What we collect,
and why.

Who runs this

The site is operated by the Global Quest Competition Foundation, a Hong Kong-registered non-profit (Reg. No. 4715454) with regional chapters in the United Kingdom and the United States. The data controller is the Foundation; the registered data-protection contact is privacy@gqc.org.

What we collect

If you visit the site, we collect anonymised analytics (pages visited, country, device class). If you sign up for the newsletter we keep your email until you unsubscribe. If you start an application or use Early-Stage Feedback we keep what you submit, plus the names, ages, schools and contact details of your teammates, for as long as your participation in the cycle is active and for seven years afterwards for audit purposes.

What we use it for

We use your data to run the competition: notifying you of shortlist decisions, organising travel, returning written feedback and contacting your school where needed. Aggregate data is used in the GQC annual report and in research about the impact of the programme. We do not sell data to third parties. We do not share data with sponsors or partners except in anonymised form, and never without the team’s consent.

Cookies

We use a single first-party cookie to keep you signed in, plus an analytics cookie that you can opt out of in your browser settings. We do not use third-party advertising cookies.

Your rights

If you are based in the UK or the EU you have the rights granted by the UK GDPR / EU GDPR, including access, rectification and erasure. If you are based in California you have analogous rights under the CCPA. If you are based in Hong Kong the Personal Data (Privacy) Ordinance applies. To exercise any of these rights, email privacy@gqc.org; we will respond within thirty days.

Changes to this policy

We will post any material change on this page and email registered applicants. Minor edits will be summarised in the next monthly newsletter.

Legal bases and retention

For UK and EU applicants we rely on: performance of a contract (running your application and the Learning Experience); legitimate interests (programme evaluation, fraud prevention, certificate verification); legal obligation (accounting, safeguarding); and consent where we send the newsletter or use optional analytics. Hong Kong applicants are covered by the Personal Data (Privacy) Ordinance; California residents may exercise CCPA/CPRA rights via privacy@gqc.org.

Retention, in outline: newsletter emails until you unsubscribe; unsuccessful application files 24 months; shortlisted and Finalist files 7 years for audit and certificate verification; travel records as required by tax law; analytics in aggregated form. We do not sell personal data. International transfers between the Hong Kong, UK and US chapters use contractual clauses and access controls. Processors (email, cloud hosting, payment of the £30 fee) are listed in the applicant portal’s sub-processor note.

Children and certificates

Many applicants are 14–17. We collect guardian consent at registration. Certificates contain a name, team, city and prize line — the minimum needed to verify. The public verifier does not expose extra contact data. Do not post a minor’s certificate on social media without the guardian’s and the student’s agreement.

How to complain

Write first to privacy@gqc.org. You may also contact the Office of the Privacy Commissioner for Personal Data (Hong Kong), the ICO (UK), or your EEA supervisory authority. A 30-day clock starts when we receive a complete request.