Global Open-source AI Challenge Privacy Policy

1. "Personal information" means all kinds of information related to identified or identifiable natural persons recorded electronically or by other means, excluding information that has been anonymized.
2. "Sensitive personal information" means personal information that, once leaked or illegally used, is likely to cause harm to the dignity of natural persons or endanger personal or property safety, including biometric identification, religious belief, specific identity, medical health, financial accounts, location tracking, and other information, as well as personal information of minors under the age of fourteen.
3. "Personal information processor" means an organization that independently determines the purposes and methods of processing in personal information processing activities. For the Services, the Hangzhou Open Source Artificial Intelligence Foundation is the personal information processor under this Policy.
4. "Entrusted processor" means an organization that accepts the entrustment of a personal information processor and processes personal information in accordance with the entrusted contract. The executor is an entrusted processor and processes personal information strictly in accordance with our instructions.
5. "Challenge Organizing Committee" means the competition organization and coordination body composed of representatives of the host, executor, and relevant partner institutions. The Challenge Organizing Committee has not undergone independent entity registration and does not have independent legal person status. Where the Challenge Organizing Committee processes personal information due to competition organization needs, the host shall bear corresponding legal liability as the personal information processor.

We will follow the principles of lawfulness, legitimacy, necessity, and good faith, and collect your personal information only within the scope necessary to achieve specific, clear, and reasonable purposes. We will inform you of the purposes, methods, types, and retention periods for collecting personal information, and process it after obtaining your consent or another lawful basis.

1. Account Registration and Login

To help you complete registration, login, identity recognition, and account security protection, we may collect:

• Mobile phone number, country or region code, SMS verification code;
• Email address, email verification code;
• Account, password, login status, authentication Token;
• Information related to password recovery, account abnormalities, login devices, and security verification.

If you only browse public content on the official website, registration or login is usually not required.

2. Registration and Participation Management

To complete registration, participation eligibility confirmation, competition notices, and track matching, we may collect:

• Name, country or region, mobile phone number, email address;
• Information about affiliated teams, employers, schools, communities, or organizations;
• Preferred track, project name, project introduction, current progress, open-source plan;
• Team member information, person-in-charge information, contact information;
• Other information you actively submit in registration forms, questionnaires, event registrations, or communications.

Special note: The registration portal is provided with external form system services by the registration form system service provider. Such form system service provider, as an entrusted processor, collects registration information in accordance with our instructions.

3. Work Submission and Review

To organize project submission, preliminary review, semi-finals, finals, roadshows, award ceremonies, and post-competition display, we may collect:

• Project introduction, technical proposal, architecture description, Demo links, code repository links;
• Models, tools, data dependencies, third-party APIs, open-source license descriptions;
• Demo videos, images, demonstration materials, roadshow PPTs, review materials;
• Project implementation plans, commercial / social / research value descriptions;
• Review records, judges' opinions, shortlist status, award status.

Please avoid including personal sensitive information unrelated to participation, trade secrets, or unauthorized third-party data in submitted materials. If it is necessary to submit content containing sensitive personal information, please ensure that lawful authorization from the data subject has been obtained and clearly mark it when submitting.

4. Token, Compute Vouchers, and Resource Support

To distribute and manage competition resources such as Token quotas, compute vouchers, cloud resources, mentor guidance, industry matchmaking, and media exposure, we may collect:

• Account identity, registration status, track, project status;
• Resource collection records, usage records, quota balance, validity period;
• Necessary information related to partner resource distribution, verification, and use.

If relevant resources are provided by partners, we may share your project and account information with partners within the necessary scope for resource distribution, benefit verification, and service support.

5. Competition Notices, Customer Service, and Communication

To send you competition notices, important milestone reminders, review arrangements, resource collection instructions, and customer service feedback, we may use:

• Mobile phone number, email address, in-site message account;
• Information you provide when communicating with the Organizing Committee, customer service, mentors, or partners;
• Problem feedback, complaints, and consultation records.

6. Security Protection and System Operation

To ensure the secure and stable operation of the official website, accounts, registration, work submission, and competition systems, we may automatically collect:

• IP address, access time, browser type, operating system, device type;
• Page access records, click records, dwell time, source pages;
• Login logs, abnormal behavior, error logs, security incident records;
• Identification information generated by Cookies or similar technologies.

The above information is used for identity verification, risk identification, prevention of malicious registration, anti-cheating, troubleshooting, security auditing, and service optimization.

7. Data Statistics and Analysis

To understand official website visits, registration conversion, event effectiveness, and content performance, we may integrate Google Analytics, Baidu Analytics, or other statistical analysis tools. Statistical tools may collect information such as visit sources, page views, device information, region information, and dwell time. We will use de-identified or aggregated methods for analysis as far as possible.

We will strictly use your personal information on the basis of lawful grounds in accordance with the Personal Information Protection Law of the People's Republic of China and other relevant laws and regulations. Specifically, our use of your personal information follows one of the following lawful bases:

1. Purposes of Use and Lawful Bases

• Obtaining personal consent: For personal information processing activities beyond basic service functions, we will obtain your explicit consent before processing;
• Necessary for concluding or performing a contract: Processing activities necessary to complete Challenge registration, participation management, work review, award distribution, and other contract conclusion or performance obligations with you;
• Necessary for fulfilling legal obligations: Processing activities necessary to comply with obligations stipulated by laws and regulations (such as tax filing, anti-money laundering, cybersecurity, and the like);
• Responding to public health emergencies or emergencies: Necessary to protect the life, health, and property safety of natural persons;
• Public interest: Processing personal information within a reasonable scope for public interest purposes such as news reporting and public supervision.

2. Specific Use Scenarios

• Identity verification and account management: Used for registration and login, identity verification, account security management, password recovery, and other services;
• Competition organization and management: Used for registration eligibility review, track allocation, schedule arrangement, review organization, results publication, and other full-process competition management;
• Communication and notices: Used to send you important information such as competition notices, schedule changes, review arrangements, and award notifications;
• Resource distribution and management: Used for distribution, usage management, and benefit verification of competition support resources such as Tokens, compute vouchers, and cloud resources;
• Security protection: Used for system security protection, anti-cheating detection, abnormal behavior monitoring, and security incident response;
• Data analysis and improvement: Used for competition effectiveness evaluation, service optimization, and user behavior analysis (all conducted in de-identified or aggregated form);
• Legal compliance: Used to fulfill various obligations stipulated by laws and regulations, including but not limited to tax filing, financial auditing, and dispute resolution.

3. Automated Decision-Making

There are no circumstances in the Services where decisions with a significant impact on personal rights and interests are made solely through automated decision-making. If automated decision-making is involved in the future, we will explain the algorithm logic and decision-making mechanism to you in advance and obtain your separate consent.

We may use Cookies, local storage, pixel tags, or similar technologies for:

1. Identifying login status and maintaining account sessions;
2. Saving language, region, and preference settings;
3. Statistics on visits, page performance, and event effectiveness;
4. Ensuring account and system security;
5. Optimizing page loading and user experience.

You may manage or refuse Cookies through browser settings. Please note that after disabling Cookies, some functions such as login, registration, work submission, and language preferences may not work properly.

1. Sharing

We do not sell your personal information. To achieve competition service purposes, we may share your personal information with the following parties within the necessary scope:

• Challenge Organizing Committee: Members of the Challenge Organizing Committee may, within the necessary scope, access participants' registration information, project information, and contact information due to competition organization and coordination needs. As an organization that has not undergone independent registration, the Challenge Organizing Committee's personal information processing activities shall be borne by the host (Hangzhou Open Source Artificial Intelligence Foundation) for legal liability;
• Challenge Judging Panel: Judges may access project introductions, technical proposals, Demo materials, roadshow PPTs, and other review materials submitted by participating teams / contestants for work review purposes.
• Executor: As an entrusted processor of the competition, the executor processes personal information in accordance with our instructions, including but not limited to competition operation management, technical support, and participant communication. The executor shall not process personal information beyond the scope of entrustment and shall return or delete personal information as required by us after the entrustment relationship terminates.
• Technical service providers: Including registration form system service providers, cloud service providers, SMS service providers, email service providers, data statistics service providers, and the like. The above service providers, as entrusted processors, may process personal information only in accordance with our instructions and must adopt adequate security protection measures.
• Partners: Including partners for Tokens, compute vouchers, cloud resources, industry matchmaking, media dissemination, and the like. We will share your project and account information with the above partners only within the necessary and minimum scope for resource distribution, benefit verification, and service support, and require them to comply with protection measures no lower than the standards of this Policy.
• Recipients required by laws and regulations: In accordance with laws and regulations, regulatory requirements, or requirements of judicial or administrative organs, we may share your personal information with relevant government departments, judicial organs, and regulatory agencies.

We will require recipients to process information only for clear, lawful, and necessary purposes and to adopt confidentiality and security protection measures.

2. Transfer

If personal information needs to be transferred due to adjustments in competition organization entities, service migration, merger, division, asset transfer, or similar reasons, we will require the new information recipient to continue to be bound by this Policy and notify you or obtain your consent within the scope required by law.

3. Disclosure

We disclose your personal information only under the following circumstances:

• With your explicit consent;
• In accordance with requirements of laws and regulations or judicial or administrative organs;
• To protect the lawful rights and interests of you, other users, the public, or the Challenge;
• For official website display, media dissemination, and results publication of winning projects, shortlisted teams, and public roadshow projects, but the scope of disclosure is limited to information such as project name, team name, and project introduction required for public competition display.

Given that the GOAI Challenge is an international competition and some participants come from outside the territory of the People's Republic of China (including Hong Kong, Macao, and Taiwan regions), cross-border transfer of personal information is inevitable. We will handle cross-border transfer matters strictly in accordance with the Personal Information Protection Law of the People's Republic of China, the Measures for Security Assessment of Data Export, and other laws and regulations.

1. Inbound Transfer of Personal Information of Overseas Participants

If you are an overseas participant, during the process of registering an account, filling in registration forms, and submitting competition works, your personal information will be transferred from your country or region to within the territory of the People's Republic of China, stored on servers located within China, and processed within China. Your act of submitting personal information through the Services is deemed as your acknowledgment and consent to the above cross-border transfer.

2. Outbound Transfer of Personal Information Collected Within China

In principle, personal information we collect and generate within the territory of the People's Republic of China is stored within China and is not provided overseas. If it is indeed necessary to provide personal information overseas, we will lawfully fulfill necessary compliance procedures.

3. Cross-Border Transfer Protection Measures

Whether personal information is transferred inbound or outbound, we will adopt the following protection measures:

• Encrypt and protect personal information subject to cross-border transfer;
• Sign data processing agreements with overseas recipients to ensure that the protection measures they provide are not lower than the standards stipulated by Chinese laws and regulations;
• Overseas recipients may use personal information only for the purposes set forth in this Policy;
• Overseas recipients shall not further transfer personal information to third parties unless our written consent is obtained;
• If the personal information protection level in the country or region where the overseas recipient is located is lower than Chinese standards, we will adopt additional security protection measures.

4. Protection of Participants' Rights

We respect the rights enjoyed by participants under the personal information protection laws applicable in their country or region. We will provide equal channels for exercising rights to all participants (whether domestic or overseas) in accordance with the provisions of the "Your Rights" section of this Policy.

1. We will retain your personal information for the shortest period necessary to achieve the purposes described in this Policy, except as otherwise required by laws and regulations, regulatory requirements, competition archives, financial auditing, or dispute resolution.
2. In principle, personal information we collect and generate within the territory of the People's Republic of China is stored within China.
3. If cross-border transfer occurs due to overseas participation support, international email services, cross-border collaboration tools, or overseas partner services, we will lawfully fulfill necessary procedures and adopt necessary protection measures.
4. We will adopt the following technical and administrative measures to protect the security of your personal information:
   • Technical measures: SSL/TLS encrypted transmission, encrypted data storage, access control, firewalls, intrusion detection, and other security technical measures;
   • Administrative measures: Establish personal information protection management systems, conduct security training and background checks for staff, and implement the principle of least privilege and separation of duties.
5. The Internet environment is not absolutely secure. If a personal information security incident occurs, we will lawfully and promptly inform you of the possible impact, measures taken or to be taken, risk prevention suggestions you may adopt, and report as required by regulators.

In accordance with the Personal Information Protection Law of the People's Republic of China and relevant laws and regulations, you, as a personal information subject, enjoy the following rights. We will lawfully safeguard the exercise of your rights and respond within 15 working days after receiving your complete request and verifying your true identity. If the situation is complex, upon approval by our person in charge, the response period may be appropriately extended, but shall not exceed 30 working days at most, and we will inform you of the extension period and reasons.

1. Right of Access and Copy

You have the right to access and copy your personal information held by us. You may access your registration information, application information, project information, and the like through the account center of the Services. If you need to access other personal information, you may submit an application to us through the contact information set forth in Article XII of this Policy.

2. Right of Correction and Supplementation

If you find that your personal information held by us is inaccurate or incomplete, you have the right to request correction or supplementation. You may correct part of the information yourself through the account center, or apply to correct other information through contact information.

3. Right of Deletion

Under any of the following circumstances, you have the right to request that we delete your personal information:

• The processing purpose has been achieved, cannot be achieved, or is no longer necessary to achieve the processing purpose;
• We stop providing products or services, or the retention period has expired;
• You withdraw consent;
• We process personal information in violation of laws, administrative regulations, or agreements;
• Other circumstances stipulated by laws and administrative regulations.

To ensure account security, we will require you to complete identity verification before processing deletion requests. For information that must be retained according to law or rules for competition review archives, financial auditing, compliance review, or dispute resolution, we may not be able to delete it immediately, but we will stop processing other than storage and adoption of necessary security measures.

4. Right to Withdraw Consent

You have the right to withdraw consent previously given. Withdrawal of consent does not affect the validity of personal information processing activities already carried out based on consent before withdrawal. You may withdraw part of your authorization through the settings function in the Services, or withdraw other consent through contact information.

5. Right to Data Portability

Subject to the conditions stipulated by the national cyberspace administration department, you have the right to request that your personal information be transferred to another personal information processor designated by you.

6. Right to Restrict Processing

Under specific circumstances, you have the right to request that we restrict the processing of your personal information.

7. Right to Explanation

You have the right to request that we explain the rules by which we process your personal information.

8. Methods of Exercising Rights

You may exercise the above rights through the following methods:

• Online channel: Through the information management function in the account center of the Services;
• Email application: Send a request to the email address set forth in Article XII of this Policy;
• Written application: Mail a written request to the address set forth in Article XII of this Policy.

To ensure the security of your account and personal information, we will require you to provide identity documentation to verify your identity before processing your rights requests.

9. Complaints and Remedies

If you believe that our personal information processing activities have harmed your lawful rights and interests, you have the right to file complaints or reports with the relevant competent authorities, or institute legal proceedings in a people's court in accordance with law.

The Services may contain third-party links, external registration forms, open-source repository platforms, cloud resource platforms, statistical analysis tools, SMS or email services, video or document hosting services, and the like (hereinafter collectively referred to as "Third-Party Services"). Third-Party Services are independently operated by the corresponding third parties and are not bound by this Policy.

Please carefully read the privacy policies and terms of service of Third-Party Services before using them to understand their personal information processing rules. Third parties shall independently bear legal liability for independently collecting and using your information. We will use reasonable efforts to select third-party service providers with good reputations, but cannot fully control their personal information processing activities.

The GOAI Challenge is mainly aimed at developers, teams, and organizations with independent participation capabilities. We attach great importance to the protection of minors' personal information.

If minors use the Services or register to participate, they should obtain the consent of parents or other guardians in advance and submit information under the guidance of guardians. We will protect minors' personal information in accordance with applicable laws and regulations.

If you are a guardian of a minor and find that we have processed a minor's personal information without verifiable guardian consent, or if you have any questions about the processing of minors' personal information, please contact us through the contact information set forth in Article XII of this Policy.

We may update this Policy in accordance with laws and regulations, regulatory requirements, business adjustments, competition arrangements, or service changes. After updates, we will publish the latest version on the official website, account center, or related pages. If major changes involve changes in the purposes, methods, or scope of personal information processing, we will notify you in a prominent manner (including but not limited to email, SMS, in-site messages, announcements, and the like) and, where necessary, obtain your consent again.

After this Policy is updated, if you continue to use the Services, you are deemed to have read and agreed to the updated Policy. We recommend that you review this Policy regularly to learn about the latest personal information protection rules.

If you have any questions, comments, suggestions, complaints, or requests regarding this Policy, personal information protection, or account information processing, you may contact the Challenge Organizing Committee through the contact information published on the GOAI official website or contact us through the following methods:

• Email: goai@goaihz.com