docs/privacy-policy.md

FormulaOne AI Coding Challenge - Privacy Notice v1.2
Last updated: 6 Aug 2025

1. Controller
FormulaOne Team, <legal entity and address>
Contact: privacy@formulaone-ai.org

2. Data We Collect
- GitHub or Hugging Face username and public profile ID
- Email address (if supplied via OAuth)
- Uploaded Submission files, compile/runtime logs, numeric scores
- IP address and browser telemetry for security and rate limiting

3. Purposes and GDPR Legal Bases

| Purpose                                      | Legal basis (GDPR)            |
|----------------------------------------------|-------------------------------|
| Evaluate and rank submissions                | Contract (6(1)(b))            |
| Site security and abuse prevention           | Legitimate interests (6(1)(f))|
| Academic, non-commercial research on models  | Legitimate interests (6(1)(f))|
| Contacting participants about results/collab | Legitimate interests (6(1)(f))|


4. Public Disclosure
Your display name, score and rank appear on a public leaderboard.
You may use a pseudonym.
5. Data Sharing
Processors: Hugging Face Inc., GitHub Inc., <cloud host> - under
written contracts.
Independent controllers: GitHub and Hugging Face regarding your
platform accounts.
6. International Transfers
Where data moves outside the EEA/UK, we rely on EU Standard
Contractual Clauses or adequacy decisions.
7. Retention
- Leaderboard entries: indefinitely.
- Raw submission files and logs: up to 5 years, then deleted or
anonymised.
- Security logs: 12 months.
8. Your Rights
Access, correction, erasure, restriction, portability, and
objection. Contact us at the address above.
You may lodge a complaint with your supervisory authority.
9. Security
Submissions run in network-restricted containers. Access is limited
to authorised staff using multi-factor authentication.
10. Cookies
If you use only GitHub and Hugging Face, their cookies apply under
their policies. If you later self-host a site for the leaderboard,
publish your own cookie notice.
11. Children
The Competition is not directed to children under 16. Do not submit
personal data if you are under 16.
12. Changes
We will post updates here and notify registered participants by
email when material.