Privacy Policy.
What we collect, and why.

Henna Beyond Borders (HBB) is organised by Shaista Jalal (Canada) and Sara Vazir (Hong Kong). Together they decide how the personal information collected through this website and the conference is used, and both can be reached at hennabeyondborders@gmail.com.

When you register. Your name, email address, age, country, Instagram handle (optional), where you are in your henna journey, why you want to join, dietary requirements, your room-sharing preference, how you would like to pay, and your acceptance of the Terms & Conditions.

When you contact us. Your name, email address, country (optional), the type of enquiry and your message.

After your place is confirmed, by email rather than through the website: payment confirmations, flight details for airport transfers, and, only if you ask for a visa invitation letter, your passport details.

During the conference. Photographs and video in which you may appear (see the Terms & Conditions for how these are used and how to opt out).

Automatically. Our hosting provider keeps standard server logs (IP address, browser type, pages requested) for security and to keep the site running. We do not run advertising trackers or sell data.

• to review and confirm your registration and manage your booking and payments;
• to organise the conference: rooming lists, dietary needs, airport transfers, workshop materials and certificates;
• to answer your questions and send you practical information before and after the event;
• to issue a visa invitation letter if you ask for one;
• to tell you about future editions of Henna Beyond Borders (you can opt out at any time);
• to keep the website secure and to meet our legal and accounting obligations.

We rely on the booking agreement with you, our legitimate interest in running the conference, and, for marketing and photography, your consent.

Only the people and services needed to run the conference:

• The conference resort, which receives names, room-sharing pairs and dietary requirements, and may need passport details for Indonesian guest registration.
• Transfer providers, who receive names and flight details for airport pick-ups.
• Wise and Stripe, who handle payments on their own platforms under their own privacy policies. We never see your full card number.
• Our website and database hosting providers (the site is hosted on Vercel and form submissions are stored in a Supabase database provided through Lovable Cloud), which process data on our behalf.
• Email providers used to correspond with you.
• Authorities where the law requires it.

Instructors receive first names and henna experience levels only, so they can plan their classes.

The organisers are based in Canada and Hong Kong, the conference takes place in Indonesia, and our hosting providers run servers in several countries. Your information will therefore be transferred outside the country you live in. We only use providers that protect data to a standard comparable to Canadian privacy law, and we keep the amount of information shared to the minimum needed.

• Registration and booking records: until the end of the conference plus the period required for accounting (normally seven years for payment records).
• Passport details: deleted within 30 days after the conference ends.
• Contact-form messages: up to two years after our last reply.
• Marketing consent: until you withdraw it. Photographs: as long as they remain in use, unless you ask us to remove one.

Depending on where you live you may have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct or delete it;
• withdraw consent to marketing or photography;
• object to or restrict certain uses;
• complain to your local privacy regulator (in Canada, the Office of the Privacy Commissioner).

To exercise any of these, email us. We will reply within 30 days. We may need to keep some information after a deletion request to meet accounting or legal obligations.

Form submissions travel over an encrypted connection and are stored in a database that only the organisers can access. We do not store card details. No system is perfectly secure, so if we ever become aware of a breach affecting your information we will tell you promptly.

This website does not use advertising or analytics cookies. It stores only what is technically needed for the pages to work. Fonts are loaded from Google Fonts, and links to Instagram, the Indonesian immigration portal and the Bali tourism levy portal take you to sites with their own privacy practices.

The conference is for adults aged 18 and over and the website is not aimed at children. If you believe a child has sent us personal information, please email us and we will delete it.

We will update this page if our practices change, and mark it with a new date. If a change is significant we will also email registered participants. This policy forms part of our Terms & Conditions.