Expert data-use terms

1. Scope and acceptance

These terms supplement the AtriumArena Terms of Use between Purple Panda Limited and an expert or organization receiving audience details. They are intended for business use and require valid acceptance or incorporation into an agreement before reliance on them. Publication alone is not evidence that an existing expert accepted a new obligation.

An organization acts on its own behalf when it determines its subsequent marketing or business purposes. It must assess its actual role under applicable law. If processing occurs strictly on another party's instructions, an appropriate processor agreement may be required instead; this document does not silently create one.

2. Limited permission, not ownership

Audience records are personal data, not property transferred for unrestricted use. Access or export grants no general marketing entitlement. Use is limited to the named organization, the stated purpose and subject matter, the fields necessary for that purpose, the actual permission given and applicable law.

Before contact or import into another system, confirm what the person saw, what they selected, whether consent is valid for the proposed use, and whether any additional notice, written consent or transfer safeguard is required. An available download button or a populated row is not legal clearance.

3. Prohibited uses

You must not:

• Sell, rent, publish, exchange or pass audience details to another organization for its own use without a separately valid basis and required permission.
• Treat one battle's permission as agreement to unrelated subjects, channels, brands or indefinite campaigns; append unrelated third-party data or use the list for advertising audience matching without the necessary legal basis and disclosures.
• Contact non-consenting people, bypass an objection or suppression record, infer permission from attendance, or encourage a person to provide another individual's details without authority.
• Use records to impersonate people, manipulate votes, make discriminatory or unlawful decisions, or upload audience information to a general-purpose AI tool for unrelated processing.

4. Lawful outreach and withdrawal

Identify your organization and why the person is being contacted. Provide your own appropriate privacy information and a clear, functioning way to object or unsubscribe. Distinguish essential event administration from promotional messaging.

Apply withdrawal and objection promptly, without charging the person, and in accordance with the applicable legal deadline. Keep only a minimal suppression record when necessary to avoid contacting them again. Do not use an old export to bypass a newer restriction.

Forward a request concerning platform-controlled records to our contact address without undue delay. Cooperate with us on a correction, withdrawal, complaint or deletion request and contact the individual directly for processing you independently control.

5. Security and service providers

Use access restrictions, protected accounts and appropriate encryption or secure transfer for exported files. Limit access to people who need it and have confidentiality duties. Do not store lists in public folders or share unprotected links.

You remain responsible for evaluating your CRM, email vendor and other processors, using appropriate agreements, limiting their access and resolving applicable international-transfer requirements. Do not transfer the data to a processor prohibited from handling it for the proposed purpose.

Keep accurate records of exports, permitted purposes, notices, consent evidence, recipients, withdrawal and disposal proportionate to your obligations. Maintain accuracy and do not keep the data longer than necessary.

6. Incidents and cooperation

Notify our contact address without undue delay if platform-supplied information is lost, accessed without authority, sent to an unintended recipient or misused. Provide an initial report within 24 hours of becoming aware, even if incomplete, and meaningful updates as facts emerge.

Preserve relevant evidence, contain the incident and cooperate on required assessments and notices. Do not imply that AtriumArena has approved your incident response, admission or public statement. This contract does not delay any shorter or independently applicable statutory duty.

7. Ending use and verification

Stop processing when the permission, purpose or other lawful basis ends. Securely delete or effectively anonymize copies no longer needed, including copies held by processors, unless limited retention is legally justified. Backups should be isolated from normal use and follow a documented deletion cycle; restored data must have withdrawals reapplied.

On reasonable request, provide proportionate evidence of compliance and confirm deletion or explain a lawful exception. We may suspend further access where there are reasonable concerns, while respecting legal rights and limiting disclosure of unrelated business information.

8. Business responsibility and claims

You are responsible for your own unlawful processing and for people or processors acting under your authority. We remain responsible for our own acts and legal duties; this allocation does not restrict a data subject's rights against either party.

For an expert acting in business, and only to the extent legally enforceable, you agree to reimburse reasonable external defence costs and amounts finally awarded or agreed in an authorized settlement of a third-party claim directly caused by your material breach of these data-use duties or unlawful use of exported data. This does not cover loss caused by our own fault.

We must give prompt notice and reasonable cooperation and must not agree a settlement charged to you without your reasonable consent. This reimbursement obligation is capped at the greater of HKD 50,000 and fees you paid us in the preceding 12 months. It does not create an unlimited indemnity or shift a regulatory penalty where the law prohibits doing so. Mandatory legal liabilities are unaffected; the platform's liability remains subject to the enforceable limitations and exceptions in the Terms of Use.

9. Priority and changes

These terms control a conflict with the general Terms specifically about handling exported audience data, unless a separately signed agreement lawfully provides otherwise. Mandatory law and data subjects' rights always prevail.

A material change requires appropriate notice and any required acceptance before it governs future use. Neither an amended page nor a general content licence supplies consent that an individual has not validly given.