Privacy Policy

SemiEvents (the "Platform") is operated by Imersifi Ltd ("we", "us", "our"), a company registered in England and Wales. For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, we are the controller of the personal information described in this policy, unless we say otherwise.

We have not appointed a Data Protection Officer, but you can contact us about anything in this policy at [email protected].

• Attendees — people who create a Semi Passport to collect event stamps.
• Organisation Users — people who manage an organisation's workspace, events and campaigns.
• Visitors — anyone who browses public pages or scans an event QR code without signing in.

Organisations that list events on the Platform make their own decisions about how they use information you choose to share with them (for example, if you allow them to email you). Their use of your information is covered by their own privacy notices.

Account information

• Your name and email address.
• Your password, which we store only in hashed (one-way encrypted) form — we can never see it.
• Your account type (attendee or organisation) and a randomly generated passport number.
• The date and time you accepted our Terms of Service and this Privacy Policy.

Profile information (attendees)

• Your age range (for example "Under 16" or "25–34" — we do not ask for your date of birth).
• Your gender, only if you choose to give it (woman, man, non-binary, another gender, or prefer not to say). This is optional, and you can change or remove it at any time from your account page.
• Your interests (for example careers, internships or research).
• Your country and, optionally, your region. When you sign up we suggest a country based on your device's time zone setting; this happens on your device and you can change it.

Passport and engagement activity

• The events you have scanned and the stamps and badges you have claimed, with the date and time.
• Star ratings and any written comments you leave about events.
• The organisations you choose to follow.
• When you were last active on the Platform.

Contact permissions

• For each organisation you allow to contact you: whether permission is currently given, the wording you agreed to, how and where you gave it (for example on an event feedback form or in your account settings), and when it was given or withdrawn. We keep this as a record of your consent.

Organisation information

• Organisation name, legal name, website, country and region, logo, description and status.
• The Organisation Users who belong to each organisation, and when they joined.
• Events created (including venue, address, online link, registration link, images and stamp designs).
• Campaigns created (subject, message, audience filters, who created it and delivery counts).

Technical and usage information

• Sign-in sessions: when you are signed in, we store your IP address, browser user-agent and session data so you stay logged in and to protect your account.
• Engagement analytics: when you view an event page or scan a QR code we record an anonymous visitor identifier (from a cookie), the type of device (mobile, tablet or desktop), browser and operating system, the referring web page, and the time. Your user-agent string is stored only as a keyed one-way hash. We do not store your IP address for analytics; if this is ever enabled, it is stored only as a keyed one-way hash, never in raw form.
• Security logs: sign-in attempts are rate-limited using your email address and IP address to protect against password guessing.

Camera

To scan event QR codes the Platform asks for access to your device camera. The camera feed is processed only on your device to read the QR code — we do not record, store or receive any images or video.

Information we do not collect

We do not collect payment details, precise location (GPS), date of birth, or special category data such as health, ethnicity or religion. Please do not include such information in feedback comments.

• Directly from you — when you register, complete your profile, scan a QR code, leave feedback, change your contact preferences or contact us.
• Automatically — through cookies and server logs when you use the Platform (see Cookies).
• From your organisation — if you are an Organisation User, a colleague may add you to their organisation's workspace.

Purpose	Information used	Lawful basis
Creating and running your account and Semi Passport, awarding stamps and showing your history	Account, profile, passport activity	Contract — necessary to provide the service you signed up for
Running organisation workspaces, reviewing and approving organisations, publishing events	Organisation information, Organisation User details	Contract; legitimate interests in keeping the Platform trustworthy
Sharing your ratings and feedback with the organisation that ran the event	Ratings, comments, your name	Legitimate interests — helping organisations improve their outreach
Providing organisations with aggregated, anonymous analytics (for example how many attendees by age range or country)	Profile, engagement activity	Legitimate interests — measuring the impact of semiconductor outreach
Including your gender in aggregated, anonymous statistics about who outreach is reaching, shown to organisations and our administrators	Gender (only if you gave it), passport activity	Consent — giving your gender is optional, and you can withdraw consent at any time by removing it from your account page
Delivering emails from organisations you have allowed to contact you	Name, email, contact permissions, profile (for audience filtering)	Consent — which you can withdraw at any time
Sending service emails (for example password resets and important account or policy notices)	Name, email	Contract; legitimate interests
Keeping the Platform secure, preventing fraud and misuse (for example fake stamp claims), and debugging	Technical and usage information, account information	Legitimate interests — protecting our users and the Platform
Improving the Platform and producing anonymised statistics about outreach activity	Engagement analytics, aggregated profile information	Legitimate interests
Complying with the law, responding to legal requests and defending legal claims	Any relevant information	Legal obligation; legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights and you can object at any time (see Your rights). We do not use your information for advertising and we never sell it.

When you engage with an organisation's event, that organisation can see:

• your name, if you claimed their event's stamp or left feedback on it;
• the star ratings and comments left for their events, and summary statistics such as average rating;
• aggregated, anonymous counts of attendees broken down by age range, gender, country and region — these never identify you individually. Gender counts are only shown once enough attendees have engaged that no one can be singled out.

Organisations cannot see your email address, password, passport number or the gender you have given. If you allow an organisation to contact you, the Platform sends their email campaigns to you on their behalf; your email address is still not shown to them, but if you reply to a campaign your reply goes directly to the organisation.

Permission to be contacted is off by default, is given separately for each organisation, and can be withdrawn at any time from your Contact preferences page or by using the link at the bottom of any campaign email.

We share information only where necessary, with:

• Hosting and infrastructure providers — who host our servers and database (managed through Laravel Forge) and act as our processors under contract.
• Amazon Web Services (Amazon SES) — which delivers our emails, including password resets and organisation campaigns. It processes your name, email address and the email content.
• Swansea University — our outreach partner, with whom we may share aggregated, anonymised statistics only, to evaluate and report on the impact of outreach activity.
• Organisations — as described in What organisations can see.
• Professional advisers, regulators, law enforcement or courts — where required by law or to protect rights, property or safety.
• A buyer or successor — if our business or the Platform is sold or restructured, subject to this policy continuing to protect your information.

Event pages may link to external websites (for example an organisation's registration page or Google Maps). Those sites are not controlled by us and have their own privacy policies.

Some of our service providers (such as Amazon Web Services and Google) may process information outside the United Kingdom, including in the European Economic Area and the United States. Where this happens we make sure appropriate safeguards are in place, such as a UK adequacy regulation (including the UK–US Data Bridge for certified companies) or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. Contact us for more information.

Cookies are small files stored by your browser. We use only a small number of cookies and similar technologies, all of which are needed for the Platform to work or to measure event engagement in a privacy-friendly way. We do not use advertising or third-party tracking cookies.

Name	Purpose	Duration	Type
semievents-session	Keeps you signed in and remembers your progress through forms	120 minutes of inactivity	Strictly necessary
XSRF-TOKEN	Protects forms against cross-site request forgery	120 minutes	Strictly necessary
remember_web_…	Keeps you signed in between visits if you tick "Remember me"	Up to 400 days, or until you sign out	Strictly necessary (only set at your request)
semi_aid	A random anonymous identifier used to count unique visitors and scans on event pages without identifying you	1 year	Analytics (first-party only)
event_timezone	Remembers the time zone an Organisation User prefers when creating events	1 year	Functional (organisation workspace only)
theme (local storage)	Remembers whether you chose light or dark mode	Until you clear it	Functional

If you install SemiEvents to your home screen, your browser may also cache parts of the Platform on your device so it loads faster and works offline. You can control or delete cookies and stored site data in your browser settings; blocking strictly necessary cookies will stop sign-in from working.

• Account, profile and passport data — for as long as your account exists. When you delete your account we permanently erase your profile, stamps, feedback, contact permissions, organisation memberships, sessions and any password reset tokens.
• Sign-in sessions — expire after 120 minutes of inactivity and are removed from the database periodically.
• Password reset links — expire after 60 minutes.
• Engagement analytics — the anonymous records are not linked to your account and are kept for as long as the related event exists, so organisations can see their historical results.
• Organisation, event and campaign records — for as long as the organisation's account is active. When an organisation or event is deleted, its related feedback, stamps and analytics are deleted with it.
• Backups — deleted data may remain in encrypted backups for a short period until they are overwritten in the normal backup cycle.
• Correspondence with us — up to 2 years after the matter is resolved, unless we need it longer for legal reasons.

We may also delete accounts that have been inactive for a long period, after first trying to tell you.

The Platform is designed to inspire people of all ages, including school students, to explore careers in the semiconductor industry. You must be at least 13 to create an account. If we learn that we hold information about a child under 13, we will delete it.

For users aged 13 to 17 we:

• collect only an age range, never a date of birth;
• only ask for gender as an optional question, and use it only in anonymous totals;
• keep contact permissions switched off by default — no organisation can email you unless you choose to allow it;
• never show your email address to organisations;
• do not use your information for advertising or profiling.

We encourage young people to talk to a parent or guardian before signing up. Parents and guardians can contact us at [email protected] with any concerns, or to ask us to delete a child's account.

Under UK data protection law you have the right to:

• Access — ask for a copy of the personal information we hold about you.
• Rectification — correct inaccurate or incomplete information. You can update most details yourself from your account page.
• Erasure — ask us to delete your information. You can delete your account yourself at any time from your account settings.
• Restriction — ask us to limit how we use your information in certain circumstances.
• Portability — receive information you gave us in a structured, machine-readable format.
• Object — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time: organisation contact permissions from your Contact preferences page, and your gender by removing it from your account page. This does not affect processing already carried out.

To exercise any of these rights, email [email protected]. We may need to verify your identity first. We will respond within one month, which may be extended by two further months for complex requests. There is normally no charge.

We use appropriate technical and organisational measures to protect your information, including:

• passwords stored using strong one-way hashing;
• encryption in transit (HTTPS) for all traffic to the Platform;
• encrypted, HTTP-only cookies and cross-site request forgery protection;
• rate limiting on sign-in and QR scanning to prevent abuse;
• role-based access controls so that organisations can only see their own data and only our authorised staff can access the platform administration area;
• one-way hashing of technical identifiers used for analytics.

No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify you and the Information Commissioner's Office as required by law.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Organisations can filter campaign audiences by broad criteria (such as age range, interests or country), but only among people who have chosen to hear from them. Gender is never used to filter campaign audiences.

We may update this policy from time to time. The "Last updated" date at the top shows when it was last changed. If we make significant changes we will let you know by email or with a notice on the Platform before they take effect.

For any questions about this policy or your personal information, please contact Imersifi Ltd at [email protected].

If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to deal with your concerns first.