This Privacy Policy explains what personal data The Change Experience 2026 (“we”, “us”) collects when you browse this site or register for the event (15 & 16 October 2026, Dubai), how we use it, who we share it with, and the rights you have over it.
The event is organised by TKT Church (TKT Dubai), the data controller for registration. Registration itself runs on TKT Church’s Convoy platform, which also powers other TKT Church events. This site never sells your personal data.
1. Data we collect
Registration data you provide. When you register we collect:
- Name, mobile number, and one-time-passcode verification status.
- Email address and date of birth.
- Area / locality (typed with Google Places autocomplete) and an optional profile photo.
- Details of family members or guests you add, exactly as you provide them.
- Referral attribution — who invited you, and the invite links you share.
- Marketing-consent choice, which you can change at any time (see §5).
Visit and early-contact signals. Even if you never register, we record visit and interaction signals (for example, viewing the schedule, opening a FAQ, beginning registration, or an OTP step failing) with campaign attribution. These events contain fixed labels, not the answers you type into the form. If you type a valid mobile number into the registration form but leave before verifying it, we store that number encrypted, for up to 90 days, as an unverified contact hint. We never send marketing messages to unverified numbers, and full numbers are never shown to staff — only a masked form (country code plus last digits) for analysis.
Data collected automatically. Pages you visit, approximate device and browser information, and registration events (for example, starting or completing signup). Our analytics tag the current page path only; invite and referral parameters are stripped from the URL before any analytics call so they are never recorded by third-party scripts.
2. How we use your data — and our lawful bases
- Running your registration — confirming your seat, issuing your QR ticket, managing capacity, waitlists, and check-in on both evenings. Basis: performance of our agreement with you when you register.
- WhatsApp and email updates — confirmations, ticket delivery, material program changes, and practical event information. Basis: performance of our agreement; marketing messages only with your consent.
- Safety and integrity — preventing duplicate or fraudulent registrations and keeping check-in secure. Basis: our legitimate interests and legal obligations.
- Measuring outreach — understanding which announcements bring people, using Meta Pixel and Microsoft Clarity (see Cookie Policy). We record the campaign and ad angle you arrived with, so a registration weeks later is still credited to the right announcement. Basis: our legitimate interests in measuring advertising; where consent is required, your consent as described in the Cookie Policy.
- Understanding incomplete journeys — counting visits, interaction patterns, and unverified contact hints to improve registration and measure advertising. Interaction signals and unverified hints alone are never used to contact you. Basis: our legitimate interests; where Meta audience-building is enabled, hashed contact details are shared as described in §4.
3. WhatsApp, email & marketing choices
Transactional messages about your own registration (confirmations, tickets, material changes) are part of the service. Anything beyond that — such as invitations to future gatherings — is sent only if you opt in, and every message explains how to stop it. You can withdraw marketing consent at any time from the Privacy & consent section of My ticket, or by emailing us. Withdrawing consent never affects your current registration.
4. Who we share data with
We share the minimum necessary with processors who act on our instructions:
- Convoy (TKT Church) — registration records, tickets, referral accounting, and check-in. Your browser never talks to Convoy directly; requests pass through this site’s server proxy.
- WhatsApp Business messaging — your mobile number, to deliver confirmations and tickets you asked for.
- Meta (Pixel + Conversions API) — registration events with hashed identifiers (SHA-256 email, phone, name, date of birth, area and similar fields), your IP address and browser user-agent, browser click identifiers, the ad angle and UTM parameters of the visit, and a shared event ID so browser and server events are deduplicated rather than double-counted. Advanced matching on the registration form also passes your phone number to Meta directly from your browser. IP address and browser type are sent only together, never one without the other. Where audience-building is enabled for the campaign, unverified contact hints are shared as hashed phone numbers only (standard Contact events) — never names, and never in readable form.
- Microsoft Clarity — pseudonymous session analytics, such as taps, scrolls and rage clicks, on marketing and registration pages. It does not run on ticket, pass, login or ticket-recovery screens, and we do not combine recordings with anything you type into a form.
- Google Maps / Places — area autocomplete on the registration form, and venue directions as an ordinary outbound link, governed by Google’s terms and privacy policy. No map is embedded on this site.
- Authorities — only where required by UAE law or a lawful order.
5. International transfers
This site is hosted on cloud infrastructure in ap-south-1 (Mumbai), and some processors above (notably Meta, Microsoft, and Google) process data outside the UAE, including in the United States. Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) or the EU/UK GDPR applies to you, transfers rely on your consent, the performance of your registration, or appropriate safeguards such as standard contractual clauses with our processors.
6. How long we keep data
- Registration and attendance records: up to 24 months after the event, for follow-up, testimonies you agree to share, and planning future gatherings — then deleted or anonymised.
- Visit and interaction signals, plus unverified contact hints: up to 90 days, then automatically deleted.
- Campaign attribution (the record of which ad brought you in): up to 12 months from the last recorded touch.
- Encrypted session cookies on your device: up to 30 days. The registration resume draft in your browser: 24 hours.
- Analytics storage: per the Cookie Policy (Meta cookies ~90 days, Clarity identifiers up to 13 months).
- Where law requires longer retention (for example, tax or dispute records), we keep only what the law requires.
7. Your rights
Depending on where you live — including under the UAE PDPL and, for international visitors, the GDPR — you may have the right to access, correct, or delete your data; to object to or restrict certain processing; to receive a portable copy; and to withdraw consent at any time. To exercise any right, email [email protected] with the name and phone number or email you registered with. We aim to respond within 30 days. You also have the right to complain to the UAE Data Office or your local supervisory authority.
8. Children
The event welcomes children accompanied and supervised by a responsible adult. Anyone under 18 should be registered by a parent or guardian, whose details we treat as the registering adult’s data. We do not knowingly collect data directly from children without guardian involvement — contact us and we will delete it. See also our Safeguarding Policy.
9. Security
Registration sessions are sealed into encrypted HttpOnly cookies; one-time OAuth tokens never reach the browser; and our server proxy only permits a fixed allowlist of upstream calls. No method is perfectly secure, so please keep your ticket QR code private and tell us immediately if you suspect misuse.
10. Cookies
The trackers and cookies this site sets — and how to control them — are listed in our Cookie Policy.
11. Changes to this policy
If we change this policy materially before the event, we will post the updated version here with a new “last updated” date and, where appropriate, notify registered attendees by WhatsApp or email.
12. Contact
Data questions, rights requests, or concerns — reach the organising team at [email protected].
