Privacy Policy

This policy applies to the website gycaawards.com and related services operated by Global Young Create Awards (GYCA) ("GYCA"), the data controller.

• Business name: Global Young Create Awards (GYCA)
• Representative: Koo Min-young
• Address: 55-807, 401 Apgujeong-ro, Gangnam-gu, Seoul, Republic of Korea
• Business registration no.: 454-25-02305
• Privacy officer: admin@gyca.org

We collect the following data, either because you enter it or automatically while you use the service.

• Account: name, email, password (stored hashed). With social sign-in (Google, Microsoft, Facebook, Kakao): the name, email, profile picture and account identifier that provider shares.
• Competition entries: participant name (native and English), date of birth, country of residence, nationality, school, grade, work title, description, creator bio, and the submitted files (images, PDFs, etc.).
• Guardian consent: for minors, the guardian's name, email, time of consent and the document version consented to.
• Payments: order history, amount, method and authorisation result. Card numbers and similar payment credentials are handled by our payment processor and never stored on GYCA servers.
• Automatically: IP address, browser type, access times, the login session cookie and usage logs.

We do not use advertising or third-party analytics cookies. The only cookie we set is the strictly necessary session cookie that keeps you signed in.

• Identifying you, signing you in and protecting your account (performance of a contract)
• Managing entries, checking eligibility, judging and notifying results (performance of a contract)
• Taking entry fees, issuing receipts and processing refunds (contract and legal obligations)
• Obtaining guardian consent for minors (legal obligation)
• Exhibiting, publishing and promoting awarded or selected works (separate consent)
• Sending notices, entry and results emails (performance of a contract)
• Preventing fraud, handling security incidents and resolving disputes (legitimate interests and legal obligations)

We do not use personal data for purposes other than those listed. If a purpose changes, we ask for your consent again.

GYCA competitions are aimed at young people. Participants below the age set by their local law (for example under 14 in Korea or under 16 in the European Economic Area) can only complete an entry with a guardian's consent.

We obtain that consent through a link sent to the guardian's email address entered by the participant, and keep the guardian's name, time of consent and document version as evidence. A guardian may withdraw consent at any time, after which the entry will not proceed.

• Account data: until you close your account or your deletion request is processed
• Entry data and submitted files: for the period stated in each competition's retention policy, after judging, results and any exhibition have ended
• Guardian consent and payment evidence: for the period required by each competition's retention policy and by law (Korean e-commerce law requires contract and payment records for 5 years and complaint/dispute records for 3 years)
• Access logs: 3 months under Korean telecommunications law

Data past its retention period is deleted irreversibly or anonymised.

We use the following providers to run the service. Some are located outside the Republic of Korea. Each processes data only on our instructions under a contract.

• Google Cloud (Google LLC, Seoul region): website hosting
• Supabase (Supabase Inc., AWS Seoul region): database
• Amazon Web Services: private storage of submitted files
• Toss Payments: payment processing
• Resend: transactional email
• Google, Microsoft, Meta (Facebook), Kakao: social sign-in, only if you choose it

If participant data must be shared with an overseas partner for an exhibition or affiliated programme, we tell you in advance who receives it, why, which data and for how long, and ask for separate consent.

You (and, for minors, your legal guardian) may at any time access, correct or delete your personal data, restrict its processing and withdraw consent.

• Edit your account or delete it: the Settings page (/settings) after signing in
• Request deletion of entry data: the privacy request tool on My Page (/mypage). Data we must keep for judging, exhibition or legal reasons is processed once that period ends.
• By email: admin@gyca.org (we reply within 10 days after verifying your identity)

If you live in the EEA or the UK you also have the GDPR rights to data portability, to object to processing and to lodge a complaint with your supervisory authority. Residents of Korea may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

• All traffic is encrypted with HTTPS and passwords are stored in a non-reversible form.
• Submitted files live in private storage that cannot be reached directly from the internet and are opened only through time-limited signed links.
• Access to personal data is limited to the minimum staff needed to run the service, and every grant or change of access is logged.
• Judges receive blinded materials with the participant's identity removed.

When we change this policy we post the changes and their effective date in the website notices at least 7 days in advance, or 30 days for changes that materially affect your rights.

Questions: admin@gyca.org