Inchol

How We Protect Your Information

Version 2.0. Published 16 September 2026.

What this page is for

This page says how we protect personal information, what we do when something goes wrong, and how to tell us about a problem. We have written it for a parent or guardian who wants to know how a child's competition records, photographs and video are looked after. A competition organizer, a competitor, or a security reviewer with the same questions will find their answers here too.

If you want to see or correct what we hold about you, or to make a complaint, go to Your Privacy Rights. What we collect, why, and who else sees it is on Privacy Policy, and so is which privacy laws apply to us and how we decide which one governs a particular activity.

British Columbia's Personal Information Protection Act requires us to protect personal information in our custody or under our control by making reasonable security arrangements. The rest of this page is what we require of ourselves to meet that duty. It is written as a set of commitments, not as a report on how each of our systems is set up today. If you need to know how a particular thing is set up, ask us, and we answer from evidence.

What we do not claim

We are not certified to ISO/IEC 27001 or any comparable standard, and we do not hold a SOC 2 report. An earlier version of this page said we operated an information security management system developed in line with ISO/IEC 27001:2013. That was not accurate, and it was withdrawn. We repeat the withdrawal here so that nobody relies on the old wording.

What we require of ourselves

These rules bind everyone who has access to our systems: employees, contractors and anyone else holding our credentials, whichever device they use and whoever owns it. Everyone must be told what the rules require before they are given credentials, and again each year, and a record must be kept of who was told and when. Each rule carries a figure where we set one, because a figure is something you can hold us to and a vague word is not.

Accounts and authentication

Each person has their own named account, and accounts are not shared. A password must be at least twelve characters, must not be reused anywhere else, and lives in the password manager we provide rather than in a document, a message or on paper.

By confidential information we mean personal information, a competition organizer's information, our source code and our commercial terms. Any system that holds it and offers multi-factor authentication, which means a second sign-in step beyond the password such as a code from a phone, must have that step turned on. For email, the password manager and any administrative console, that step must be on in every case.

Granting and removing access

Access is granted only when the manager responsible for that person asks for it in writing, and only to what the role requires. Every grant and every removal must be recorded. An account must be disabled within one business day of our being told that an engagement has ended. Access must be adjusted within five business days of our being told that a role has changed. What counts as a business day is explained on Your Privacy Rights. Administrative rights must be limited to the people who need them for their work, and administrative work must be done from an account separate from the one used for email and everyday work.

Who may see personal information

Access to personal information must be limited to the people whose work requires it. That is the rule for competition records, for photographs and video, and for the information you give us when you hold an account with us. Where we use competition information and media to improve our software, as described on Privacy Policy, that material is held to the same safeguards and the same access rule.

Devices

Every laptop and phone used for our information or a competition organizer's must have full disk encryption turned on, which scrambles everything stored on it so it cannot be read if it is lost. It must lock after no more than fifteen minutes without use, or thirty where the device cannot enforce fifteen and we have recorded that. We check both once in every twelve months and record the check.

Every system and device must run a version its supplier still supports. We apply security updates within thirty days of release, or within seven days where the supplier or our Chief Technology Officer says the weakness is being exploited. Every laptop and server we control must run endpoint protection, which is software that watches for malicious code.

Where information may be kept

Our information and a competition organizer's may be kept only in a system our Chief Technology Officer has approved. It must never reach a personal cloud account, a personal email account or any other unapproved service, whether on purpose or by accident. Confidential information must be sent only over an encrypted channel. Remote access to a system must be authenticated and encrypted, and none of the tools we use to manage a system from a distance may be reachable straight from the internet.

Backup and recovery

Every system holding information we could not afford to lose, including what we host for competition organizers, must be backed up at least daily. Each month we must confirm, with a record, that every backup completed. At least one copy must be held where a compromise of the source system would not reach it. We must restore from backup at least once in every twelve months, and record the date, what was restored and how long it took.

Security incidents

Anyone working for us who suspects a security incident must report it at once, rather than deciding first whether it matters. A lost phone, a link clicked in a suspicious message, or a notice from a supplier that it has suffered a breach all count. What happens after a report is under What we do when something goes wrong. If you are not one of our staff, the route for you is under Telling us about a security or privacy problem.

Service providers

A service provider is an outside company that handles personal information for us. Before we disclose personal information to one, we require a written agreement to be in place, and we remain accountable for the information while it is with the provider. Which companies handle personal information for us, what each does with it, what that agreement must cover, and what we have and have not checked are on Service Providers and Subprocessors.

Written exceptions

Sometimes one of these rules cannot be met for a while. When that happens our Chief Technology Officer must approve the exception in writing, say what is done instead, and set an end date no more than twelve months away. We keep track of every exception in force, and a departure nobody approved is a breach of these rules.

Which encryption applies where

This is the question a reviewer asks most often, so here is the plain answer. Laptops and phones must have full disk encryption. Personal information and other confidential information must travel only over an encrypted channel, and remote access to a system must be authenticated and encrypted. Card numbers and payment details, banking information, passwords and other credentials, financial records, and the configuration and backup files that describe our systems must be encrypted wherever they are stored. Competition photographs and video are different. We do not apply encryption of our own to them once they are stored. They are held with providers that encrypt what they store, and each of those providers is named on our Service Providers and Subprocessors page. We would rather say that plainly than let you assume more.

Telling us about a security or privacy problem

Anyone can tell us. That includes a parent or guardian who thinks a child's photographs or video have been exposed, a competitor whose account has been taken over, an organizer, and a researcher who has found a weakness. You do not need an account with us, and you do not need to be certain.

Email dpo@inchol.com. Tell us what you saw, when you saw it, and which website or competition it concerns, and give us a way to reply. Please do not send us other people's personal information while you report it. If you would rather speak to someone, the telephone number under How to contact us reaches the same people.

We send your report to our Chief Technology Officer, who must decide whether a security incident has occurred and then follow the steps in the next section. We tell you within one business day that your report has reached us. What we say afterwards about an incident, and whether we say anything, is our Chief Executive Officer's decision.

What we do when something goes wrong

Two terms are used carefully here. A security incident is any event that may have compromised the confidentiality, integrity or availability of information we hold. By a personal information breach we mean a security incident that involves personal information. Every personal information breach is a security incident, and not every security incident involves personal information.

On receiving a report, we undertake to do this, in this order.

  1. Decide whether a security incident has occurred.
  2. Open a written record at once.
  3. Contain the incident.
  4. Preserve the evidence. An affected device is not rebuilt, wiped or tidied, and logs and messages are not deleted, until our Chief Technology Officer says the record is complete.
  5. Establish and record whether personal information is involved.
  6. Decide who must be told, and tell them.

Who we tell, and when

Who we tell depends on whose information it is. Whether we or a competition organizer are responsible for it is explained under Two different roles on Privacy Policy.

In both cases, "the first report" below means the moment an incident is first reported to us.

Where a competition organizer is responsible

This is the ordinary case for a competitor's record, which reaches us from the organizer running the competition and is held on that organizer's documented instructions.

If personal information held on an organizer's instructions is involved, we undertake to tell that organizer's privacy contact within 48 hours of the first report. We tell them sooner where our contract with the organizer requires it. We hold a privacy contact for every organizer we work with. The decision whether to contact the people affected is the organizer's and not ours, unless the organizer instructs us in writing to contact you or the law places that duty on us directly. Reporting to a regulator works the same way. After that, the organizer's own privacy policy governs what happens.

An incident that does not involve personal information is a different case. Our Chief Executive Officer must decide whether the organizer is told, and must record the decision. That decision must be made within the period our contract with the organizer fixes, and otherwise within two business days of the first report.

Where we are responsible

What we must do after a breach then depends on which privacy law governs the activity. How we decide that is on Privacy Policy.

Under Canada's federal Personal Information Protection and Electronic Documents Act. Our Privacy Officer must determine in writing whether it is reasonable to believe the breach creates a real risk of significant harm to an individual, and must record that determination whatever its outcome. If the answer is yes, we must report the breach to the Privacy Commissioner of Canada as soon as feasible after determining that it occurred. Unless the law prohibits it, we must also notify each affected person within the same time. Those are the periods the Act itself sets.

Under British Columbia's Personal Information Protection Act. That Act places no duty on us to report a breach to a commissioner and no duty to notify the people affected. Reporting to the Office of the Information and Privacy Commissioner for British Columbia is voluntary, and that office encourages it. Our Privacy Officer must decide whether to report and whether to notify, and must record the decision and the reason either way. A decision not to tell people about a breach likely to cause them significant harm needs the written agreement of our Chief Executive Officer.

Under the privacy law of the United Kingdom or the European Union. Where that law reaches the activity, we follow what it requires after a breach, including its time limits for telling the authority and the people affected. Which of those laws reaches what we do is explained on Privacy Policy.

The records we keep

Two records come out of an incident, and they are kept for different periods. The first is our own record of the incident: what was observed and decided, by whom and when. It is opened when a report is received, it covers every security incident whether or not personal information is involved, and we keep it for seven years. That is our own commitment, not a statutory minimum.

The second is the record of a breach of security safeguards that Canada's federal Act requires where a breach involves personal information. We keep it whether or not we found a real risk of significant harm, for at least 24 months from the day we determine that the breach occurred. That is the statutory minimum. When one event produces both records, both are kept, and the seven-year period is the longer.

Where these rules come from

The statements of law on this page rest on these provisions. This page is not legal advice.

  • The duty to protect personal information by making reasonable security arrangements: British Columbia's Personal Information Protection Act, S.B.C. 2003, c. 63, section 34.
  • Reporting a breach to the Privacy Commissioner of Canada, and notifying the people affected: Canada's Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, section 10.1.
  • Keeping the record of a breach of security safeguards for at least 24 months: the Breach of Security Safeguards Regulations, SOR/2018-64, section 6(1).
  • That the British Columbia Act imposes no duty to report a breach or to notify people: that Act, Part 9, sections 33 to 35, which impose duties of accuracy, protection and retention only. British Columbia does have a mandatory breach reporting regime, in the Freedom of Information and Protection of Privacy Act, and it binds public bodies rather than companies like us.

For a security or procurement review

If you are reviewing us before your organization signs a contract, write to dpo@inchol.com with your questionnaire. Our Chief Technology Officer, who also holds the Privacy Officer designation, answers it in writing.

We answer a question about the present state of our systems from evidence. If we hold the evidence, we give the answer and say what the evidence is. If we do not, we say so. An earlier version of this page offered to share security documentation under a confidentiality agreement. That offer is withdrawn, and we do not send a document in place of an answer.

How to contact us

The address dpo@inchol.com reaches our Privacy Officer.

The telephone number is toll free within Canada and the United States. It may not be reachable from outside North America. If you are in the United Kingdom, the European Economic Area or anywhere else outside North America, please use email or post.

If your complaint is about the Privacy Officer, write to our postal address marked for the attention of the Chief Executive Officer, who then takes the decisions the Privacy Officer would normally take.

Our postal address is on Your Privacy Rights.

Questions about these policies? Email our Privacy Officer at dpo@inchol.com.