Personal Data Protection and Privacy Notice

Event organiser

Cradle determines the Event, ticketing and attendee-management purposes described in this Notice and is expected to act as the principal data controller for those activities.

Ticketing technology provider

GoConference for Cradle LIVE! Summit 2026 is operated by Borneo Digital PLT (SSM: 201904000699), Tingkat 1, Lot 155, Bangunan Tabung Haji, Jalan Haji Taha, 93400 Kuching, Sarawak. GoConference processes Event data for Cradle as its contracted technology provider and payment collection agent. If GoConference uses personal data for an independently determined purpose, this Notice must identify GoConference as a separate or joint data controller for that purpose.

In this Notice, “we”, “us” or “our” means Cradle and, where relevant to platform processing, GoConference.

We may process personal data about:

• ticket buyers and prospective buyers;
• registered attendees, including people registered by another buyer;
• speakers, sponsors, exhibitors, volunteers, media and Event guests;
• users of the website, attendee portal, mobile or progressive web applications, chatbot and support channels; and
• parents or guardians where an attendee is under 18.

If you provide another person’s data, you must be authorised to do so, give that person access to this Notice and obtain any consent required for sensitive personal data.

Depending on how you use the Event services, we may collect:

Identity and contact data

• first and last name, email address and telephone number;
• country of residence and nationality;
• date of birth, age and gender;
• Malaysian identity-card number or passport number where required for identity, eligibility, duplicate-registration prevention, security or check-in;
• parent or guardian information where applicable; and
• account credentials, attendee ID, ticket ID, QR code and redemption code.

Professional and participation data

• employer or organisation, job title, industry and institution;
• selected tracks, sessions, meeting preferences and Event interests;
• ticket type, student or other eligibility status;
• gala-dinner response, accessibility requests and attendance/check-in history;
• networking profile, connections, messages and meeting records where attendee networking is enabled; and
• referral, discount, sponsor, exhibitor or volunteer information.

Sensitive personal data

• dietary requirements, allergies and related health information;
• accessibility or medical assistance information; and
• any other sensitive personal data you choose or are required to provide.

We will request explicit consent where the PDPA requires it for sensitive personal data, unless another statutory condition applies. Please do not provide medical details beyond what is reasonably necessary for Event safety or accommodation.

Transaction data

• order, invoice, ticket price, discount, currency and payment status;
• transaction references, gateway references, refund and chargeback information;
• payer name and payment method category; and
• limited payment information returned by Billplz, Airwallex or participating financial institutions.

Billplz, Airwallex and financial institutions collect payment credentials under their own notices. We do not intend to store full card numbers, card security codes or online-banking credentials on GoConference.

Technical, usage and analytics data

• IP address, browser, device, operating system, language, time zone and user agent;
• pages viewed, links or buttons used, referring URL, timestamps and session activity;
• cookie, pixel, browser and advertising identifiers;
• approximate location inferred from IP address;
• notification tokens and app/device identifiers where notifications are enabled; and
• analytics and conversion events, which may include hashed contact information for matching where enabled and consented to.

Communications and media

• support enquiries, refund reasons, complaints, survey responses and communication history;
• Event photographs, audio and video recordings; and
• information submitted through chatbot or AI-assisted features.

Do not submit confidential, sensitive or unnecessary personal data through a chatbot.

• directly from you through the website, registration forms, attendee portal, apps, surveys, check-in and Event interactions;
• from a Buyer, employer, sponsor, exhibitor, partner, parent or guardian who registers you;
• from Billplz, Airwallex, banks, card networks and other payment participants;
• from Cradle’s authorised Event, venue, security, registration and support teams;
• automatically through cookies, pixels, logs and similar technologies; and
• from lawful public sources or partners where you have authorised the disclosure.

1. provide ticket quotations, accept and administer orders, collect payment and issue receipts;
2. create registrations, tickets, accounts, QR codes and redemption codes;
3. verify identity, age, student or ticket eligibility and prevent duplicate, fraudulent or unauthorised use;
4. provide Event entry, check-in, badge printing, session access and attendee support;
5. administer dietary, allergy, accessibility, safety and emergency arrangements;
6. process ticket changes, refunds, disputes, complaints and chargebacks;
7. provide attendee networking, meetings, notifications and personalised Event features that you choose to use;
8. communicate operational information, including material Event, venue, schedule, safety and ticket changes;
9. send marketing about Cradle LIVE and future events only where you have opted in or where otherwise permitted by law;
10. measure website, campaign, ticketing and Event performance, subject to applicable cookie and consent requirements;
11. maintain security, detect abuse, troubleshoot, keep audit logs and protect legal rights;
12. improve the Event, platform and attendee experience using aggregated feedback and statistics;
13. comply with accounting, tax, audit, corporate, consumer-protection, law-enforcement and other legal obligations; and
14. establish, exercise or defend legal claims.

We will not use personal data for a materially different new purpose without giving any further notice or obtaining consent required by law.

We process personal data with your consent and where processing is otherwise permitted by the PDPA, including where necessary for matters directly related to the ticket or Event service you request, legal compliance, fraud prevention, administration of justice or protection of lawful interests recognised by the PDPA.

The Privacy Notice itself is not a blanket consent. Where required, we use separate choices for acceptance of ticket terms; explicit processing of sensitive personal data; optional direct marketing; non-essential analytics and advertising technologies; and optional attendee networking or sponsor lead sharing.

You may withdraw consent by contacting live@cradle.com.my, subject to legal or contractual restrictions and reasonable notice. Withdrawal does not affect processing already lawfully completed.

Data marked as required on a form is needed to process the relevant registration, payment, identity check, ticket delivery, check-in or safety arrangement. If you do not provide it, we may be unable to complete the order, issue or verify a ticket, admit the attendee or provide the requested accommodation.

Marketing consent, optional profile details, networking participation and non-essential cookies are optional. Refusing them will not prevent a standard ticket purchase.

• Cradle personnel and authorised Event staff;
• the GoConference operator and its authorised support personnel;
• Billplz or Airwallex and participating banks, card networks, fraud-prevention and payment-service providers;
• cloud hosting, database, authentication and storage providers, including Supabase and Vercel where used;
• email and messaging providers, including Resend and OneSignal where used;
• Event venue, registration, badge, catering, accessibility, security, production and emergency-service providers;
• professional advisers, auditors, insurers and contracted support providers;
• Google and Meta where analytics, Pixel or Conversions API services are enabled and the required choice or consent has been obtained;
• sponsors or exhibitors only where you have chosen a lead-sharing or networking action, or after data has been aggregated so it no longer identifies you;
• government, regulatory, court, law-enforcement or tax authorities where disclosure is required or permitted by law; and
• a successor responsible for the Event or relevant business, subject to appropriate confidentiality and legal safeguards.

We do not sell personal data. Service providers may only process Event data under applicable contracts and instructions, except where they independently act under their own legal obligations.

Some providers may host or access personal data outside Malaysia, including providers of cloud hosting, payment, email, notifications, analytics, support and security services. Where personal data is transferred outside Malaysia, the responsible data controller will use a transfer basis and safeguards required by section 129 of the PDPA and applicable official guidance.

Contact live@cradle.com.my for information about the relevant category of transfer or safeguard.

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the data. These may include role-based access, authentication, encryption in transit, restricted administrative access, logging, provider security review, backups and incident procedures.

No online service is completely risk-free. Please protect ticket QR codes, redemption codes and account credentials and report suspected misuse promptly.

Cradle and GoConference will manage a personal-data breach in accordance with the PDPA, including notification to the Commissioner and affected individuals where required.

We keep personal data only as long as reasonably required for the stated purposes and legal obligations. The following proposed schedule must be validated operationally before publication:

• unsuccessful or abandoned registration records: up to 90 days after expiry, unless needed for fraud or dispute handling;
• ticket, payment, refund, invoice and accounting records: 7 years after the relevant transaction or longer where legally required;
• identity-card/passport details used only for Event verification: delete or irreversibly mask within 30 days after the later of the Event, completion of an open refund, or resolution of a fraud/security issue;
• allergy, dietary and accessibility details: delete within 90 days after the Event unless required for an incident or legal claim;
• Event registration and check-in records: 24 months after the Event, then delete or anonymise unless a longer period is justified;
• support, complaint and refund correspondence: 24 months after closure, or longer for an active dispute;
• marketing records: until consent is withdrawn or the programme ends, with a minimal suppression record retained to honour opt-outs;
• analytics data: up to 14 months unless configured for a shorter period; and
• backup copies: removed through the ordinary backup cycle, targeted at no more than 90 additional days.

Subject to the PDPA and applicable exceptions, you may:

• request access to personal data we hold about you;
• request correction of inaccurate, incomplete, misleading or outdated data;
• withdraw consent, subject to legal or contractual restrictions and reasonable notice;
• request that processing likely to cause damage or distress be stopped in circumstances recognised by law;
• require us to stop or not begin direct marketing;
• request data portability where the statutory right applies and transfer is technically feasible; and
• ask questions or make a complaint about our processing.

Send a request to live@cradle.com.my with your name, registered email, ticket or order reference, the right you wish to exercise and enough information to verify your identity. Do not email an unredacted identity document unless specifically and securely requested.

You may also complain to the Personal Data Protection Commissioner of Malaysia.

Marketing is optional. If you opt in, we may send information about Cradle LIVE and future Cradle events using the contact details selected. You can unsubscribe through the message link or by contacting live@cradle.com.my.

Operational ticket and Event notices are not marketing and may still be sent where needed to perform the requested service.

The Event website may use strictly necessary technologies and, if enabled, optional analytics or advertising technologies such as GA4 and Meta Pixel/Conversions API. Details and choices are explained in the Cookie Notice.

Non-essential tags that process personal data should not run before the required visitor choice. Hashing contact information before sending it to an advertising platform does not automatically make it anonymous.

The Event may be photographed or recorded for security, reporting, archive and Event publicity. We will use reasonable signage or other notice at the Event. Where practical, contact Event staff if you do not wish to be prominently featured. Focused interviews, testimonials or staged commercial recordings will use an additional release where required.

The platform is not intended to let a person under 18 independently purchase a ticket. A parent or legal guardian must authorise the registration and any required processing for an attendee under 18. If we learn that a child’s data was provided without proper authority, we will investigate and delete or regularise it as required.

The website may link to third-party services. Their own privacy notices apply when you leave the Event service or interact with a provider acting independently.

We may update this Notice to reflect legal, provider or processing changes. We will post the revised version with its effective and last-updated dates. We will give additional notice before a material new use or disclosure where required.