Privacy Policy

1. Who We Are and How to Contact Us

• Legal Entity Name: WeMakeDevs Limited
• Registered Office Address: 128 City Road, London, United Kingdom, EC1V 2NX
• Primary Contact & Privacy Email: contact@wemakedevs.org

Under applicable privacy legislation, including the UK General Data Protection Regulation (UK GDPR), the European Union General Data Protection Regulation (EU GDPR), the Indian Digital Personal Data Protection Act, 2023 (DPDPA), and relevant United States state privacy laws, WeMakeDevs Limited acts as the Data Controller (or Data Fiduciary) for the personal data processed through our website and events.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact us at contact@wemakedevs.org.

2. Information We Collect

We collect personal information that you provide to us directly, as well as technical data generated when you use our website backend or participate in our events:

• Account & Registration Data: When you create an account on wemakedevs.org or register for an event, we collect your full name, email address, job title, company/organization, location, social media or GitHub profile handles, and password credentials.
• Event Participation Data: Details regarding the virtual webinars, workshops, hackathons, or in-person conferences you sign up for, attend, or interact with (including Q&A submissions or live session feedback).
• Special Category Data (In-Person Events Only): If you attend a physical event, you may voluntarily provide dietary requirements or physical accessibility requests. This sensitive data is used strictly to provide event accommodations and is deleted shortly after the event concludes.
• Photographs and Video Recordings (In-Person Events): When you attend a WeMakeDevs event in person, our team, photographers, or videographers may capture photographs and video recordings of attendees, sessions, and activities. By attending an in-person event, you consent to being photographed and filmed for the purposes described in Section 3 below.
• Technical & Device Telemetry: IP address, browser user-agent, operating system details, device identifiers, essential session cookies, and backend application log data to keep our system secure and optimized. We also collect aggregate, cookieless website usage statistics, as described in Section 7 below.
• Creator Link Attribution: If you register for an event after following a link shared by a content creator, the campaign labels on that link (such as the creator’s name and the campaign) are stored with your registration. Section 7 explains when this happens and the cookie involved.

If you would prefer not to appear in photographs or video recordings at an in-person event, let event staff know on-site or contact us at contact@wemakedevs.org, and we will make reasonable efforts to accommodate your request.

3. How We Use Your Data and Lawful Bases

We process your personal data for the following specific purposes and under the following legal bases:

• To Provide Our Platform and Manage Events: To authenticate your backend logins, issue event tickets, facilitate hackathon team assignments, and host virtual or physical sessions. (Legal Basis: Performance of a Contract)
• To Send Event Updates & Marketing Communications: To send you updates about upcoming WeMakeDevs events, technical workshops, community news, and educational resources. (Legal Basis: Consent or Legitimate Business Interest)
• To Share Information with Event Sponsors: To allow official sponsors of events you attend to contact you with relevant opportunities or product updates, subject to your explicit choice. (Legal Basis: Explicit Opt-In Consent)
• To Maintain System Security: To protect our website backend against unauthorized access, cyber threats, and fraudulent activity. (Legal Basis: Legitimate Interest / Legal Obligation)
• To Photograph and Film In-Person Events: To capture photographs and video recordings at our in-person events, and to use them in our marketing materials, including our website, social media channels, newsletters, event recaps, and other promotional content. (Legal Basis: Consent, given by attending the event in person)

4. Event Updates and Unsubscribing

We like to keep our global developer community informed about upcoming hackathons, conferences, platform upgrades, and learning resources.

• How We Contact You: By registering an account or signing up for an event, we may send you administrative service messages (such as ticket confirmations and password resets) and promotional event updates.
• Your Right to Unsubscribe: You can opt out of receiving marketing emails or event updates at any time. Every promotional email we send includes an automated, single-click “Unsubscribe” link at the bottom. You can also update your email preferences directly in your backend account settings or email us at contact@wemakedevs.org to be removed from our marketing lists.

Note: Unsubscribing from promotional emails will not affect essential transactional messages (e.g., ticket confirmations or critical security alerts) related to events you actively register for.

5. Sharing Your Data with Event Sponsors

Our events are made possible through the support of corporate and technology sponsors.

• Sponsor Sharing Clause: When you register for an event sponsored by a third-party company or present your event badge for scanning at an in-person sponsor booth, we may share your contact information (such as your name, email address, job title, and company) with the specific sponsors associated with that event.
• Control & Choice: We will only share your contact information with sponsors if you explicitly opt in during registration (via an unticked checkbox) or voluntarily present your badge to be scanned at an event booth.
• Sponsor Communications: Sponsors who receive your data act as independent data controllers. They may use your data to reach out regarding developer tools, job opportunities, or services. You can opt out of communications from a sponsor at any time by following the unsubscribe mechanism in their emails.

6. Third-Party Service Providers and Global Transfers

We do not sell your personal data. We only share data with trusted third-party service providers (Data Processors) who assist us in operating our platform. The infrastructure providers we currently rely on, the regions they operate in, and the Data Processing Agreement (DPA) that governs each, are:

This list is kept current here and in our Terms of Service, and is updated whenever our infrastructure changes.

Embedded content: Some pages embed videos from YouTube (served from its privacy-enhanced youtube-nocookie.com domain), and some event pages open a ticketing window from Luma when you choose to book a seat. These services receive your IP address and browser details when their content loads, and act as independent controllers of the data you give them. Their own privacy policies apply.

International Transfers: Because our community is global, your personal data may be stored or processed on servers outside your home country. Our website, application hosting, primary database and image storage are located in Singapore and the wider Asia-Pacific region. Our email delivery provider is located in the European Union, and our error monitoring is located in the United States. Data may also be processed in the UK or India in the course of running our events and communications. Where cross-border transfers occur, we rely on recognized legal safeguards, including Standard Contractual Clauses (SCCs) and the data processing agreements with each provider listed above.

7. Cookies and Analytics

We keep cookies to the minimum needed to run the platform, and we do not use advertising or cross-site tracking cookies. The one optional cookie we use is set only if you accept it in the cookie banner.

• Essential Cookies: When you sign in, we set session cookies that keep you logged in and protect your account. We also set a cookie that remembers your answer to the cookie banner for 6 months, so we can respect it. These are strictly necessary for the platform to work, so they are not optional, and they are never used for analytics or advertising.
• Creator Link Attribution (Optional Cookie): Content creators share links to our events that carry campaign labels, such as which creator shared the link. If you accept in the cookie banner, we store those labels in a first-party cookie on your device for 30 days, so that if you register for an event within that time we can credit the creator who referred you. The cookie holds only those labels, is read only by us, and is never shared with advertisers. If you decline, it is never set, and withdrawing your consent later deletes it. (Legal Basis: Consent)
• Creator Link Attribution (Same Visit): If you register for an event during the same visit in which you followed a creator’s link, we record the campaign labels from that link with your registration, whether or not you accepted the cookie. Nothing is stored on your device for this: the labels are read from the address of the page you are on. We use them only to measure which creators and campaigns bring people to our events. Our reports count registrations by source, medium and campaign and never name individuals. The labels also appear on your registration record, which only our event team can see. You can ask us to remove them from your registration at any time. (Legal Basis: Legitimate Interest)
• Cookieless Analytics: We use Cloudflare Web Analytics to understand, in aggregate, how our website is used, such as which pages are visited, where visitors arrive from and how quickly pages load. It sets no cookies, does not use local storage, does not fingerprint your device, and does not track you across websites or build a profile of you. Cloudflare processes the page request, including your IP address, only to produce these aggregate statistics. (Legal Basis: Legitimate Interest)

You can change your choice at any time from the cookie preferences link here or in the footer of any page.

8. Data Retention & Deletion

We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy or to comply with legal obligations:

• Account Data: Retained while your account is active. Accounts inactive for over 24 months are archived or deleted following notification.
• Event Data: General event participation registers are retained for up to 12 months post-event for feedback and certificate generation.
• Special Accommodations Data: Accessibility and dietary information for physical events is permanently purged within 14 business days post-event.
• Automated Pre-Erasure Notifications (India DPDPA): For users in India, when data reaches the end of its scheduled retention window or purpose, we issue an automated electronic notice at least 48 hours prior to permanent data erasure, giving you the opportunity to retain your account if desired.

9. Your Global Privacy Rights

Depending on your jurisdiction (including under UK/EU GDPR, Indian DPDPA, and US privacy laws), you have specific statutory rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you and details of third-party sharing.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure (“Right to be Forgotten”): Request the permanent deletion of your personal data.
• Right to Object / Opt-Out: Object to the processing of your data for direct marketing or sponsor sharing at any time.
• Right to Data Portability: Receive your data in a structured, standard machine-readable format.
• Right to Nominate (India): Nominate an individual to exercise your privacy rights in the event of death or incapacity.

To exercise any of these rights, please email us at contact@wemakedevs.org. We respond to all verified requests free of charge within statutory deadlines (generally within 30 days).

10. Children’s Data and Age Requirements

You must be at least 18 years old to create an account and use our platform on your own behalf. If you are under 18, you may only use the platform with the consent of a parent or legal guardian, and you will be asked to confirm during registration that you are 18 or older or that you have obtained that consent. These age requirements are set out in full in our Terms of Service.

• Children under 13: Our platform is not directed at children under the age of 13, and we do not knowingly collect personal data from them without appropriate consent. If we learn that we have done so, we will delete that information promptly.
• Users between 13 and 18 without consent: If we later learn that an account holder is between 13 and 18 and did not in fact have a parent or guardian’s consent, we will suspend the account and delete the associated personal data, unless that consent is then provided.
• Verifiable parental consent (India DPDPA): For users in India who are under 18, we process personal data only on the basis of verifiable consent from a parent or legal guardian. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, as required by the DPDPA.
• Parental requests: If you are a parent or guardian and believe your child has provided us with personal data, contact us at contact@wemakedevs.org and we will review and delete the data as appropriate.

11. Security Safeguards

We implement technical and organizational security controls to protect your data, including end-to-end Transport Layer Security (TLS 1.3) for website traffic, AES-256 encryption at rest for backend databases, multi-factor authentication, and strict access controls. In the unlikely event of a security breach affecting your data, we will notify you and relevant supervisory authorities as required by law.

12. Updates to This Policy

We may update this Privacy Policy at any time, with or without notice, to reflect technical modifications to wemakedevs.org, new event formats, or regulatory changes. The “Last updated” date at the top of this page will always reflect the most recent version, so please check back periodically. Where a change materially affects how we process your personal data, we will aim to highlight it on our website and notify registered users by email, but we are not obliged to do so except where the law requires it. Your continued use of the platform after an update takes effect constitutes acceptance of the revised policy.

13. Supervisory Authority Complaints

If you feel we have not addressed a privacy concern adequately, you have the right to lodge a complaint with your local regulatory authority:

• United Kingdom: Information Commissioner’s Office (ICO), at ico.org.uk
• India: Data Protection Board of India (DPBI)
• European Union: Your local national Data Protection Authority (DPA)