Privacy Policy

1. Who We Are

Connect Events is operated by Connect Marketing FZE, a Free Zone Establishment incorporated in the United Arab Emirates under trade licence no. 4418442.01 ("Connect", "we", "us" or "our"). We operate the digital ticketing platform at events.byconnect.io (the "Platform"), through which registered Connect ambassadors purchase tickets to Connect's global summit events.

For the purposes of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), Connect Marketing FZE is the controller responsible for the personal data described in this policy, meaning we decide why and how that personal data is processed on the Platform.

If you have any questions about this policy or about how we handle your personal data, you can contact us at support@connect.ac.

2. Scope of This Policy

This policy explains what personal data we collect through the Platform, how and why we use it, who we share it with, and the rights available to you. It applies to everyone who accesses or uses Connect Events.

Browsing the Platform is open to all visitors. Purchasing tickets is restricted to registered Connect ambassadors: to buy tickets you must sign in with your Connect ambassador email, your membership is verified against Connect's BackOffice system, and a one-time code (OTP) is emailed to you to confirm your identity. This policy covers the personal data involved in that sign-in process as well as in browsing, checkout, payment and ticketing.

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Account and identity data: your ambassador name, email address and Connect ambassador/distributor ID, obtained when we verify your membership against Connect's BackOffice system.
• Authentication data: the short-lived one-time codes (OTPs) we email you to confirm your identity at sign-in.
• Attendee data: the name of the attendee entered for each ticket in an order. Where the attendee is someone other than you, you confirm that you are authorised to provide their name to us for ticket issuance and entry.
• Order and payment metadata: the order amount, the order and payment status, the payment reference or transaction identifier, and the cryptocurrency used for payment.
• Ticket data: the digital tickets issued to you, including each ticket's unique ID and QR code, and its check-in status at event entry.
• Technical and usage data: your IP address (used for rate-limiting and security) and your device and browser information.
• Marketing preferences: whether you have subscribed to our optional "Stay Connected" email updates.

4. What We Do Not Collect

Payment for tickets is made in cryptocurrency only and is processed by our third-party payment processor. Each order is paid to a unique deposit address, and the order is confirmed only after the payment is confirmed on-chain and your tickets are issued.

We do not receive, collect or store card numbers, bank account details, or cryptocurrency wallet private keys. We hold only the order and payment metadata described in Section 3.

5. How and Why We Use Your Data, and Our Legal Bases

We use your personal data only for clear purposes, and each is supported by a legal basis under the PDPL:

• To verify your Connect ambassador membership, authenticate your sign-in with a one-time code, and give you access to the Platform — necessary to provide the service you request (performance of our contract) and to operate a members-only Platform (our legitimate interests).
• To process your orders, issue tickets to the named attendees, confirm on-chain payment, and deliver your digital tickets and QR codes — necessary for the performance of our contract with you.
• To validate tickets at event entry through QR check-in — necessary for the performance of our contract and to run our events securely (our legitimate interests).
• To keep the Platform secure, prevent fraud and abuse, and apply rate-limiting — our legitimate interest in protecting the Platform and its users.
• To send you "Stay Connected" updates about Connect events — only where you have given your consent, which you may withdraw at any time.
• To contact you if an event you hold a ticket for is changed or cancelled — necessary for the performance of our contract and our legitimate interest in keeping you informed.
• To comply with applicable law and respond to lawful requests from competent authorities — necessary for compliance with our legal obligations.

6. Cookies and Local Storage

We use only a minimal set of cookies and browser storage, focused on making the Platform work rather than on tracking you. We do not use third-party advertising or cross-site tracking cookies.

• An essential session cookie that keeps you securely signed in after authentication. The Platform cannot function without it.
• Local storage in your browser that remembers your shopping cart and your light or dark theme preference.
• An optional "Stay Connected" email subscription that you may choose to join to receive updates; this is based on your consent, and you can unsubscribe at any time.

7. How We Share Your Data

The Platform relies on trusted third-party service providers, and completing a payment will take you to our payment processor. This policy does not cover the independent practices of those third parties, and we encourage you to review their own privacy policies before using them.

We do not sell your personal data. We share it only with the service providers (processors and sub-processors) that help us operate the Platform, and only to the extent each needs to perform its role. These providers may use your personal data solely on our instructions and must keep it confidential and secure. We share personal data with:

• NOWPayments — our third-party cryptocurrency payment processor, which handles the payment for your order. We share the order metadata needed to create and confirm the payment; we do not receive your wallet keys.
• Microsoft Azure — our cloud hosting provider, on which the Platform and its data are hosted, together with Azure Communication Services, which delivers our transactional emails (such as your one-time login codes and ticket confirmations).
• Connect BackOffice and Connect Marketing systems — used to verify your ambassador membership and retrieve your ambassador/distributor ID at sign-in.
• Competent authorities, regulators or legal advisers — where we are required to disclose data to comply with a legal obligation, or to establish, exercise or defend legal claims.

8. International Data Transfers

The Platform and its data are hosted on Microsoft Azure in the United Arab Emirates and Southeast Asia regions. Some of our processors may process personal data in locations outside the United Arab Emirates.

Where personal data is transferred outside the UAE, we take reasonable steps to ensure it remains protected in accordance with the PDPL, including through appropriate contractual and technical safeguards with the processors involved.

9. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purposes described in this policy, and to meet our legal, accounting and record-keeping obligations. When personal data is no longer required, we securely delete or anonymise it.

In practice:

• One-time login codes (OTPs) are short-lived and expire shortly after they are issued.
• Account and identity data is retained while you remain an active Connect ambassador using the Platform.
• Order and payment metadata and ticket records are retained for as long as needed to service your tickets and events, and thereafter for the period required by our record-keeping and legal obligations.
• Marketing preferences are kept until you unsubscribe from the "Stay Connected" updates.

10. How We Protect Your Data

We take the security of your personal data seriously and apply appropriate technical and organisational measures to protect it, including encryption of data in transit, access controls, and hosting on Microsoft Azure's secure infrastructure.

Because payment is made in cryptocurrency to a unique deposit address per order and is handled by our third-party payment processor, we do not hold card numbers or cryptocurrency wallet private keys, which materially reduces the sensitive payment data we store.

No method of transmission or storage is completely secure, and while we work hard to protect your personal data we cannot guarantee absolute security. Please help keep your account safe by protecting access to your ambassador email.

11. Your Rights Under the UAE PDPL

The PDPL gives you a number of rights over your personal data. To exercise any of them, or if you have concerns about how we handle your data, contact us at support@connect.ac and we will respond as required by the PDPL. You also have the right to lodge a complaint with the UAE Data Office.

Subject to the conditions and exceptions set out in the PDPL, these rights are:

• The right to be informed about how your personal data is processed.
• The right to access the personal data we hold about you.
• The right to request correction of inaccurate or incomplete data.
• The right to request erasure of your personal data in certain circumstances.
• The right to request that we restrict or stop processing your data in certain circumstances.
• The right to object to processing that is based on our legitimate interests.
• The right to data portability, where applicable.
• The right to withdraw your consent at any time where our processing is based on consent, such as marketing updates.
• Rights in relation to automated decision-making, where applicable.

12. Children

The Platform is intended for registered Connect ambassadors, who are adults. It is not directed at children under the age of 18, and we do not knowingly collect personal data from children.

If you believe a child has provided us with personal data, please contact us at support@connect.ac so that we can take appropriate action.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology or legal requirements. When we do, we will publish the updated policy on the Platform.

Where the changes are material, we will take reasonable steps to bring them to your attention. Your continued use of the Platform after an updated policy takes effect means you accept the revised policy.

14. Governing Law and Contact

This policy, and our processing of your personal data, are governed by the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. The competent courts of the United Arab Emirates have jurisdiction over any matter arising in connection with this policy.

If you have any questions, requests or concerns about this policy or about how we handle your personal data, please contact us:

Connect Marketing FZE, United Arab Emirates. Email: support@connect.ac.