applications, including accreditation applicants and visitors, organization representatives, and authorized operators such as reviewers, printers, and gate/scanning personnel.

This Policy does not cover third-party websites, applications, or services that we do not control, even where they are linked from or integrated with the Platform.

3. Information We Collect

Information you provide to us

• Account and profile data: your name, email address, phone number, username, password/credentials, and language preference.
• Accreditation application data: full name, date of birth, nationality, country of residence, job title, organization or affiliation, and the accreditation category you request.
• Government identification data: passport number and expiry date, national ID number, residency (Iqama) number, visa type, and work-permit details.
• Identity and travel documents you upload: passport copy, national ID copy, visa copy, residency copy, work permit, and flight ticket / arrival details.
• Badge photograph: a facial photograph used to produce and verify your credential.
• Emergency contact: name and phone number of the person you nominate.
• Dietary requirements and any special-assistance or health-related information you choose to provide.
• Any other information you submit through forms, uploads, or correspondence with us.

Information collected automatically

• Device and technical data: device type, operating system, application version, browser, language, and IP address.
• Usage and log data: screens or pages viewed, actions taken, timestamps, and error/diagnostic logs.
• Cookies, tokens, and local storage: your authentication token, session data, and display/language preferences (see the Cookies section below).

Access-control and credential data

• The zones and accreditation categories assigned to you.
• Access events recorded when your badge or QR code is scanned at Event gates and checkpoints, including the gate/location and the date and time of each scan.
• Vehicle pass details, where a vehicle pass is issued to you.

Information from other sources

• From your organization or its appointed representative, who may register you and submit accreditation information on your behalf.
• From Event organizers, partners, and authorized operators who process your application.
• From competent government and security authorities in connection with identity verification, visas, and security clearance.

4. Device Permissions (Mobile Apps)

Our mobile applications may request the following device permissions. We request them only for the purposes described and only when needed:

• Camera — to scan QR codes and badges (for example at gates, for badge collection, and for vehicle-pass checks) and, where you choose, to capture a badge photograph. We do not record audio or video.
• Photos / Media / Files (storage) — to let you upload a badge photo and identity or travel documents from your device.
• Notifications — where enabled, to send you status updates about your accreditation.

You can grant or withdraw these permissions at any time through your device settings. Some Platform features may not work correctly if a required permission is withheld.

5. Sensitive and Special-Category Data

Some of the data we process — including government identification documents, your facial photograph, and health-related information such as dietary requirements or special-assistance needs — may be treated as sensitive personal data under applicable law. We collect and process such data only where necessary for accreditation, identity verification, safety, and access control, and, where required, on the basis of your explicit consent. We apply additional safeguards to this data.

6. How We Use Your Personal Data

We use your personal data to:

• create and manage your account and verify your identity;
• receive, review, approve, reject, or request changes to accreditation applications;
• produce, issue, print, and reissue badges and credentials, including the QR code and badge photograph;
• control and monitor access to Event venues and zones, and record access events for safety and security;
• issue and manage vehicle passes;
• communicate with you about your application, credential, and the Event, including notifications and emails;
• ensure safety and security, prevent fraud and credential misuse, and investigate incidents;
• comply with legal, regulatory, visa, immigration, and security requirements, and respond to lawful requests from authorities;
• operate, maintain, secure, and improve the Platform, including troubleshooting and analytics; and
• enforce our Terms and protect our rights and the rights of others.

Our legal bases for processing under the Saudi Personal Data Protection Law (PDPL) and other applicable laws include: the performance of, or steps prior to, a contract (your accreditation); your consent, which you may withdraw at any time; compliance with a legal obligation; the protection of vital interests and public safety and security; and our legitimate interests (and those of the Event organizers) in operating a safe, secure, and well-managed Event, balanced against your rights and freedoms.

7. How We Share and Disclose Your Data

We do not sell your personal data. We share it only as described below:

• Event organizers, the Foundation's relevant teams, and authorized operators, reviewers, printers, and scanning personnel, to process your accreditation and manage access;
• your sponsoring organization or its representative, in relation to the accreditation managed on your behalf;
• venue operators and security or law-enforcement personnel, for access control, safety, and security at the Event;
• government, regulatory, immigration, and security authorities, where required for visas, security clearance, or by law;
• service providers and sub-processors who act on our behalf (for example cloud hosting and object storage, email/notification delivery, and IT support) under appropriate confidentiality and data-protection obligations;
• professional advisors, such as lawyers and auditors, where necessary;
• an acquirer or successor in the context of a reorganization, merger, or transfer of all or part of our operations; and
• any other party with your consent or where required or permitted by law.

8. International Data Transfers

The Event takes place in the Kingdom of Saudi Arabia and your data is primarily processed there. Because participants come from many countries and some of our service providers may operate outside the Kingdom, your data may be transferred to, stored in, or accessed from other countries. Where we transfer personal data across borders, we take steps to ensure an appropriate level of protection in accordance with the Saudi PDPL and other applicable laws.

9. Data Retention

We keep your personal data only for as long as necessary for the purposes set out in this Policy, including for the duration of the Event and for a reasonable period afterwards, and for any longer period required to comply with legal, regulatory, security, audit, or accounting obligations or to resolve disputes. When data is no longer required, we securely delete or anonymize it. Access logs and security records may be retained for longer where needed for safety and legal purposes.

10. How We Protect Your Data

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These include role-based access controls, encryption of data in transit, secure authentication, and access on a need-to-know basis. No system is completely secure, and we cannot guarantee absolute security; you are responsible for keeping your account credentials confidential.

11. Your Rights

Subject to applicable law (including the Saudi PDPL), you have the right to:

• be informed about how your personal data is processed;
• access the personal data we hold about you and obtain a copy;
• request correction of inaccurate or incomplete data;
• request deletion of your data in certain circumstances;
• withdraw your consent at any time, without affecting processing carried out before withdrawal;
• object to, or request restriction of, certain processing; and
• where applicable, request transfer (portability) of data you provided.

Account and data deletion: You may request deletion of your account and associated personal data at any time by contacting us at support@hemmtk.com. Please note that we may need to retain certain information to comply with legal obligations, for security, or to complete the accreditation process, and that deleting your account may prevent the issuance or use of your accreditation.

To exercise any of these rights, contact us using the details in the "Contact Us" section. We may need to verify your identity before responding. You also have the right to lodge a complaint with the competent supervisory authority — in the Kingdom of Saudi Arabia, the Saudi Data & Artificial Intelligence Authority (SDAIA).

12. Children's and Minors' Privacy

The Platform is intended primarily for adults. Some Event participants (for example competitors) may be minors. Where a minor is accredited, their application must be submitted and consented to by a parent, legal guardian, or an authorized representative of their organization, who is responsible for the information provided. We process minors' data only as necessary for accreditation and with appropriate safeguards. If you believe we have collected a minor's data without proper authorization, please contact us so we can take appropriate action.

13. Cookies and Local Storage

The Platform uses cookies and similar technologies (including browser local storage) that are strictly necessary to operate — for example, storing your authentication token to keep you signed in and remembering your language and display preferences. We do not use the Platform for third-party advertising. You can control cookies through your browser settings, but disabling strictly necessary cookies may prevent the Platform from working.

14. Automated Decision-Making

Accreditation decisions are reviewed by authorized personnel. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement.

15. Third-Party Links and Services

The Platform may contain links to, or rely on, third-party websites and services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

16. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Platform after the changes take effect constitutes acceptance of the updated Policy.

17. Contact Us

If you have questions, requests, or complaints about this Policy or your personal data, contact us at:

• Esports World Cup Foundation
• Email (privacy): support@hemmtk.com
• Address: Riyadh, Kingdom of Saudi Arabia