The Ministry of Homeland Security, Labour and Technology runs VARA Expo. This page explains what this website collects about you, why, how long it is kept, and who to ask about it. It covers this website only.
We ask for as little as we can. We do not sell your information, we do not share it for anyone's marketing, and there is no advertising on this site.
What we collect, and why
If you register for a workshop we collect your name, national ID number, email address, phone number, age range and gender. The name and ID number hold a seat in your name and stop the same person taking two. The email and phone are how we confirm your place and tell you if anything changes. Age range and gender are used only as counts, to report who the programme reached.
If you register as an exhibitor we collect your company name and description, the name, email address and phone number of your contact person, and any website, LinkedIn or social handle you give us. We need these to allocate a stand, confirm it, and reach you about logistics and payment.
If you book an interview slot we collect your company name, contact person, email address and phone number, so we can hold the slot and tell you if it moves.
If you send us a message we keep your name, email address, subject and message, so we can reply.
If you ask for updates by email we keep your email address and the date you asked. You can leave at any time using the link in any email we send, and that link works in one click.
With every form we also record the IP address it was sent from, and for exhibitor registration the browser's user agent. This is how we tell a person from an automated script and stop the same form being submitted thousands of times. It is deleted along with the rest of the record.
What we do not do
- No analytics and no tracking. This site runs no analytics service, no advertising network and no social media pixels. Nobody is building a profile of your visit.
- No tracking cookies. The site sets one cookie. It keeps your place in a form, so a half-finished registration is still there when you come back to the page, and it does nothing else. It is not shared, and it is not used to recognise you on other websites.
- No selling or sharing. We do not sell personal data and we do not pass it to anyone for their own purposes.
Who else handles it
Running a website means other companies necessarily handle some of this. They act on our instructions and for no other purpose.
- Cloudflare sees your IP address and the pages you request, and runs the check that appears on each form. It sits in front of this site and is what keeps automated submissions out.
- Resend sees the address we are writing to and the contents of that email. It delivers our email.
- Honeybadger receives technical details when something on the site breaks. Personal data is stripped out before the report is sent.
- Our hosting and backup providers hold encrypted copies of the database. The site has to run somewhere, and backups have to be kept somewhere else.
These providers, and the servers this site runs on, are outside the Maldives.
How long we keep it
Personal data is deleted 365 days after the event it relates to. This happens automatically: names, ID numbers, email addresses, phone numbers and IP addresses are erased from the record.
What remains after that is the account of the event itself and no longer identifies anybody: how many people attended, which zones and sessions they chose, the age and gender counts, and the organisational record of which companies exhibited.
Messages sent through the contact form are deleted entirely once the same period has passed.
Backups. Encrypted backups that still contain personal data are kept for up to 12 months after that, and are then destroyed. A backup cannot be edited, so information already deleted from the live site may remain in a backup until it expires.
How it is protected
- National ID numbers are encrypted in the database rather than stored as plain text. So are the phone numbers given on a workshop registration.
- Staff see ID numbers masked by default. Revealing one is recorded, with the name of the staff member who did it.
- Every export of personal data is recorded the same way.
- Staff accounts are individual, each with its own password. There is no shared login.
- All backups are encrypted before they leave the server.
- The whole site is served over HTTPS, and a request over plain HTTP is redirected rather than answered.
If you are under 18
You can register for a workshop, and we ask that you do so with a parent or guardian's knowledge. We do not ask for anything beyond what is listed above.
Asking us about your information
You can ask what we hold about you, ask us to correct it, or ask us to delete it before the period above. Write to us through the contact page and say what you are asking for. If you registered for a workshop and want that registration removed, tell us and we will delete it.
Changes to this page
If this page changes we will update the date below. If something changes that affects a registration you have already made, we will email you about it rather than only changing this page.