1. Who we are

. Data Protection Officer: to be named. Until then, ask at the Help Desk at any event.

2. What we collect

About you: your name; passport number; Kuwait Civil ID; WhatsApp/mobile number and email (both optional, each confirmed with a one-time code); a scrambled version of your PIN (we cannot see your PIN); your member card number; the events you sign up for and when and how you check in; whether you want announcements; and your answers to after-event surveys, if you give them.

About family members you add: their name, their relationship to you, their Kuwait Civil ID, and which events they come to. You may only add someone if they (or, for a child, their parent or guardian) agree. They do not get their own login or messages.

3. Why

To register you once; to let you and your family sign up for events; to confirm at the door that you signed up; to count attendance; to send you, if you agree, announcements, warnings, a reminder the day before an event you signed up for, and a short survey after an event you attended; and to improve future events. We do not use it for anything else, and we never use it for advertising.

4. Legal basis

Your consent, which you give when you tick the box, and, for family members, their consent given through you. You can withdraw it anytime; we then delete the record (we cannot give event passes without it). You can turn off WhatsApp messages anytime in "My account" and still use your Event Pass.

5. Who sees it

Admins of see full records. Door staff see only names, whether someone signed up, and the last digits of their ID numbers, to match them with the card in front of them. Survey answers are shown to admins without names.

Our service providers store or send it for us and may only use it to provide the service: Supabase (database, servers in Frankfurt, Germany), Cloudflare (website), Infobip (WhatsApp messages and codes) and Resend (email codes).

6. Outside the Philippines

Your information is stored on servers in Germany, passes through our messaging providers, and is used in Kuwait. We protect it as the Philippine Data Privacy Act of 2012 requires.

7. How we protect it

The database is locked; only named admins can see records, and they sign in with a password and a code from their phone; PINs and one-time codes are scrambled; QR codes and links contain no personal details; repeated wrong PINs are blocked; and every check-in, look-up, export, PIN reset, card replacement, deletion and message blast is logged.

Your Event Pass link and member card work without a PIN, so treat them like a ticket: anyone holding them could check in as you. If you lose your member card, replace it in "My account" or at the Help Desk and the old one stops working.

8. How long we keep it

Your record, your family members and your survey answers are deleted after 2 years without any event or log-in, or sooner if you ask. Removing a family member deletes their details straight away. Event attendance links are removed 2 years after the event (only totals are kept). One-time codes are deleted within a day. Activity logs are kept for 3 years.

9. Your rights

Under the Data Privacy Act you (and family members you added) can: be informed; see a copy of your data; correct it; object or withdraw consent; have it deleted or blocked; get a copy in a common format; and complain to the National Privacy Commission (privacy.gov.ph).

10. How to ask

Delete your account or remove a family member yourself under "My account" on the Event Pass page, or ask at any event Help Desk (bring your passport or Civil ID). We reply within 5 days and finish within 15 working days.

11. If something goes wrong

If your data is leaked, we will tell you and the National Privacy Commission within 72 hours, as the law requires.

12. Changes

If we change this notice, we will show it to you the next time you open your Event Pass and ask you to agree again.