Privacy and cookie notice

1. Who is responsible

AtriumArena is operated by Purple Panda Limited, established in Hong Kong ("we", "us"). We determine how personal data is used to operate the platform. Contact our contact address for privacy enquiries, access or correction requests, and complaints. Address your request to the AtriumArena privacy contact.

This notice applies to our website and platform. An expert organization that receives audience details for its own purposes is responsible for its subsequent handling of that information. This notice does not replace that organization's privacy notice.

2. Information we process

We collect information you provide and records generated when you use the service. Supply information about other people only if you have authority to do so. Do not submit sensitive personal information, confidential client material, payment-card details or identification documents through ordinary profile or registration fields.

• Accounts and profiles: name, email, password hash, role, biography, profile image, professional links, organization, industry and optional professional or business information.
• Battles and participation: event details, applications, invitations, registrations, name, email and any company or phone information supplied; follows, referral activity, votes and results.
• Permissions and security: organization-specific consent choices, the disclosure version, timestamps, IP address and browser information recorded with certain actions, verification and session records, and audit/export records.
• Communications: information you send us by email and information needed to deliver service messages or handle a support or privacy request.

3. Purposes and legal grounds

We use information to create and secure accounts; display the public information you submit; organize and administer battles; process applications, registrations and votes; deliver requested service messages; maintain consent and export records; investigate abuse; and handle rights, legal obligations and disputes.

Required fields are identified in the relevant form. Without information necessary for an account or battle, we may not be able to provide that function. Optional profile information is not required to browse public pages.

Hong Kong's Personal Data (Privacy) Ordinance applies as relevant. Where EU, UK or another applicable law requires a legal basis, we rely on performance of our agreement for requested services, legitimate interests in security and administration where not overridden by your rights, legal obligations where applicable, and valid consent where required for marketing or optional sharing. Accepting our Terms or reading this notice is not itself marketing consent.

4. Audience details and expert organizations

Battle registration identifies participating organizations and records separate selections for them. Selected organizations may receive the registration details you supplied, such as your name, email and any company or phone information. Their outreach must stay within the disclosure and permission given; attending a battle is not permission for every expert to contact you.

The current registration form requires a permission selection for at least one listed organization. This condition does not replace any additional or freely given consent required by applicable law. A registration or technical export record alone is not proof that every proposed marketing use is lawful.

Expert participation and audience sharing can support commercial promotion. Where providing personal data to another party for direct marketing requires a specific disclosure, written consent or a disclosure of gain, those requirements must be met before that provision. Neither this notice nor a general platform agreement substitutes for those requirements.

You can ask our contact address to stop future platform-controlled sharing or marketing based on consent. Withdrawal does not invalidate earlier lawful processing. A receiving expert may already hold a copy; contact that expert as well. We can assist with identifying the recipient, but cannot promise to erase a separate organization's systems directly.

5. Public content and external services

Public profiles, event pages, rankings and published articles can be viewed, indexed, linked and cached by others. Public expert pages display professional identity, submitted profile material and battle activity; private account or organization contact email addresses are not intended for public display.

External event, replay, social-profile and image links may take you to another provider or load its content. That provider receives information associated with the visit, such as your IP address, and applies its own terms and privacy practices. Removing content from AtriumArena may not remove copies already lawfully made by others.

6. Service providers and other disclosures

We disclose information needed for the following services. Providers may also keep records needed for their security, legal obligations or their own independently determined purposes.

• Replit: application hosting, managed database and platform infrastructure receive stored application data and operational metadata. Google Cloud Storage, used through the storage integration, holds uploaded files and related object metadata.
• Twilio SendGrid: receives email addresses, sender details, message contents and delivery metadata to send service messages. Verification emails necessarily contain the code being delivered.
• Anthropic: receives selected public-source research, editorial instructions, article drafts and relevant existing article titles for Claude-assisted blog research, writing and quality review. Audience lists and account databases are not part of the blog-generation workflow. Public research can nevertheless contain information about identifiable people.
• Google Fonts and external asset hosts: can receive IP address, browser and request information when fonts or externally hosted images load.
• Professional advisers, authorities or another business owner: limited disclosure may be necessary for legal advice, lawful requests, protecting rights, or a genuine business transfer, subject to applicable safeguards and notice obligations.

7. International handling

We operate from Hong Kong and use service providers that may process data in other countries. Expert recipients may also be outside your country. We do not promise that all information remains in Hong Kong or any particular region.

Where applicable law requires contractual safeguards, a valid transfer mechanism, an assessment or other conditions, those must be addressed for the relevant transfer. This notice is not itself a transfer agreement, a claim that every destination has equivalent laws, or blanket consent to otherwise unlawful transfers.

8. Cookies and browser storage

The core platform uses an essential sign-in session cookie with a rolling expiry of up to 30 days, subject to earlier sign-out or invalidation. Browser storage also keeps a display-theme preference. Blocking essential cookies may prevent account functions from working.

No behavioural advertising or audience-tracking integration is part of the current application code. Email service providers and external sites can process their own delivery or usage metadata under their settings and notices. If we introduce non-essential tracking that requires consent, it must be disclosed and controlled before it is enabled.

9. Retention and security

We keep personal data for the purposes described above and for no longer than reasonably necessary, taking account of an active account, event administration, unresolved requests or disputes, evidence of consent, fraud prevention and applicable legal requirements. When no longer needed, information should be deleted or effectively anonymized. A narrowly scoped legal hold may justify longer retention.

Verification codes expire after 15 minutes; session expiry and code expiry are not promises that every underlying record or backup is physically erased at that moment. Backups, provider logs and copies held by independent recipients have separate lifecycles.

We use access controls and security checks, and store account passwords as salted hashes. No internet service is risk-free, and we do not guarantee absolute security. Contact us promptly if you suspect misuse.

10. Your rights and contact

You can edit supported profile fields in your account. To request access, correction, closure, deletion, restriction, portability or withdrawal where available under applicable law, email our contact address with enough information to identify the relevant account or registration. You do not have to hold an account to make a request.

We may verify identity and ask for clarification proportionate to the request. Do not send identity documents unless we specifically explain why they are necessary and provide an appropriate channel. We may retain limited information where required or permitted by law and will explain a lawful refusal or limitation. We apply the relevant statutory response period; no universal deadline or fee is imposed by this notice.

For direct marketing, you can request that it stop without charge. For information already received by an expert, you may also exercise rights with that organization. You may complain to Hong Kong's Privacy Commissioner for Personal Data (pcpd.org.hk), or another competent authority where applicable.

11. Age and changes

The service is intended for adults aged 18 or older and is not directed to children. Contact our contact address if you believe a child has provided personal data so we can review the situation.

We identify the version of this notice on this page. Material changes will be highlighted on the website or by another appropriate notice; changes requiring new consent cannot be made lawful simply by posting an updated notice.