Privacy policy
Helping Station DEU is run by students for students. We collect the minimum needed to run a safe event, we do not sell or share anything with sponsors, and you can ask us to delete your data at any time.
Last updated 1 March 2026 · Contact helpingstation@deu.ac.kr
Who can see what
- YouYour own registration, participation status and any prizes you have won. Nothing more.
- The event organiserThe details they need to run a safe event. Access to individual full records is logged.
- Any visitorYour entry number, and a masked name only if you opted in. Never your e-mail, phone, student ID or full name.
- Nobody elseNo sponsors, no advertisers, no analytics or advertising third parties, no data brokers.
What we collect, and why
Every field below is asked for on the registration form. If a field is optional it says so on the form, and leaving it blank never affects your participation.
| Field | Why we need it | Basis |
|---|---|---|
| Full name | To check you in on the day and to know who is on site. | Performance of a contract (participation) |
| University e-mail address | To confirm you are a student, to send your entry number, and to let you sign in to check your status. | Legitimate interest (running the event) |
| Student ID | To verify student status and, if you win, to hand over a prize to the right person. | Legal obligation (event compliance) |
| Department | To place you in a balanced activity team. Never published. | Legitimate interest (running the event) |
| Phone number | For on-the-day safety and emergencies. | Legitimate interest (health and safety) |
| Emergency contact name and number | To be able to reach someone quickly if something happens during the event. | Legitimate interest (health and safety) |
| Consent flags | To record what you agreed to, and to prove we recorded it. | Consent |
What we never collect
- Photographs or video of you
- Your location or movements during the event
- Payment details — participation is free
- Marketing profiles, advertising IDs or third-party trackers
- Your device fingerprint beyond a salted hash of your IP address used for rate limiting
How long we keep it
- Registration records are kept for up to 180 days after the event, then anonymised. Anonymised records keep only a statistical entry number and status — they cannot be traced back to you.
- Audit logs of organiser actions are kept for 12 months. They contain entry numbers and action names, never names, e-mails or phone numbers.
- Login attempt records are kept for 30 days and store a salted hash of your IP address, never the address itself.
- Prize and claim records are kept for 3 years where tax or accounting rules require it.
Want it gone sooner? Email helpingstation@deu.ac.kr with the subject “Data deletion request”. We will confirm within 7 days. Deleting your data before the draw removes your entry, so do it before the event if you are not coming.
How it is protected
Passwords are hashed
Passwords are stored as bcrypt hashes. Nobody — including the organiser — can read them.
Sessions are signed
Sign-in uses signed, HTTP-only, secure cookies. Session contents are not readable by scripts.
Transport security
The site is served over HTTPS only, with a strict content security policy and security headers.
Rate limiting
Sign-in and registration are rate limited to stop bulk scraping. Only a salted hash of an IP address is kept.
Separated draw data
The draw runs against a frozen, hashed snapshot rather than the live registration table, so no one can add themselves in.
Access is logged
Opening a participant's full record in the admin area is written to the audit log.
Your rights
You can ask what we hold about you, ask for a copy, ask us to correct it, or ask us to delete it. We will not ask why, and we do not make it difficult.
Read the participation rules to see what the draw does and does not do with your data.