Last updated: 28 October 2026
This policy explains what personal data Korea Youth Summit collects when you use https://koreayouthsummit.com and the participant portal, why we collect it, who we share it with and what choices you have. The data controller is Yayasan Youth Break the Boundaries, an Indonesian foundation ("YBB", "we", "us"). Contact for anything privacy-related: [email protected]. This policy does not cover separate sites we run, such as our news site.
1. Data we collect
Account data. Email address, password (stored only as a one-way hash), and your sign-in method. If you sign in with Google, we receive your name, email address and Google account identifier from Google through Firebase Authentication.
Profile and application data. Depending on the program: full name and the name for your ID or certificate, date or year of birth, gender, nationality, phone number, address, country and city, education, occupation, organisations, achievements, social media or portfolio links, CV, profile photo, t-shirt size, and how you heard about us.
Health and special needs. Some programs ask for medical or health history, dietary restrictions and special needs so we can look after participants safely. This is sensitive data: we ask for it only for this purpose, limit who can see it, and you can choose not to provide it (though we may then be unable to make arrangements for you).
Emergency contact. Name, relationship, phone and email of the person you list. Please make sure they know you gave us their details.
Application content. Essays, motivation letters, answers, uploaded documents, review scores and reviewer notes, application status, and the documents we issue to you (for example Letters of Acceptance and certificates).
Payments. Invoices, amounts, currency, payment status and references, and the email on the payment. Card, e-wallet and virtual account details are entered on our payment provider's secure page and not stored by us. For manual bank transfers we store the proof of payment you upload (which may show your name and bank details).
Support and communications. Messages and support tickets you send us, notification and announcement history, newsletter subscription, and your email preferences.
Referrals. Referral or ambassador codes you enter, and referral activity linked to an ambassador's code.
Technical data. IP address, browser and device type, login times, security events and pages or actions in the portal. We use cookies and similar storage (section 8).
Advertising data. If you arrive from an ad, we store ad click identifiers (such as Meta fbp/fbc and TikTok ttp/ttclid) from your browser when you sign up, so we can measure which ads lead to registrations (section 5).
2. Why we use your data, and our legal bases
- Run your account and application (create accounts, review and score applications, select participants, contact you, issue letters and certificates, manage attendance). Basis: performing our agreement with you.
- Take and record payments and keep financial records. Basis: contract and legal obligation.
- Provide support and send service messages (verification, deadlines, results, receipts, reminders). Basis: contract and legitimate interests.
- Send announcements and marketing about Korea Youth Summit and other YBB programs. Basis: your consent or, where the law allows, legitimate interest. You can unsubscribe at any time.
- Keep the platform secure and prevent fraud and abuse. Basis: legitimate interests.
- Measure and improve our outreach (analytics and advertising conversions). Basis: your consent where required, otherwise legitimate interests.
- Run and promote our programs. We may use photos and videos taken at events, and essays or excerpts you submitted, for program operations and to promote Korea Youth Summit and other YBB programs. Basis: legitimate interest and, where required, your consent. You can opt out by emailing [email protected]; the opt-out applies going forward and does not reach material already published.
- Handle health data to protect participants. Basis: your explicit consent.
- Comply with law and defend legal claims.
Where we rely on consent, you can withdraw it at any time. By creating an account you confirm that you have read this policy.
3. Who sees your data
Within YBB: authorised program, admissions, finance, support and technical staff and reviewers, only as needed for their job. Ambassadors see only limited referral information linked to their own code, not your full profile.
We do not sell your personal data. We share it only with the following:
- Payment provider. Xendit processes online card, e-wallet and virtual account payments. Bank transfers are checked by our staff.
- Email delivery. Resend sends our transactional and program emails.
- Sign-in. Google / Firebase Authentication, if you choose Google sign-in.
- Hosting and security. Our servers are with Hostinger in Indonesia; Cloudflare provides content delivery, security filtering and its Turnstile bot check.
- Advertising and analytics. Meta (Facebook/Instagram pixel and Conversions API), TikTok (pixel and Events API) and Google Analytics, where enabled for Korea Youth Summit. Server-to-server ad events carry hashed email, phone or ID, plus IP address, browser details and click identifiers.
- AI support tools. We may use AI tools, such as Google's Gemini service, to help sort support requests by urgency. If enabled, the ticket category, subject and description may be processed by that provider.
- Program partners. Where needed to run a program, we may share the details needed (for example your name, nationality and travel dates) with host organisations and venues. If you ask us for a visa-support or invitation letter, we prepare it with the details needed for that letter. We do not give participant lists to sponsors or advertisers.
- Authorities and advisers where required by law, or to protect rights and safety, and in a merger or restructuring.
4. International transfers
We operate from Indonesia and our servers are in Indonesia. Through the providers above, your data may also be handled in other countries (for example Singapore, the United States and Europe) that may have different data-protection laws. Where the law requires it, we rely on contracts with those providers, your consent, or another transfer basis the law allows.
5. Advertising and analytics choices
Pixels and analytics load only if enabled for Korea Youth Summit. They record events such as viewing a program, creating an account, paying a fee and submitting an application. If you visit from the European Economic Area, the United Kingdom, Switzerland, Turkey or South Korea, they load only after you accept them in the cookie banner. Elsewhere they load by default and you can decline them in the cookie notice. You can change your choice at any time with the Cookie settings link in the website footer; declining stops these pixels and the matching server-to-server ad events sent from your browser, and deletes their cookies. You can also block them in your browser settings (section 8) or adjust your ad settings with Meta, TikTok and Google.
6. How long we keep data
We keep personal data for as long as needed to run the program and meet legal and accounting obligations; after that it is deleted or anonymised. In particular:
- Account and application data: while your account is active and as long as needed afterwards to handle alumni requests, documents and disputes, then deleted or anonymised.
- Financial records (invoices and payment records): kept as long as the law and our accounting require, even if you delete your account.
- Issued Letters of Acceptance and certificates: kept as a record of what we issued, even after account deletion.
- Security and activity logs: about 180 days. Audit change logs: about 30 days. Expired sessions are deleted.
- Support tickets, emails and ad click identifiers: as long as needed for their purpose, then deleted or anonymised.
7. Your rights
Depending on where you live, you can ask to: access your data and get a copy; correct it; delete it; restrict or object to some uses; withdraw consent; and move your data to another service. You can update most profile details in your dashboard and request account deletion there.
Deletion works like this: after you ask, there is a 30-day grace period in which you can cancel (we email you before it ends); then we remove or anonymise your personal data, including your name, contact details, profile, essays and answers, and delete your sign-in credentials, except records we must keep (section 6).
To use any right, email [email protected]. We may need to verify your identity, and we will reply within 30 days. If you are unhappy with our answer, you may also contact the relevant data protection authority in your country (in Indonesia, the authority designated under Law No. 27 of 2022 on Personal Data Protection).
8. Cookies and local storage
- Essential: sign-in cookies (accessToken, refreshToken, activeRole) that keep you logged in, a referral cookie that remembers a referral code, and browser storage for your session, dashboard settings, a saved checkout cart, payment progress and auto-saved application drafts (so you do not lose your work). Clearing this signs you out and may remove unsaved drafts.
- Security: Cloudflare Turnstile may set cookies or run checks at checkout.
- Analytics and advertising: Google Analytics cookies, Meta (_fbp, _fbc), TikTok (_ttp) and a saved TikTok click ID (ybb_ttclid), where enabled.
We remember your cookie choice in your browser storage (ybb_consent_v1). You can change it with the Cookie settings link in the footer, or delete cookies or block them in your browser settings. Blocking essential cookies will stop sign-in and some features from working; blocking analytics and advertising cookies will not.
9. Security
We use HTTPS, hashed passwords, role-based access, bot and brute-force protection, audit logs and regular backups. No system is perfectly secure. If a breach affects your data we will tell you and the authorities as the law requires.
10. Children and minors
Some programs accept participants from age 15. Participants aged 15 to 17 must have a parent or guardian's permission to register and take part, and by registering they confirm that they have it. We do not knowingly collect data from children under 15; contact us if you think we have, and we will delete it.
11. Changes to this policy
We will post updates here with a new date and, for material changes, notify you by email or in your dashboard.
12. Contact
Yayasan Youth Break the Boundaries (YBB), Indonesia. Email: [email protected].