Privacy policy

Who is responsible

The association Gervigreindarkeppni Íslands, reg. no. (kennitala) 470826-1420, Hléskógar 26, 109 Reykjavík, Iceland, is the controller. The association's chair handles privacy matters and answers questions and requests sent to contact@gki.is.

We have not appointed a data protection officer because we are not required to. We are not a public body, we do not carry out large-scale systematic monitoring of people, and we do not process special categories of personal data.

What we collect and why

• Account: name, email, password (stored as a hash, never as text) and university or division. To create your account, sign you in and contact you about the competition. If you sign in with Google (open division only), we store your Google account's ID and its email address to link it to your account.
• Optional profile details: LinkedIn URL, Discord username, short bio, birth year and profile picture. You decide whether to fill them in.
• Teams and participation: team name, members, requests and invitations to join a team (including any message) and your competition registration. To run the competition.
• Looking for a team (optional): you can join a list of participants who are looking for a team. Only signed-in participants who are registered for the same competition and have verified their email can see the list. It shows your first name, division, university, your team's name and size if you are on a team, skills and note. It also shows your Discord username and the LinkedIn URL from your profile if you have given them. Your email address is shown only if you have confirmed that you are 18 or older, and then only to participants who are on the list themselves and have also confirmed that they are 18 or older. We record when you confirmed it. If you send an intro through the site, we email the recipient your full name, email address, division, university and note, and you get a copy. Only participants who have confirmed that they are 18 or older can send intros. We record who sent an intro to whom, to limit how many can be sent. You can leave the list at any time, and your list entry (note, skills, Discord username and age confirmation) is then deleted. Your entry is removed or hidden once your team is full, and the list is hidden once team changes close.
• Submissions: your server's address (which may be an IP address), scores, error messages and timestamps. To score solutions, publish results and handle disputes. Your server's API key travels with the submission inside a message in the evaluation queue (Microsoft Azure Service Bus), and messages are encrypted at rest. The message is deleted once the submission has been evaluated. If evaluation fails repeatedly, or the message is not picked up within 14 days, it moves to a separate dead-letter queue and stays there until organizers delete it. We plan to store the key separately instead, encrypted, so that it becomes unusable after 24 hours.
• Passkeys: the public key, device name and when it was last used. To confirm that a team member's account approves every submission. They are removed when you reset your password. We never receive your fingerprint, face or PIN.
• Email: verification codes, password reset links, security notices (for example when a passkey is added to your account) and competition announcements.
• Reminder list: your email address only (no name). We send at most four reminders per competition: when registration opens, about a month before, a week before and on the day it starts. Past participants receive announcements of new competitions by email. Anyone else is only added if they ask for it: with the reminder sign-up form on the website, or by answering yes to the reminder question in the survey after a competition. Registering for the competition does not add you to the list. Every email has a clear unsubscribe link. If you unsubscribe, we keep a keyed fingerprint (hash) of your email address, not the address itself, so we don't email you again.
• Prizes: prizes are usually gift cards. Otherwise the winning team gives us bank details, we invoice the sponsor, the sponsor pays, and the money goes to the team's account. If you ask for a conference ticket, we send your email address to the conference organizer only so they can deliver the ticket.
• Eligibility checks: in the university division, you confirm when you join the competition that you study at an Icelandic university. We store when you did so and which version of the text you accepted. University-division teams in contention for a prize send proof of enrollment by email to skolavist@gki.is, which only organizers can read. The proof must show your name, your school and your courses for the current semester, for example a screenshot from Ugla or a certificate of enrollment. You may hide anything else, such as your kennitala and grades. The documents are never uploaded to the website. Two organizers review them, and the website records only whether they pass. If we are in doubt whether a prize winner meets the competition's conditions, we may ask for other proof, for example a document showing name and kennitala. It is handled the same way and deleted at the same time.
• Operations and security: technical details about visits, such as the URL, browser type and approximate location (country or city) derived from the IP address. The IP address itself is not stored in these logs. It is kept only in the web server's memory to prevent abuse, is never written to disk, and is forgotten when the limit window ends (at most 61 minutes). In system logs, email addresses are only recorded as a hash.
• Fair play: we may compare account and server details to find duplicate entries. A person always reviews the results, and no decision is made automatically.
• Analytics: Google Analytics, only if you accept cookies (see below).
• Correspondence: emails you send us.

To create an account you must give your name, email and a password and choose a division (university or open). In the university division you also choose your university and use its email address. Without this information you cannot register. Everything else is optional.

Legal basis

• Contract: so you can take part under the competition rules (account, team, submissions, email and checking eligibility for prizes).
• Legitimate interests: security, preventing cheating, publishing results, keeping the competition's history so results serve as proof of achievement, and sending past participants announcements of new competitions, with an unsubscribe link in every email.
• Consent: analytics, joining the reminder list, joining the "Looking for a team" list and optional profile details. You can withdraw consent at any time.
• Legal obligation: bookkeeping records for prizes, which the Bookkeeping Act No. 145/1994 requires us to keep.

What is public

On scoreboards and team pages, including past years, anyone can see team names, members' full names, university or division, scores and rank, plus your LinkedIn URL and profile picture if you added them. The website also posts team names and scores automatically to the competition's Discord server. Your email address is never shown publicly (see also "Looking for a team" above).

Your name on a past year's final results stays, even if your account is deleted or anonymized, because results serve as proof of participants' achievements (legitimate interests). Of your personal profile, only your name stays: your LinkedIn URL and profile picture are removed. You can ask at any time to have your name removed by writing to contact@gki.is. The team name stays. The name is removed from the website, but posts already made to the public Discord server cannot be recalled.

The competition's Discord server, including the scoreboard channel, is public, and anyone can join it.

Who processes data for us

• Microsoft Azure (data centers in Sweden): website hosting, database, storage and system logs.
• Resend (data centers in Ireland): sends the website's emails.
• Google: Sign in with Google if you choose it, Google Analytics, only with your consent, and Google Workspace for emails you send us.
• GitHub (United States): hosts the website's code and runs automated workflows.
• Discord (United States): the website posts team names and scores to the competition's Discord server. If you join that server, Discord's terms also apply.

Microsoft, Google, GitHub and Resend process data for us under their data processing agreements or terms of service.

When data leaves the EEA, the transfer relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Copies of these safeguards are available from contact@gki.is.

Organizers use AI tools, such as Anthropic's Claude, in their work. We only enter aggregate figures and code into them, never personal data, not even pseudonymized data. No automated decisions with legal or similarly significant effects on you are made (GDPR Art. 22).

Conference organizers: if you ask for a conference ticket, the conference organizer receives your email address, only to deliver the ticket to you, and handles it under their own privacy policy. They receive no other data.

We do not sell personal data. Sponsors receive no data from our systems. We may show them public links that participants share themselves, such as public GitHub repositories or demo sites, and they can see the public Discord server like anyone else.

How long we keep data

• Account: until you delete it, or three years after your last sign-in. We then delete the account, or anonymize it if results are linked to it. Your name on past years' final results still stays, but your LinkedIn URL and profile picture are removed (see "What is public").
• Unverified accounts: 30 days.
• This year's scoreboard: shown while the competition runs. When it ends, the final results are kept like past years' final results (see the next item).
• Final results of past years (team names, names and scores): kept permanently as proof of achievement and part of the competition's history, even if the account is deleted or anonymized. You can ask to have your name removed (see "What is public").
• Technical submission details (server address and error messages): three years after the competition ends.
• Reminder list: until you unsubscribe, but at most three years after you last took part or joined the list.
• Bookkeeping records for prizes (bank details and invoices): seven years from the end of the financial year, as the Bookkeeping Act No. 145/1994 requires.
• Proof sent for eligibility checks (emails and attachments) and the organizers' review of each member: deleted at the latest 30 days after the award ceremony. After that we keep only whether the team was verified. Your confirmation of study when you joined stays with your competition registration.
• System logs: 30 days. Visit data in our monitoring system: 90 days.
• Database backups: the database can be restored to any point in the last 7 days. Weekly backups are kept for 4 weeks and monthly backups for 12 months. Deleted data may therefore remain in backups for up to 12 months, but backups are only used to restore the system.
• Google Analytics: two months.

Cookies and browser storage

Necessary (no consent needed): sign-in (aicomp_token, aicomp_user), language, your cookie choice (gki_analytics_consent) and similar keys for forms and pop-ups. These are stored in your browser.

Optional: Google Analytics cookies (_ga, _ga_*), only if you choose "Accept". They measure how the site is used and how our ads perform.

You can change your choice at any time, as easily as you made it, with the "Cookie settings" link at the bottom of the main pages of the site.

Cookie settings

Your rights

• To access your data and get a copy.
• To have incorrect data corrected. You can change most of it on your profile page.
• To have your data deleted. You can ask for your account to be deleted or anonymized by writing to contact@gki.is. When the option is available, you can also delete your account on your profile page. If submissions were made from your account, the results stay, and we anonymize the account instead of deleting it. Your name on past years' final results stays unless you also ask for it to be removed. When we handle an erasure request, we ask whether you also want your name removed.
• To object to processing based on legitimate interests, or to have it restricted.
• To receive your data in a machine-readable format.
• To withdraw consent at any time.

Send requests to contact@gki.is. We reply within one month.

If you think we handle your data wrongly, you can complain to Persónuvernd, the Icelandic Data Protection Authority: personuvernd.is

Minimum age

To take part in the 2027 competition or later, you must turn 18 during the competition year. For the 2027 competition, that means you were born in 2009 or earlier. You confirm this yourself by accepting the competition rules when you register.

From the 2027 competition onward, we do not knowingly accept registrations from people under the age limit. If we learn that a participant in the 2027 competition or later is under the limit, we remove their competition registration and delete their account, or anonymize it if past years' results are linked to it.

The 2026 competition had no minimum age, so accounts and results from it may belong to people under 18. Past results stay as described in "What is public". Anyone who was under 18 in 2026 can ask at any time to have their name removed from past results by writing to contact@gki.is.

Changes

We update this page when our processing changes and announce major changes on the website or by email.