Who we are. [ENTITY] (Party Action People), registered in Singapore, [REG NO], [ADDRESS], is the controller of personal data collected through pe4ks.com, PE4KS ticketing, the PE4KS event app, and PE4KS mailing lists. Contact: [privacy@ email — DECIDE].
What we collect, and why
| When you… | We collect | Purpose | Basis |
|---|---|---|---|
| browse in the Standard state | anonymous, cookieless usage signals: pages, referrer, device class; no identifier [counsel — Standard also sends page-performance measurements (LCP, INP, CLS) as the web_vitals event through the same GA4 container: docs/13 §3 item 11, task 025] | to know the site works and where visitors come from | legitimate interest; no consent required |
| choose Personalise | analytics cookies; ad-audience identifiers (Google, LinkedIn); a HubSpot tracking cookie linking your visits to your contact record if you give us an email | measurement, relevant advertising, remembering you | your consent, withdrawable in one click from the header |
| choose Private | nothing beyond the server log needed to deliver the page | — | — |
| join the mailing list | email; optionally name, company, role; which cities and summits you're interested in | to send you PE4KS updates | consent (double opt-in where required) |
| register interest or buy a ticket | name, email, company, role; payment handled by our ticketing platform; if you pay in stablecoin, the wallet address used | to sell and deliver your ticket, run the event, comply with tax law | contract |
| apply to speak or sponsor | what you enter in the application form | to assess and respond | legitimate interest / pre-contract |
| use the event app | your ticket identity; meetings you accept; sessions you attend; badge scans you consent to at a sponsor stand | to run networking and check-in | contract; consent for sponsor scans |
| attend | your image and voice in photography and recordings of the event | event coverage and archive | legitimate interest, with the on-site opt-out described in the event terms |
Who processes it for us (processors, current): HubSpot (CRM, email) · agendaforge (programme, applications) · our ticketing platform, hosted on Supabase ([region — DECIDE]) · Vercel (hosting) · Google (analytics and ads, Personalise state only) [counsel — Standard also loads GA4 through GTM in Consent Mode denied: cookieless pings, no identifier; D-019, D-047 (a)] · Beehiiv (newsletter) · Slack (internal approvals — no attendee data). Sponsors receive only what you give them yourself: a scan you accept at their stand, or a meeting you accept. We never publish or share an attendee list. Where we show "who's in the room" we show organisations and counts, never people.
Where it goes. Singapore, the EU/UK, the US. Transfers rely on [SCCs / IDTA / adequacy — counsel].
How long. Mailing list: until you unsubscribe or 24 months of no engagement, then non-marketing. Ticket and tax records: [statutory period per 15]. Applications: 24 months. Analytics: GA4 retention set to 14 months.
Your rights. Access, correction, deletion, portability, objection, withdrawal of consent, complaint to your regulator — one email to [privacy@], answered within 30 days. Region-specific rights sections: UK/EU · US (New York) · Hong Kong · UAE/ADGM · Singapore — text per 15.
Cookies. We set one first-party cookie in every state: the one that remembers which state you chose. [counsel — the site also sets pe4ks-utm, a first-party cookie holding the campaign parameters of the first and the most recent landing, with no identifier, for 90 days, in Standard and Personalise; choosing Private deletes it: D-058 (c), src/lib/tracking/utm.ts] In Personalise we set the analytics and advertising cookies listed at /legal/privacy#cookies (table generated from the GTM container, not hand-maintained). [DECIDE — the cookies table is not built: 14 §1 generates it from the GTM container] We use no consent-management vendor.
Changes. Version and effective date at the top; the changelog lists every change.