Privacy Policy

PRIVACY POLICY & PERSONAL DATA PROTECTION STATEMENT

Last Updated: October 11, 2026

1. GLOBAL PRIVACY COMMITMENT & INTRODUCTION

1.1 Statutory Framework and Global Commitment

This Privacy Policy and Personal Data Protection Statement is provided by the Platform operator ("we", "us", "our") to inform you of how we collect, process, protect, and manage your personal data when accessing our platform, registering an account, booking tickets, or interacting with organizations. We adhere to applicable global data protection regulations, including the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the United Kingdom General Data Protection Regulation ("UK GDPR"), the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"), the Singapore Personal Data Protection Act 2012 ("PDPA"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

1.2 Multi-Organisation Architecture

The Platform operates a multi-organisation architecture in which independent organisations ("Organisations") host events, manage timeslots, publish surveys, and coordinate volunteers under their own administrative scopes. The Platform acts as the primary data controller for platform-wide user accounts, authentication tokens, security telemetry, and the global virtual credit economy. When you interact with a specific Organisation's event or booking, that Organisation acts as an independent data controller for event management, attendance roster verification, and on-site door security. This Policy transparently governs both platform-level processing and scoped organization-level data interactions.

2. DATA WE COLLECT

We collect the following categories of data in accordance with the principles of data minimization and purpose limitation:

2.1 Account Information: Registered profile name, email address, normalized and encrypted mobile phone number (encrypted at rest using industry-standard AES-256-GCM algorithms), and securely hashed passwords (using bcrypt with adaptive salt rounds). These details are processed for account registration, identity distinction, and secure authentication.

2.2 Demographic and Voluntary Information: Voluntary user attributes including age range or birth year, gender, general geographic location/district, spoken languages, dietary restrictions, industry, occupation, and personal interests. General demographic fields are entirely voluntary. Mandatory Age Verification Exception: When you register for an event explicitly marked with statutory or venue-enforced age restrictions (e.g. 18+ adult-only admissions), providing your verified date of birth is mandatory to determine admission qualification.

2.3 Platform Activity and Transaction Data: Event registrations, ballot entries, queue waitlist tickets, Clovers transaction history, check-in validation records, store orders, survey submissions, and volunteer shift service logs.

2.4 Technical Telemetry & Security Data: Anonymized IP addresses, browser user agent, device operating system characteristics, session tokens, and security bot deterrence tokens (via Cloudflare Turnstile). This data is processed strictly to maintain network security, deter automated bot attacks, detect Sybil account farming, and safeguard platform integrity.

2.5 Third-Party Authentication Data: If you elect to authenticate using third-party single sign-on providers (e.g., Google, Apple, Discord), we receive your unique provider identifier, verified email address, and public profile display name. We never request or store your third-party credentials or passwords.

2.6 Push Notifications: If you install the Platform as a Progressive Web App (PWA) and grant permission for push notifications, we store standard push subscription endpoints. You may revoke push notification permissions at any time through your browser or device operating system settings.

3. LAWFUL BASES FOR PROCESSING & PURPOSES

3.1 Lawful Bases Breakdown (GDPR Article 6)

Under the GDPR and international data protection standards, we process your personal data under the following recognized legal grounds:

(a) Performance of a Contract (GDPR Art. 6(1)(b)): Processing necessary to fulfill our service agreement with you, including: creating and maintaining your account; issuing and validating event tickets; facilitating timeslot reservations and queue waitlists; delivering essential transactional service notifications (ticket QR codes, schedule alterations, emergency weather notices); managing your virtual Clovers balance; and processing store order redemptions.

(b) Legitimate Interests (GDPR Art. 6(1)(f)): Processing necessary for legitimate platform operational interests, provided such interests are not overridden by your privacy rights, including: automated bot defense via Cloudflare Turnstile; detecting and preventing multi-account farming, credential stuffing, and economic manipulation; maintaining system performance and security server logs; and computing aggregate, anonymized attendance statistics for venue capacity planning.

(c) Freely Given Consent (GDPR Art. 6(1)(a)): Processing based on your unambiguous, affirmative opt-in consent, including: sending optional promotional newsletters and platform updates; and processing optional voluntary demographic metrics (interests, dietary restrictions, industry). Consent may be withdrawn at any time without affecting the lawfulness of processing prior to withdrawal.

(d) Compliance with Legal Obligations (GDPR Art. 6(1)(c)): Processing necessary to satisfy statutory, regulatory, tax, or law enforcement disclosure duties under binding legal process.

3.2 Automated Decision-Making & Algorithmic Ballot Allocation

The Platform utilizes an algorithmic weighted ballot mechanism to allocate high-demand free tickets fairly. The allocation algorithm evaluates objective profile metrics (such as community engagement XP, level, verified attendance history, and past unexcused no-show penalties) to assign allocation probabilities. This automated process does not produce legal effects or similarly significant detriments, but ensures community fairness. Attendees have the right to request information regarding the criteria applied and to submit questions regarding their account standing by contacting privacy@clov.co.

4. DIRECT MARKETING & COMMUNICATIONS

4.1 Strict Opt-In Rule: We do not send promotional newsletters, direct marketing campaigns, or platform announcement blasts without your explicit, affirmative opt-in consent. During registration, the marketing consent checkbox is unchecked by default.

4.2 Independent Scoping: Platform-wide announcements are dispatched solely by Platform Administrators. Independent event organisations do not receive direct access to the global user email list.

4.3 Free and Instant Revocation: You may revoke direct marketing consent at any time, completely free of charge, by updating your profile preferences at /dashboard/profile, clicking the one-click unsubscribe link (compliant with RFC 8058) included in marketing emails, or contacting privacy@clov.co. Essential service notices (e.g. ticket delivery, password resets, weather cancellations) are non-promotional and will continue to be delivered.

5. ADMINISTRATIVE ROLE STRUCTURE AND DATA ISOLATION

The Platform enforces strict role-based access control (RBAC) and organisation scoping:

5.1 Platform Administrators (Superadmins): Superadmins maintain global platform operations, system security, and technical infrastructure. Superadmin access to personal data is logged, audited, and strictly limited to security investigations, legal compliance, and customer-requested support.

5.2 Organisation Managers & Event Administrators: Administrators within an Organisation have access strictly scoped to their own events, timeslots, and bookings. When an attendee registers for an event, event administrators may view the attendee's name, ticket code, masked contact information, attendance verification status, and declared age category strictly for on-site crowd control and admission. Demographic analytics (gender breakdown, age brackets, district representation) are provided to event organizers strictly in anonymized, aggregated form. Individual personal identities are never unmasked for demographic analytics.

5.3 Store Administrators: Store administrators access buyer shipping addresses and fulfillment notes solely to dispatch physical items purchased by the user, with no access to wider user profiles.

6. DATA SHARING, SUB-PROCESSORS & INTERNATIONAL TRANSFERS

6.1 Zero Commercial Sale: We do not sell, rent, lease, or monetize your personal information or attendee profiles to any third party for commercial advertising or data brokerage purposes.

6.2 Approved Technological Sub-Processors: We engage reputable third-party infrastructure providers operating under binding Data Processing Agreements (DPAs) with strict confidentiality and security terms:

6.3 International Data Transfers (GDPR Chapter V): Because our cloud infrastructure spans global tier-1 data centers, your personal data may be transferred to and processed outside of your country of residence (including outside the European Economic Area, the United Kingdom, or Hong Kong). Where personal data originating in the EEA, UK, or Switzerland is transferred to countries not recognized as providing an adequate level of data protection, we implement European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and robust supplementary technical measures (including encryption in transit and at rest) to safeguard your data.

7. DATA RETENTION & AUTOMATED PURGING

7.1 Active Account Retention: We retain personal data associated with your active user profile for as long as your account remains open and in use.

7.2 Automated Guest Record Pruning (30-Day Window): To enforce storage limitation, personal data belonging to unregistered guest attendees (including unmasked names, email addresses, and phone numbers) is automatically anonymized by scheduled system background engines thirty (30) days after the conclusion of the registered event.

7.3 Immediate Self-Serve Account Erasure: When you delete your account via /dashboard/profile, our system immediately purges your identifying name, email, phone number, demographic attributes, IP logs, linked OAuth accounts, active sessions, and stored delivery addresses. Transactional ledgers are permanently severed from your identity and linked to non-reversible anonymous hashes to preserve historical event capacity audit records.

7.4 Statutory Accounting & Audit Compliance: Following account erasure, identifying personal attributes are permanently purged, while non-identifiable financial transaction hashes and store order records are securely retained solely as pseudonymized audit ledgers to comply with statutory corporate, accounting, and tax compliance requirements (e.g. up to seven (7) years).

8. DATA SECURITY & INCIDENT NOTIFICATION

8.1 Technical & Organisational Safeguards: We deploy defense-in-depth security measures to protect personal data from accidental loss, unauthorized access, destruction, or disclosure. Safeguards include: AES-256-GCM encryption for telephone credentials; salted bcrypt hashing for passwords; TLS 1.3 / HTTPS encryption in transit; automated rate limiting; role-based administrative isolation; and regular vulnerability assessments.

8.2 Breach Notification Protocol: In the unlikely event of a security incident resulting in the unauthorized access or disclosure of personal data that presents a risk to your rights, we will notify affected individuals and the competent supervisory authorities (including the relevant European Data Protection Authority, the UK ICO, or the Hong Kong PCPD) within statutory timeframes (e.g. within 72 hours where feasible under GDPR Article 33).

9. YOUR GLOBAL PRIVACY RIGHTS

Depending on your jurisdiction of residence, you enjoy comprehensive, statutory rights regarding your personal data. We extend these rights universally to all users:

(a) Right of Access (GDPR Art. 15 / PDPO DPP 6): You have the right to obtain confirmation as to whether your personal data is being processed, and to receive a copy of your personal data.

(b) Right to Data Portability (GDPR Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON). Authenticated users can generate and download a complete copy of their profile data, tickets, and registrations directly from /dashboard/profile.

(c) Right to Rectification (GDPR Art. 16 / PDPO DPP 6): You have the right to correct inaccurate, outdated, or incomplete personal data at any time via your self-serve profile settings.

(d) Right to Erasure / Right to be Forgotten (GDPR Art. 17): You have the right to request the permanent deletion of your account and personal data, executable instantly via the self-serve "Delete Account" control at /dashboard/profile or by contacting privacy@clov.co.

(e) Right to Restriction of Processing (GDPR Art. 18): You have the right to request the restriction of processing where you contest data accuracy or lawfulness.

(f) Right to Object (GDPR Art. 21): You have the absolute right to object to the processing of your personal data for direct marketing purposes at any time.

9.1 Zero Administrative Fees & Response Timeframe

All Data Subject Access Requests (DSARs), correction requests, and erasure requests are processed completely FREE OF CHARGE. We do not charge fees to exercise your fundamental privacy rights. We will acknowledge and fulfill valid requests within thirty (30) calendar days of receipt. To exercise any right that cannot be fulfilled through your self-serve dashboard, email our Privacy Team at [privacy@clov.co](mailto:privacy@clov.co).

10. REGIONAL SCHEDULES & JURISDICTION-SPECIFIC NOTICES

10.1 European Economic Area (EEA) & United Kingdom

If you are located in the EEA or the UK, you have the right to lodge a complaint with a competent supervisory data protection authority in your EU member state of habitual residence, place of work, or place of the alleged infringement, or with the UK Information Commissioner's Office (ICO) (https://ico.org.uk).

10.2 United States (California CCPA/CPRA & State Privacy Laws)

Under the California Consumer Privacy Act as amended by the CPRA, California residents are entitled to specific disclosures:

10.3 Asia-Pacific (Hong Kong PDPO & Singapore PDPA)

For users in Hong Kong, this statement constitutes a Personal Information Collection Statement (PICS) pursuant to Data Protection Principle 1(3) of the PDPO. Voluntary and mandatory data fields are identified in Section 2. For users in Singapore, personal data is collected and managed in full compliance with the consent, purpose limitation, and protection obligations under the Singapore PDPA 2012. Enquiries or complaints may be directed to our Data Protection Officer at privacy@clov.co, or to the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), or the Personal Data Protection Commission, Singapore (PDPC).

11. COOKIES AND LOCAL STORAGE

11.1 Strictly Necessary & Functional Cookies Only: The Platform utilizes strictly necessary session cookies for core user authentication (`next-auth.session-token`), queue state verification (`tf_ticket_*`), and security fraud deterrence. We also store functional user preferences (such as light/dark theme preference and UI language selection).

11.2 No Third-Party Advertising Trackers: We do not deploy third-party advertising cookies, cross-site targeting beacons, or commercial tracker pixels. Because our cookies are strictly necessary for service delivery requested by you, no intrusive consent pop-up banner is required under ePrivacy Directive Article 5(3).

12. MINORS AND CHILDREN'S PRIVACY

The Platform is intended for general audiences aged 18 and older, or individuals who have attained the age of digital consent in their jurisdiction of residence. We do not knowingly collect personal information from children under 13 (or under 16 in certain European jurisdictions) without verifiable parental consent. If we learn that personal data from an unauthorized minor has been collected without parental consent, we will promptly delete such data.

13. CHANGES TO THIS POLICY

We may revise this Privacy Policy periodically to reflect technological enhancements, operational changes, or new regulatory standards. Material changes will be published on this page with an updated "Last Updated" date. If modifications materially alter your rights, we will provide prominent notice on the Platform or via registered email prior to the changes taking effect.

14. DATA PROTECTION OFFICER & CONTACT INFORMATION

For questions regarding this Privacy Policy, your personal data, or to exercise any data protection rights, please contact our Data Protection Officer and Privacy Team at:

By using this Platform, you acknowledge that you have read and understood this Privacy Policy.