Scope and contact
This notice covers hkaiiff.market and its account, catalogue and workspace services within the HKAIIFF ecosystem. The festival’s governing body is the Hong Kong AI International Film Festival Association. For questions about this website’s personal data, contact info@hkaiiff.org and identify HKAIIFF MARKET. A separate INDEX service or third-party partner may have its own notice; follow the notice on that service.
Information processed and why
Account data includes your email, profile and sign-in events, used to authenticate you, maintain sessions and protect the service. Organisation data includes membership, roles, invitations and contact details, used to control access and coordinate work. Project data includes descriptions, INDEX references, artwork, rights declarations and submitted materials, used to present and review works.
Enquiries, deal activity, documents, delivery records and support messages are processed to manage the requested workflow, resolve issues and preserve transaction evidence. Technical data such as IP addresses, request information, security logs and email delivery events may be processed by our infrastructure providers to deliver and protect the service. Provide only information needed for your request.
Public information and private workspaces
Published catalogue fields, approved artwork, source links and public guides are accessible to visitors and search services. Organisation and deal access controls restrict private workspace information to authorised participants and relevant operations roles. Publicity is not a safe place for personal identity documents, private contact details or confidential production files. Before submission, ensure you have authority to share information about other people.
Service providers and international processing
The service uses Supabase for authentication, database and storage, Vercel for hosting and delivery, and Resend for transactional email. They process the information necessary for their functions. Data may be processed outside your place of residence according to the configured infrastructure and provider arrangements. Payment or compute providers, when enabled for a specific transaction, may require additional information under their own terms.
We may disclose relevant information to an authorised counterparty to carry out your request, to advisers or authorities where legally required, or to protect rights and investigate misuse. Publicly displaying a project does not authorise unrestricted sharing of its private files.
Cookies, local storage and app installation
Essential session cookies support authentication. Browser storage may remember preferences and app-installation choices. The PWA service worker caches selected public app resources to support the interface. Clearing browser storage can sign you out or reset preferences. The current application does not include advertising tracking or a third-party marketing analytics SDK. External sites linked from this service control their own cookies and data use.
Retention and account closure
Information is retained while needed to provide the requested service, maintain organisational and contractual records, resolve disputes or meet applicable obligations. A closure or deletion request is reviewed by data category: profile data, public project information, shared deal evidence, security records and provider backups can require different treatment. There is no instant global deletion guarantee. We will explain any continuing need to retain information when responding to a request.
Access, correction, deletion and complaints
Write to info@hkaiiff.org from your account email, state the request and identify the relevant record. We may request proportionate identity or authority verification to avoid disclosing information to the wrong person. You may request access, correction or deletion and raise concerns about data use. Applicable rights and response periods depend on the law governing your request; nothing in this notice removes mandatory rights.
If your concern remains unresolved, you may contact the competent privacy regulator, including Hong Kong’s Privacy Commissioner for Personal Data where applicable. The service is intended for people authorised to conduct professional activities. Do not submit a child’s personal information without appropriate authority and safeguards.
Security and notice updates
Access controls and provider security measures reduce risk but cannot guarantee absolute security. Keep sign-in codes and credentials confidential, review team permissions and report suspected unauthorised access promptly. Material changes to data use require an updated notice and, where applicable, additional information or consent before that use. The review date appears on this page.