Privacy Policy Statement / Personal Data Collection Statement

Effective Date: 1 January 2020

---

1. Introduction

Event Management Dalang! ("Event Management Dalang", "we", "us" or "our") respects your privacy and is committed to protecting personal data.

This Privacy Policy Statement and Personal Data Collection Statement explains how we collect, use, store, retain, disclose and protect personal data when you access or use our website, event management platform and related services (collectively, the "Services").

We are committed to complying with the Personal Data (Privacy) Ordinance (Cap. 486 of the Laws of Hong Kong) ("PDPO") and other applicable data protection laws.

This Statement applies to personal data collected from our customers, account holders, event organizers, event applicants, participants and other individuals who interact with our Services.

---

2. Scope and Roles

Our Services enable customers to create and manage events, customize online registration forms, collect registration information, distribute QR Code admission credentials, manage event check-in and check-out, view attendance statistics and export relevant records.

Depending on the circumstances, we may collect and use personal data for our own business purposes, or process personal data on behalf of customers who use our Services to manage their events.

Where an event organizer collects personal data from applicants or participants through our platform, the organizer may determine the purposes for which that information is collected and used. The organizer is responsible for ensuring that an appropriate personal data collection statement or privacy notice is provided to participants and that the collection and use of their personal data comply with applicable laws.

Our processing of event participants' personal data on behalf of an organizer does not necessarily mean that we determine the purposes for which the organizer collects and uses that data.

---

3. Personal Data We Collect

We collect personal data that is necessary and appropriate for the purposes described in this Statement.

Depending on how you use our Services, the personal data we may collect includes:

A. Account holders and customers

• Full name
• Email address
• Telephone number
• Account login and authentication information
• Service requests, enquiries and communications with us
• Transaction, payment and service-plan information, where applicable

---

B. Event applicants and participants

When you register for or participate in an event managed through our platform, the information collected may include:

• Name
• Email address
• Telephone number
• Registration details and answers to questions in the event registration form
• Registration status and relevant event records
• QR Code admission credential information
• Check-in and check-out records, including relevant dates and times
• Other information that the event organizer requests through the registration form

The specific information collected from event applicants and participants depends on the requirements of the relevant event organizer and the registration form.

---

C. Technical and usage information

When you access our website or Services, we may collect limited technical information, such as browser information, device information, access logs, cookie data and information about how the Services are used.

The provision of certain personal data may be necessary for account registration, event registration or the provision of particular Services. Where information is required, the relevant form or interface should indicate this where appropriate. Failure to provide required information may prevent us from providing the relevant Services or completing the requested registration.

We do not intentionally collect personal data that is unnecessary for the relevant purposes. If an event organizer requests additional information, the organizer is responsible for ensuring that the collection is lawful, necessary and appropriate.

---

4. Purposes of Collection and Use

We may collect and use personal data for one or more of the following purposes:

• Creating, verifying and managing customer accounts;
• Providing, operating and maintaining our Services;
• Creating and managing events and customized registration forms;
• Processing event registrations and communicating registration-related information;
• Generating and distributing QR Code admission credentials;
• Recording event check-in and check-out activities;
• Producing attendance statistics and facilitating data export;
• Processing purchases, payments and service requests;
• Responding to enquiries and providing customer support;
• Maintaining service security, preventing unauthorized access and investigating suspected misuse;
• Conducting internal administration, auditing and business management;
• Performing statistical analysis using aggregated or anonymized information to improve our Services and product quality;
• Complying with legal, regulatory or court requirements;
• Exercising or defending our legal rights; and
• Other purposes directly related to the above, or any other purpose for which the relevant individual has provided the required consent.

Personal data collected for event registration and attendance management may be made available to the relevant event organizer and authorized personnel as necessary to administer the event. The organizer's own use of that information is subject to the organizer's applicable privacy notice and legal obligations.

---

5. Direct Marketing

We may wish to use your personal data, such as your name, email address or telephone number, to provide information about our own products, Services, promotions and special offers.

Where required under the PDPO, we will inform you of the relevant details and obtain your consent or indication of no objection before using your personal data for direct marketing.

You may opt out of receiving direct marketing communications at any time, free of charge, by contacting us or following the unsubscribe instructions provided in our communications.

We will not use event participants' personal data for our own direct marketing purposes unless the applicable legal requirements have been satisfied.

Event organizers are responsible for ensuring that their own marketing communications to event applicants or participants comply with applicable laws, including obtaining any required consent.

---

6. Disclosure and Transfer of Personal Data

We do not sell personal data to third parties as part of our ordinary business operations.

We may disclose or make personal data available to the following classes of persons where reasonably necessary for the purposes described in this Statement:

• The relevant customer or event organizer and its authorized personnel;
• Service providers supporting our website, hosting, data storage, email delivery, MMS delivery, technical maintenance, security and other operational functions;
• Payment service providers, where applicable;
• Professional advisers, auditors and insurers where reasonably necessary;
• Courts, law enforcement agencies, regulators or government authorities where required or permitted by law; and
• Other persons where the relevant individual has given consent or where disclosure is otherwise permitted or required by applicable law.

Where we engage service providers to process personal data on our behalf, we will take reasonable steps to ensure that appropriate contractual or other safeguards are in place to protect the data.

We will not disclose personal data to third parties for their independent direct marketing purposes unless the applicable legal requirements have been satisfied, including obtaining the required consent.

---

7. International Data Transfers

Personal data may be processed, stored or backed up on servers located outside Hong Kong, depending on our hosting arrangements and the services provided by our service providers.

The laws and data protection standards in those jurisdictions may differ from those in Hong Kong.

Where personal data is transferred outside Hong Kong, we will take reasonable steps to protect the data and comply with applicable legal requirements.

---

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, provide our Services, resolve disputes, maintain appropriate business records or comply with legal and regulatory obligations.

The retention period for event registration and attendance records may depend on the relevant event organizer's requirements, the applicable service arrangements and any relevant legal obligations.

Where we process personal data on behalf of an event organizer, retention, return and deletion of that data may be governed by our arrangements with the organizer, subject to applicable law.

When personal data is no longer required, we will take reasonable steps to securely delete, anonymize or destroy it, unless retention is required or permitted by law.

---

9. Information Security

We implement reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss or destruction.

Depending on the nature of the information and the risks involved, our measures may include:

• Password protection and authentication controls;
• Appropriate password and account security requirements;
• Encrypted data transmission using SSL/TLS technologies where supported;
• Restricted access to personal data on a need-to-know basis;
• Confidentiality obligations for relevant personnel and service providers;
• System monitoring and security reviews; and
• Periodic review and improvement of our security measures.

Although we take reasonable steps to safeguard personal data, no method of electronic transmission or storage can be guaranteed to be completely secure.

---

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies to support website functionality, remember preferences, maintain sessions and improve the browsing experience.

Cookies are small text files stored on your device. Some cookies may be necessary for the operation of the website, while others may help us understand website usage or improve our Services.

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect the availability or functionality of some features.

---

11. Access to and Correction of Personal Data

Under the PDPO, you may have the right to request access to personal data held about you and to request correction of inaccurate personal data, subject to applicable legal requirements and exemptions.

Where applicable, you may also request the deletion of personal data or withdraw consent for a particular use of personal data. Any such request will be handled in accordance with applicable law and our relevant service arrangements.

If your personal data was collected by an event organizer through our platform, you should generally contact that organizer first regarding access to or correction of your event registration information. We will provide reasonable assistance where appropriate and where we are authorized to do so.

To submit a request to us, please contact us using the details in Section 14. We may request information reasonably necessary to verify your identity and clarify the scope of your request.

---

12. Your Responsibilities When Using the Services

If you use our Services to collect personal data from event applicants or participants, you are responsible for:

• Collecting only personal data that is necessary and appropriate for the relevant event;
• Providing an appropriate personal data collection statement or privacy notice at or before the time of collection;
• Explaining the purposes for which the data will be used and the relevant classes of persons to whom the data may be transferred;
• Identifying whether the provision of particular information is obligatory or voluntary, and explaining the consequences of failing to provide required information where applicable;
• Obtaining any consent required by applicable law, including consent for direct marketing where required;
• Restricting access to event data to authorized personnel;
• Using and retaining the data only for lawful purposes; and
• Responding appropriately to requests from participants concerning their personal data.

You must not use our Services to collect, disclose or process personal data unlawfully or for purposes inconsistent with applicable law.

---

13. Changes to this Statement

We may update this Privacy Policy Statement and Personal Data Collection Statement from time to time to reflect changes in our Services, business operations or applicable legal requirements.

The revised version will be published on our website together with its effective date.

Where required by law, we will provide additional notice or obtain consent before making a material change to the purposes for which personal data is used.

Your continued use of our Services after the revised Statement becomes effective does not, by itself, constitute consent to any new use of personal data for which consent is legally required.

---

14. Contact Us

If you have any questions, comments or requests regarding this Statement or our handling of personal data, please contact us:

Email: cs@oscrapa.com

We will normally respond within fourteen (14) business days after receiving your request, subject to identity verification where necessary and the complexity of the request.

---

15. Language

This Statement is available in English and Chinese.

If there is any inconsistency or discrepancy between the English version and the Chinese version, the English version shall prevail.