Privacy Policy

This policy explains what we collect when you register for an event through this site, why each piece is needed, who else sees it, and what you can ask us to do with it. It is written to meet the Personal Data Protection Act 2010 (PDPA).

Smart Digital Creative Management & Resources is the data user. Our details are at the bottom of this page.

What we collect

We only collect what a registration form actually asks for. Nothing is bought from a third party and nothing is gathered from other websites.

About each person registering

• Full name and identity card number
• Date of birth and gender
• Race, where an event or its funder requires it to be recorded
• Email address and phone number
• Address, postcode, city, state and country
• Emergency contact name and phone number
• In‑game name and player or server ID, for esports events

About a team

• Team name and team logo, if you upload one
• Which role each person holds in the team, such as player or manager

About a payment

• The amount charged, and any add‑ons chosen
• The reference our payment gateway gives the transaction, and its status

We never see or store your card number. Card details are entered on our payment gateway's own page, not on ours. What comes back to us is a reference and a result.

Collected automatically

• The IP address a registration was submitted from, and the IP address a marketing consent was given from
• The date and time a marketing consent was recorded

These exist so that a disputed entry or a disputed consent can be traced back to when and where it was given.

Sensitive personal data

Under the PDPA, some of the above counts as sensitive personal data and needs your explicit consent, not merely your implied consent. That applies to your identity card number and to race.

By submitting a registration form you give that explicit consent for the purposes listed below. If you would rather not give it, contact us before registering and we will tell you whether the event can accept an entry without it. Some cannot, because the organiser or the funder requires the field.

Why we need it

• To register you and admit you. Names and identity card numbers are checked at the venue so that the person who competes is the person who entered.
• To confirm eligibility. Age brackets, categories and residency rules are checked against date of birth and address.
• To take payment and to issue a refund if one is due.
• To contact you about the event you entered, including changes to schedule or venue.
• To reach someone if you are hurt, using the emergency contact you gave.
• To run the competition, including draws, fixtures, scoring and standings.
• To report to an organiser, sponsor or funding body where an event is run on their behalf.
• To meet legal and accounting duties.

What is shown publicly

Results pages, rankings and the Hall of Fame on this site show competitor and team names, and their standings. They do not show identity card numbers, addresses, contact details, dates of birth, gender, race or emergency contacts.

Expect your name and your team name to be public if you compete. That is the nature of a published result.

Marketing messages

We send marketing email and text messages only to people who ticked the marketing consent box. We record when you gave that consent and the IP address it came from, so we can show it was given.

Every marketing email carries an unsubscribe link. Using it stops marketing immediately. It does not stop messages about an event you have actually entered, because those are part of delivering what you paid for.

Tracking inside marketing email

Our marketing email contains a small invisible image and rewritten links. Together they tell us whether a message was opened and which links were pressed, which is how we judge whether a campaign was worth sending. This applies to marketing email only.

Blocking images in your mail program stops the open tracking. Neither method reveals anything about you beyond your dealings with that message.

Who else sees your data

We do not sell your personal data. We do not rent or trade it. It is shared only where sharing is necessary:

• Our payment gateway, CHIP, to take a payment or return one.
• Our email and SMS providers, to deliver messages we send you.
• The organiser, sponsor or funding body of an event you entered, where we run that event on their behalf.
• Venue operators and officials, to the extent needed to admit you and run the competition.
• Authorities, where the law requires it.

Some of these providers process data outside Malaysia. Where that happens we satisfy ourselves that the transfer is permitted under the PDPA and that the provider is bound to protect it.

How long we keep it

Registration and participant records are kept for as long as needed to run the event and to deal with anything arising from it, such as a dispute over a result or a refund.

Records that form part of our accounts, including payment records, are kept for seven years, because Malaysian tax law requires business records to be retained for that period.

Published results, rankings and Hall of Fame entries are kept indefinitely. A record of who won is not meaningful if it is deleted.

Your rights

Under the PDPA you may ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong or out of date
• Stop using it for marketing
• Limit how we use it, where the law allows
• Withdraw a consent you previously gave

Write to the address at the bottom of this page. We will ask you to confirm who you are before we release anything, so that one person cannot obtain another person's details, and we aim to reply within 21 days.

Withdrawing consent can mean we are no longer able to keep you in an event you entered. Where that is the case we will tell you before acting, and the refund policy applies as it would to any other withdrawal.

Keeping it safe

This site is served over an encrypted connection. Access to registration data is restricted to accounts that need it, and each account only sees the parts its role allows. Actions taken inside our admin area are logged.

No system is perfect. If a breach occurs that puts you at real risk, we will tell the people affected and explain what happened.

Children

Some events admit competitors under 18. Where that is so, the entry must be made or approved by a parent or guardian, and the emergency contact must be an adult who can be reached during the event. We do not send marketing messages to anyone we know to be under 18.

Changes to this policy

If we change this policy we will move the date at the top of the page. Where a change materially affects how we use data you already gave us, we will contact registered participants rather than rely on you noticing.