Privacy Policy

Hero.events operates the Hero app (hero.events) and is the organisation responsible for the personal data described here. Questions, requests or complaints: our Data Protection Officer — [email protected].

• Account details: name, email, phone number, password (stored only as a one-way hash), and for Heroes optional district, bio and skills.
• Age and consent (Heroes): date of birth and, for Heroes aged 16–17, the signed parental or guardian consent document you upload.
• Activity: tasks you post, applications, accepted/declined status, ratings and reviews, notifications, saved tasks, verification requests and reports.
• Payments: payment status and reference for listing fees. We do not store card numbers.
• Technical: a random visitor ID (cookie), pages viewed, device type (mobile/desktop), referring website and language choice. The application does not store IP addresses; our hosting provider’s server logs may.

To create and run your account; show Hero profiles and applications to the Employers you apply to; connect Employers and Heroes (phone and email are shown to an Employer only after they accept you); send notifications and emails about your tasks; process listing fees; prevent fraud, abuse and repeat registration by suspended users; keep platform statistics; and meet legal obligations. We use your data only for these purposes or others we tell you about.

We collect, use and disclose your personal data with your consent, given when you sign up, or where the law allows without consent. You may withdraw consent at any time by deleting your account in Account or by emailing us; we will explain any consequences (for example you will no longer be able to use the Hero app).

Employers see a Hero’s name, level, jobs done, ratings, skills, district and bio; contact details only after acceptance. Heroes see an Employer’s business name, task and verification status. We share data with service providers who help us run the Hero app (web hosting, email delivery, online payment processing) under appropriate protections, and with authorities where required by law.

Our hosting and service providers may store or process data on servers outside Brunei Darussalam. Where this happens we take reasonable steps to ensure the data is protected to a standard comparable to the PDPO.

Account data is kept while your account is active. Parental consent documents are deleted when the Hero turns 18 or deletes their account. When you delete your account, personal details are erased or anonymised; records of completed tasks are kept in anonymised form. Visit statistics are kept up to 400 days and login-attempt records about one day. Where an account has been closed for safety reasons we may keep its email, phone number and name on a blocklist as long as needed to prevent re-registration, and records we must keep by law.

You may ask to access and correct your personal data, download a copy, withdraw consent and delete your account. Most of this is self-service in Account (Download my data, Delete my account, edit your profile). For anything else email [email protected]; we will respond within a reasonable time.

We use reasonable measures including password hashing, encrypted connections (HTTPS), access controls and login-attempt limits. If a data breach occurs that is likely to cause significant harm, we will assess it promptly and notify affected individuals and the authority as the PDPO requires.

We use essential cookies (keeping you signed in, remembering language) and a first-party anonymous visitor cookie for visit counts. We do not use advertising cookies.

Please contact us first. You may also contact the Authority for Info-communications Technology Industry of Brunei Darussalam (AITI), which oversees the PDPO.

We may update this policy and will show the date above. Address: Brunei Darussalam.