Privacy Notice
Version 1.1 · Effective 22 June 2026 · English
Version 1.1 | Effective 22 June 2026
1. Controller and contact details
Tucana Global, S.L.U., CIF/NIF B66329566, is the controller of the personal data described in this Notice. Tucana trades as PAWorld, PAWorld365 and People Analytics World.
Registered office
Tucana Global, S.L.U.
Calle Velázquez 27, 1 Ext Izq
28001 Madrid
Spain
Customer correspondence
Calle Velázquez 27, 1 Ext Izq
28001 Madrid, Spain
Privacy contact
privacy@peopleanalyticsworld.com
Customer support
support@peopleanalyticsworld.com
+34 91 794 4567 | +44 203 290 3221 | +1 646 493 4784
Support hours are 07:00 to 19:00 Central European time, Monday to Friday, excluding public holidays in Madrid. Central European Summer Time applies when in force.
2. Scope
This Notice explains how Tucana processes personal data when a person:
- requests information, a quote or an invitation;
- creates or uses a PAWorld365 account;
- purchases, receives or administers a ticket;
- registers for, attends or interacts with an Event;
- uses the PAWorld365 website, event app or online-event functions;
- contacts customer support or submits a complaint;
- joins a mailing list or responds to a survey;
- is photographed, filmed or recorded at an Event; or
- deals with Tucana as a customer, prospect, speaker, sponsor, exhibitor, supplier or professional contact.
The Cookie Policy separately explains cookies and similar browser technologies.
3. Personal data we collect
| Category | Examples |
|---|---|
| Identity and professional information | Name, preferred name, title, employer, job role, industry, seniority, biography, professional interests, profile photograph and badge details. |
| Contact information | Business or personal email address, telephone number, postal address, country and communication preferences. |
| Account and authentication information | Account identifier, login and access records, language choice, password reset information and security settings. Tucana does not store readable passwords. |
| Order, billing and tax information | Customer or company name, billing address, CIF, VAT or other tax number, purchase order, ticket type, price, discount, invoice, tax treatment, payment status, cancellation, credit and refund history. |
| Payment and fraud information | Stripe transaction identifier, payment method type, card brand, limited card metadata, billing verification result, IP address, device and fraud-prevention signals. Full card details are normally processed by Stripe and are not made available to Tucana. |
| Registration and attendance information | Event selected, ticket category, check-in and access status, session registration or attendance, meeting choices, dietary requirements, accessibility requests, visa-support request and attendance certificate information. |
| Event-app and networking information | Profile visibility, biography, interests, agenda, saved sessions, messages, meeting requests, questions, poll responses and content voluntarily submitted through the platform. |
| Communications and support information | Emails, call notes, chat messages, enquiries, complaints, survey responses, preferences and records of how a request was handled. Calls are not recorded unless a separate notice is provided. |
| Marketing and engagement information | Mailing-list status, lawful-basis and consent records, event interests, email delivery, opening and link-interaction data where permitted, unsubscribe and suppression records. |
| Website, device and security information | IP address, browser, device, operating system, page requests, timestamps, diagnostic events, security logs, anti-bot results and cookie choices. |
| Images, audio and recordings | Event photographs, crowd or session footage, livestream contributions, questions, interviews, testimonials and speaker recordings. |
| Conduct and incident information | Reports, witness accounts, access-control records, security actions, health and safety incidents and related correspondence. |
| Inferences and internal analysis | Event-interest segments, attendance trends and aggregate or pseudonymised service metrics derived from the information above. Tucana does not use these to make solely automated decisions with legal or similarly significant effects. |
4. Sources of personal data
We collect personal data:
- directly from the Customer, Attendee or other individual;
- from a Customer, employer, colleague or sponsor that registers or nominates an Attendee;
- from speakers, exhibitors, venue teams and Event suppliers where necessary to organise the Event;
- from payment, fraud-prevention and authentication providers;
- from public professional sources, such as a company website or professional profile, when managing a legitimate business relationship;
- from the PAWorld365 website, app, check-in equipment and Event interactions; and
- from photographs, recordings, incident reports and correspondence created in connection with an Event.
A Customer who provides another person's information must have authority to do so and must ensure that the person receives this Notice. Tucana will also provide the Notice directly where required.
5. Purposes and legal bases
| Purpose | Main legal basis |
|---|---|
| Respond to an enquiry, prepare a quote and take steps requested before purchase | Contractual necessity or steps before a contract; legitimate interests where the contact represents an organisation. |
| Create an account, process an order, take payment, issue a ticket or invoice, manage a substitution, refund or complaint, and provide Event access | Performance of the ticket or services contract; legitimate interests where the Attendee is not the Customer. |
| Operate the Event, app, networking, check-in, sessions, catering, accessibility and customer support | Performance of the contract; legitimate interests in delivering a useful, safe and well-run professional Event; consent where an optional feature requires it. |
| Verify identity, prevent fraud, protect accounts, systems, participants and venues, investigate misuse and enforce Event standards | Legitimate interests in security, fraud prevention, safety and legal compliance; legal obligation; vital interests in an emergency. |
| Maintain accounting, tax, corporate, consumer and legal records | Compliance with legal obligations; legitimate interests in audit, governance and the establishment, exercise or defence of legal claims. |
| Send essential service communications about payment, access, programme, venue, safety or Event changes | Performance of the contract; legitimate interests in Event administration. These messages are not marketing. |
| Send newsletters, Event announcements and relevant professional marketing | Consent where required; otherwise legitimate interests or another lawful direct-marketing basis permitted by applicable law. Every marketing email provides an opt-out. |
| Share a lead with a sponsor following a voluntary booth scan, sponsor-specific form or other clear attendee choice | Consent or another lawful basis expressly stated at the point of collection. Attendance at a sponsored session alone is not treated as marketing consent. |
| Provide optional attendee-directory, profile, messaging and meeting functions | Performance of the requested app service and, where appropriate, consent or legitimate interests. Visibility controls are provided. |
| Photograph, film and document general Event activity | Legitimate interests in reporting, archiving and promoting Tucana's Events, balanced against participant rights. Separate permission or a release is normally obtained for staged, testimonial or prominently featured individual use. |
| Record and publish speaker, moderator, panellist or interview content | Performance of the speaker arrangement and the speaker's release or licence; legitimate interests; consent where required for a particular use. |
| Analyse sales, attendance, engagement, service quality and Event performance in Microsoft Fabric | Legitimate interests in improving Events, forecasting demand and managing the business. Data are aggregated or pseudonymised where reasonably possible. |
| Manage cookies and similar technologies | Strictly necessary technologies are used to provide, secure or remember a requested service. Optional technologies rely on consent. |
Where we rely on legitimate interests, we consider the purpose, necessity and effect on the individual, and apply safeguards such as minimisation, access controls, transparency, opt-outs and aggregation.
6. Required and optional information
Fields marked as required in a form or checkout are needed to complete the stated purpose. Without required Customer, Attendee, billing, payment or access information, Tucana may be unable to provide a quote, form the contract, process payment, issue a ticket or admit the Attendee.
Profile fields, networking visibility, marketing choices, survey responses and most dietary or accessibility details are optional. An Attendee may still attend without using optional networking or marketing functions, although Tucana cannot provide an adjustment or dietary arrangement that it has not been told about.
7. Special-category and sensitive information
Dietary, accessibility, health or incident information may reveal health, religion or other sensitive information. Tucana processes only what is reasonably necessary and normally relies on the individual's explicit consent, substantial public-interest or employment/safety law where applicable, or vital interests in an emergency. Access is restricted and the information is deleted or anonymised sooner than ordinary registration data where practicable.
Please do not provide detailed medical records. Tell us only what is necessary to arrange safe and appropriate support.
8. Marketing choices
Marketing consent is separate from acceptance of ticket terms. Marketing boxes are not pre-selected.
A recipient can stop email marketing at any time by using the unsubscribe link or contacting privacy@peopleanalyticsworld.com. A direct-marketing objection is applied without charge. Tucana may retain a minimal suppression record so that the person is not added back inadvertently.
Essential messages about an order, ticket, Event operation, safety or a response to a request may still be sent after a marketing opt-out.
9. Sponsors, exhibitors and attendee data
Tucana does not give every sponsor or exhibitor a general attendee marketing list.
A sponsor may receive an Attendee's business contact and professional details where the Attendee deliberately:
- asks Tucana to share them;
- presents or confirms a badge scan after being shown the sponsor identity, purpose and privacy information;
- completes a sponsor-specific lead form; or
- otherwise gives a valid sponsor-specific marketing choice.
The sponsor then processes the data under its own privacy notice as an independent controller. The Attendee can withdraw marketing consent from the sponsor and from Tucana separately.
Where Tucana shares limited attendance information for non-marketing Event operation or properly assessed analytics, the data and permitted use are restricted by contract and the stated legal basis. Attendance at a sponsor's session, on its own, is not permission for the sponsor to send marketing.
10. Event app and participant visibility
The Event app is a Tucana-operated single-page application hosted on Microsoft Azure. An Attendee may be able to control whether their name, organisation, job title, photograph or interests appear to other registered participants. Information intentionally made visible to participants can be viewed and used by them for legitimate Event networking, but participants must not scrape, bulk-download or misuse it.
Private messages are visible to the sender and recipient and may be accessed by authorised Tucana personnel where reasonably necessary to investigate a report, provide support, protect participants or comply with law.
11. Photography, filming and audio
Tucana provides notices where photography, filming or recording takes place. General images of stages, crowds, rooms and networking may include an Attendee incidentally. An Attendee with a particular concern should contact the Event team or support as early as possible. Where available, Tucana will offer a no-photo indicator or another reasonable measure, although it may not be possible to exclude a person from every wide crowd image.
Tucana normally seeks a separate release or clear permission before using a staged interview, testimonial or prominently featured individual image for advertising. Speakers and panellists are covered by separate speaker and recording terms.
12. Recipients and service providers
Tucana discloses personal data only where necessary for the purposes above. Recipients may include:
| Recipient | Role and purpose |
|---|---|
| Stripe group companies and payment partners | Payment processing, authentication, fraud prevention, refunds and chargeback handling. Stripe may act as Tucana's processor and as an independent controller for regulated payment, fraud and compliance activities. |
| Microsoft | Azure hosting; Dynamics 365 and Dataverse CRM and workflow services; Microsoft Fabric data-lake and internal analytics services; account, security and support functions. |
| Twilio SendGrid | Transactional and marketing email delivery, delivery-status reporting, security and suppression handling. |
| Usercentrics / Cookiebot | Cookie-consent management, storage and proof of browser choices. |
| Cloudflare | Turnstile anti-bot, abuse prevention and website security. |
| Venues, caterers, badge and registration suppliers, event-production providers, security, accessibility and technical contractors | Event delivery, access, safety, catering, support and logistics, limited to what each provider needs. |
| Speakers, meeting participants and registered app users | Information intentionally shared through Event participation, session questions, meetings or profile-visibility choices. |
| Sponsors and exhibitors | Sponsor-specific leads or limited Event information only as explained in section 9. |
| Professional advisers, auditors, insurers, banks and corporate service providers | Legal, financial, insurance, audit, governance and transaction support. |
| Courts, regulators, tax authorities, police and other public bodies | Compliance with law, protection of rights, fraud prevention, safety and legal proceedings. |
| A purchaser, investor or successor | Due diligence and transfer connected with a genuine corporate transaction, subject to confidentiality and applicable law. |
Service providers are required by contract to protect the data and use it only for authorised purposes where they act as processors.
13. International transfers
Tucana is established in Spain, but some service providers, participants, sponsors or Event operations are located in the United Kingdom, Switzerland, the United States or other countries.
Where personal data are transferred outside the European Economic Area, the United Kingdom or Switzerland, Tucana uses an applicable lawful mechanism, such as:
- an adequacy decision or recognised data bridge;
- the European Commission's Standard Contractual Clauses;
- the UK International Data Transfer Agreement or UK Addendum;
- Swiss-law adaptations;
- the EU-U.S. Data Privacy Framework or UK Extension where the exact recipient is validly certified and the transfer is within scope; or
- another safeguard permitted by applicable law.
Tucana also assesses security and access risks and applies supplementary measures where appropriate. A person may request information about the relevant safeguard from the privacy contact, subject to necessary redactions.
14. Retention
Tucana keeps personal data only for as long as reasonably necessary for the purpose, legal obligations and claims. Normal periods are:
| Record | Normal retention period |
|---|---|
| Enquiries and unconverted quotes | Up to 24 months after the last substantive contact, unless a live opportunity or legal issue requires longer. |
| Incomplete checkout records | Up to 30 days, unless needed for fraud, security or support. |
| Orders, contracts, invoices, payments, refunds and tax records | Normally 6 years after the end of the relevant financial year, or longer where tax, audit or a live claim requires. |
| Registration, attendance, Event-app and operational records | Normally 3 years after the Event, then deletion or anonymisation unless needed for a complaint, incident or legal claim. |
| Accessibility, dietary and health information | Normally deleted or anonymised within 30 days after the Event, unless an incident, continuing request or legal obligation requires longer. |
| Support and complaint records | Normally 3 years after closure. |
| Security, device and technical logs | Normally up to 12 months, unless an investigation or legal requirement requires longer. |
| Conduct, fraud and incident records | For a proportionate investigation and claims period, normally up to 5 years unless proceedings or law require longer. |
| Marketing records | Until consent is withdrawn or an objection is made. Inactive contacts are reviewed after 24 months. A minimal suppression record may be kept longer. |
| Consent, preference and opt-out evidence | For as long as needed to demonstrate compliance, normally up to 5 years after the relevant use or withdrawal. |
| Photographs and recordings | General Event media is normally reviewed after 5 years. Selected editorial, historical or published archive content may be retained longer where justified. Speaker content is retained under the applicable release or licence. |
| Cookie and consent data | As stated in the Cookie Policy and the live Manage cookies panel. |
A legal hold, regulatory requirement, dispute or fraud investigation may require longer retention. Data may be securely anonymised instead of deleted.
15. Individual rights
Subject to applicable law and any exemption, an individual may ask Tucana to:
- provide access to personal data and information about its use;
- correct inaccurate or incomplete data;
- delete data;
- restrict processing;
- provide portable data in a structured, commonly used and machine-readable format;
- stop processing based on legitimate interests; or
- review a decision made solely by automated means where it has legal or similarly significant effects.
An individual has an absolute right to object to direct marketing. Where processing relies on consent, consent may be withdrawn at any time without affecting processing already carried out lawfully.
Requests may be sent to privacy@peopleanalyticsworld.com. Tucana may request information reasonably necessary to verify identity and protect other people's data. There is normally no fee. Tucana will respond within the period required by applicable law.
Cookie choices can be changed through the permanent Manage cookies link. Email marketing can be stopped through the unsubscribe link.
16. Complaints to a supervisory authority
Please contact Tucana first so we can try to resolve the concern.
An individual may complain to the Agencia Española de Protección de Datos (AEPD) through www.aepd.es, or to the competent data-protection authority in the country where the individual lives or works or where the alleged issue occurred. UK residents may also have the right to complain to the UK Information Commissioner's Office where UK data-protection law applies.
17. U.S. state privacy rights
Residents of certain U.S. states may have additional rights to know, access, correct, delete or obtain a copy of personal data, and to opt out of sale, sharing, targeted advertising or certain profiling.
Tucana does not currently sell ticket-registration personal data, share it for cross-context behavioural advertising, or use targeted-advertising technologies on the ticket site. Sponsor disclosures occur only as described in section 9.
A U.S. privacy request or appeal may be sent to privacy@peopleanalyticsworld.com. Tucana will not discriminate unlawfully against a person for exercising a privacy right.
18. Automated decisions
Tucana does not use ticket, attendance or Event-app data to make solely automated decisions that produce legal or similarly significant effects about an individual.
Stripe, card issuers and fraud-prevention providers may use automated systems under their own notices to assess payment or fraud risk. Those systems may affect whether a transaction is authorised.
19. Security
Tucana uses proportionate technical and organisational measures intended to protect personal data, including access controls, authentication, encryption where appropriate, logging, supplier controls, staff confidentiality and incident-response procedures. No online service is completely risk-free.
A person who believes an account or ticket has been compromised should contact support promptly and should not send full payment-card details by email.
20. Changes to this Notice
Tucana may update this Notice to reflect changes in law, Events, systems, providers or processing. The current version and effective date will be published on this page. Material changes will be highlighted or communicated where appropriate.