Security and Data Protection

This page should be read together with our Privacy Policy and Terms of Service. In it, “Guest Data” means personal data about an organiser’s guests, registrants, ticket buyers and form respondents that is collected or uploaded through AnnexHub.

1. Roles and responsibilities

For Guest Data, the organiser is the data controller within the meaning of Malaysia’s Personal Data Protection Act 2010 (and the “controller” under the GDPR), and AnnexHub acts as its data processor. AnnexHub processes Guest Data solely to provide the services the organiser has requested, and in accordance with the organiser’s instructions.

2. Use of Guest Data

AnnexHub does not:

• sell, rent or license Guest Data to any third party;
• use Guest Data to market its own products or services;
• disclose Guest Data to other organisers using AnnexHub; or
• use Guest Data for any purpose other than providing the services.

Messages sent to guests through AnnexHub, such as tickets, reminders and event updates, are sent only on the organiser’s behalf and at the organiser’s direction. Organisers may export their complete guest records in CSV or Microsoft Excel format at any time.

3. Data storage and location

Guest Data is hosted in Singapore on infrastructure certified to SOC 2 Type 2 and ISO/IEC 27001. The AnnexHub application servers that process Guest Data also operate in Singapore.

Certain supporting services, including payment processing and email delivery, process limited data outside Malaysia. Each such provider is contractually bound to protect that data to a standard no lower than our own. The categories of provider and their processing locations are set out in section 4 of our Privacy Policy.

4. Security measures

• Encryption. Data is encrypted in transit using TLS and encrypted at rest.
• Authentication. Passwords are stored only as salted, one-way cryptographic hashes.
• Access control. Access is role-based. Only the event owner and administrators may export guest records, and organisers may appoint administrators who have no download rights.
• Event staff. Door staff access AnnexHub through a scanner link that is limited to a single event.
• Audit trail. Every check-in, and every change to a check-in, is recorded with the identity of the person who made it and the time it was made.
• Backups. Databases are backed up daily, and backups are retained for no longer than 30 days.
• Abuse prevention. Registration and enquiry forms are protected by automated bot detection.

5. Artificial intelligence

AnnexHub’s automatic WhatsApp reply feature generates responses from the information the organiser has provided about the event. Guest Data is not used to train artificial intelligence models, either by AnnexHub or by our AI service provider, whose commercial terms exclude customer data from model training.

6. Retention and deletion

Organisers may delete individual guest records, or an entire event, at any time. A deleted event is held in a recovery archive for 30 days so that it can be restored if it was deleted in error, after which it is permanently deleted. Backup copies expire within 30 days.

7. Personal data breach notification

If a personal data breach affects an organiser’s Guest Data, AnnexHub will notify the affected organiser within 72 hours of becoming aware of it, and will notify the Personal Data Protection Commissioner as the Act requires. The notice will describe the nature of the breach, the categories of data affected, and the measures taken or proposed in response.

8. Regulatory compliance

• AnnexHub is designed to meet the requirements of the Personal Data Protection Act 2010, as amended by the Personal Data Protection (Amendment) Act 2024.
• Where the GDPR applies, transfers of personal data out of the European Economic Area are covered by the European Commission’s standard contractual clauses.
• AnnexHub enters into a Data Processing Agreement with organisers who require one. To request a copy, contact our Data Protection Officer.
• Organisers conducting vendor due diligence may request our list of service providers, which we share under confidentiality.

9. Data Protection Officer

Questions about this page, requests for our Data Processing Agreement, and data protection concerns may be directed to our Data Protection Officer:

Email: dpo@annexhub.ai
Annex Creative Solutions (M) Sdn. Bhd.
Company no. 202301005655 (1499574-X)
1-13-08, Prima U1, Jalan Kerjaya, Seksyen U1, 40150 Shah Alam, Selangor, Malaysia