Privacy Notice — Events and Marketing

1. Introduction

This Privacy Notice is issued by Wisesight (Thailand) Co., Ltd. (hereinafter referred to as the "Company" or "Wisesight") to describe the collection, use, and disclosure of personal data connected with the Company's organisation of events, meetings, seminars, training, marketing communications, and public relations.

This is to ensure that data subjects receive the information required under the Personal Data Protection Act B.E. 2562 (2019) (the "PDPA").

This Notice is addressed to the following groups of persons:

Event Attendees / Registrants — persons who register for events organised or co-organised by the Company, whether online or offline.
Speakers / Presenters / Panelists — persons invited to, or participating in presentations at, the Company's events.
Sponsors / Partners — natural persons acting as representatives of sponsors or partners.
Marketing Subscribers — persons who subscribe to newsletters, product news, event invitations, or other commercial communications from the Company.
Press / Media — persons acting in the capacity of journalists or media whom the Company contacts or invites to events.
Persons appearing in event photographs and videos — persons recorded during events for public relations purposes.

2. Collection of Personal Data

Collection directly from the data subject

Event registration via online forms on the Company's website or event platforms (e.g., Zoom Events, Microsoft Teams Live).
On-site registration.
Completion of newsletter or news subscription forms.
Submission of name cards or contact information at events, such as through prize draws, participation in activities, or the exchange of business cards.
Provision of information in questionnaires before, during, or after events.
Interaction at events, such as Q&A and typing comments in chat rooms.
Registration as a speaker or sponsor.

Collection from sources other than directly from the data subject

Co-organising partner organisations — lists of attendees invited by partner organisations.
Event sponsors — contact lists shared by sponsors.
Professional databases, for inviting journalists and speakers.
Referral lists from clients, partners, or previous event attendees.

3. Categories of Personal Data Processed

General personal and contact data

Full name (including title).
Email address.
Telephone number.
Job title and organisation.
Country and city of residence (for deliveries and time-zone determination).

Event-related data

Events registered for; dates and times of attendance.
Selection of sessions and workshops of interest.
Special dietary requirements (food preferences/restrictions, e.g., vegetarian, halal, food allergies) — only where the Company provides food at the event.
Accessibility requirements — e.g., stage access, wheelchair use.
Financial data (for events with fees).
Attendance log — entry/exit times, sessions attended.
Interaction at the event — questions, comments, participation in activities.
Post-event ratings and feedback.

Image and video data

Photographs and videos recorded during events.
Photographs of attendees at meetings, group photographs, and event activities.
Recordings of presentations and Q&A sessions.
Live streaming and live broadcasts.

Data of speakers, sponsors, and partners

Name and biography (bio) for publicity.
Profile photograph.
Job title and organisation.
Contact details (email, telephone).
Organisation logo.
Travel and accommodation data (where arranged by the Company).
Remuneration payment data (if any).

Data of marketing subscribers

Full name.
Email address.
Job title and organisation.
Interest categories selected by the recipient (e.g., product news, event invitations, industries of interest).
Frequency of receiving news.
Preferred language for communications.
Email open and link-click records (email engagement metrics) — for the analysis of communication effectiveness.
Unsubscribe records and reasons (if given).

Data of press and media

Name and media organisation.
Professional contact details.
News beat for which the journalist is responsible.
History of communications and interviews with the Company.
Published interview content recorded by the Company.

Sensitive personal data

In general, the Company does not collect sensitive personal data in the context of events and marketing, except:

Health data at a limited level, such as food allergies, for the preparation of food at events.
Disability data, for arranging accessibility at events.

4. Purposes and Lawful Bases of Processing

Event organisation, registration, delivery of admission tickets, and coordination with attendees — performance of a contract / legitimate interest.
Preparation of food and accessibility arrangements according to special requirements — explicit consent (for sensitive data).
Communication with attendees before, during, and after events — performance of a contract / legitimate interest.
Preparation of records, reports, and analysis of event outcomes — legitimate interest.
Photography and video recording for publicity, media production, and marketing — consent / legitimate interest.
Publication of images and videos on the Company's and partners' communication channels — consent / legitimate interest.
Delivery of newsletters and marketing communications — consent / legitimate interest.
Measurement of marketing communication effectiveness (open rate, click rate) — legitimate interest.
Invitations to future events and interest-based communications — consent / legitimate interest.
Coordination with event sponsors and partners — performance of a contract.
Invitation of, and coordination with, speakers — performance of a contract (with the speaker).
Compliance with tax and accounting law — legal obligation.
Establishment, exercise, or defence of legal claims — legitimate interest.

5. Data Recipients and External Data Processors

The Company may disclose your personal data to the following persons or categories of persons, to the extent necessary and consistent with the purposes of processing and the lawful bases:

Employees of the Company assigned to organise events and conduct marketing communications.
Affiliated companies, for joint service delivery and publicity.
Co-organisers and event partners — to the extent necessary for the event, subject to a Joint Controllership arrangement or DPA as appropriate.
Sponsors — to the extent the attendee consents to the sharing of data (if any); the Company will not share attendee lists with sponsors automatically.
Event platform providers (e.g., Eventbrite, Zoom Events, Microsoft Teams Live, Hopin).
Email marketing providers (e.g., Mailchimp, HubSpot Marketing, ActiveCampaign).
Meeting and live streaming providers (e.g., Zoom, Microsoft Teams, Vimeo, YouTube Live).
Event Production Vendors — event organisers, photography and video teams, catering providers, venue providers, technical providers (sound, lighting).
Badge printing and souvenir providers — for the production of badges and mementos.
CRM and Marketing Automation providers — for list management and ongoing communications.
Payment providers — for events with fees.
Press and media — to the extent the Company distributes event press releases.
Government authorities and law enforcement agencies — where there is a lawful order.
Persons to whom you consent — such as sharing your details with sponsors as authorised by you.

6. Cross-Border Transfer of Personal Data

Most processing and storage takes place in the cloud systems of Amazon Web Services and Google located in the Republic of Singapore.

In some cases, data may be transferred to other countries for the provision of services by external data processors, in which case the Company will ensure appropriate protection mechanisms as required by law.

7. Retention of Personal Data

The Company retains your personal data only to the extent necessary, for as long as the data continues to serve a lawful business purpose in relation to the purposes of processing.

When your personal data is no longer used for the above purposes, the Company will delete, destroy, or anonymise your personal data in accordance with its data destruction standards. However, in the event of a dispute, exercise of rights, or legal proceedings concerning your personal data, the Company reserves the right to retain such data until a final order or judgment is received.

8. Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer pursuant to Section 41 of the PDPA to provide advice, monitor compliance with the law, coordinate with the Office of the Personal Data Protection Committee (PDPC), and receive complaints from data subjects.

DPO contact details:

Email: dpo@wisesight.com
Address: 123 Suntowers Building B, 33rd Floor, Unit B3301–3304, Vibhavadi Rangsit Road, Chomphon Sub-district, Chatuchak District, Bangkok 10900
Telephone: 022741299

9. Rights of Data Subjects

Under the PDPA, data subjects have the following rights; the details and procedures for exercising each right appear in the relevant privacy notice:

Right to be informed. The Company will provide a "Privacy Notice" containing clear details of the purposes of processing, together with a "Cookie Policy" setting out the categories of cookie technologies the Company uses and the purposes of using such cookie technologies; and in the event that the Company processes data other than in accordance with those purposes, or outside the scope of any consent given, the Company will notify and/or seek consent from the data subject before processing personal data outside such purposes.
Right to withdraw consent. The data subject may withdraw consent previously given to the Company at any time.
Right of access. The data subject may request access to his or her personal data and a copy of the personal data processing activities, and may request that the Company disclose how such data was obtained.
Right to rectification. The data subject may request the correction of inaccurate personal data so that such data is accurate, up to date, and not misleading.
Right to erasure. The data subject may request that the Company delete or destroy personal data, or render personal data anonymous such that the data subject can no longer be identified.
Right to data portability. Where the Company's data systems support reading or use by generally available automated tools or devices, and the personal data can be used or disclosed by automated means, the data subject may request a copy of his or her personal data, request the automatic transfer of such data to another data controller, and request to receive the personal data so sent or transferred.
Right to restriction of processing. The data subject has the right to request that the Company restrict the use of personal data.
Right to object. The data subject may object to the processing of personal data.

Channels for Exercising Rights

Data subjects may exercise the above rights through the following channels:

Online DSAR form at https://wisesight.com/legal-and-privacy/data-subject-request
Email: dpo@wisesight.com
Written correspondence addressed directly to the DPO at the Company's office address.

10. Complaints and Contact Channels

Internal channel — data subjects may lodge complaints with the Company directly through the DPO via the channels specified.
Government channel — where a data subject is dissatisfied with the Company's handling of a matter, or wishes to lodge a complaint directly with a government authority, the data subject may contact: Office of the Personal Data Protection Committee (PDPC). Address: 7th Floor, Ratthaprasasanabhakti Building, The Government Complex, 120 Moo 3, Chaengwattana Road, Thung Song Hong Sub-district, Lak Si District, Bangkok 10210. Telephone: 02-142-1033. Email: saraban@pdpc.or.th. Website: https://www.pdpc.or.th

11. Review and Amendment

Review — The Company will review this Policy at least once a year, or upon a change in law, in PDPC guidance, or a material change in the business.
Amendment — The Company will announce amendments to employees and affected data subjects through the Company's website and appropriate internal channels.
Effectiveness — Amendments take effect on the date of announcement or the date specified in the announcement, whichever occurs later.