How we handle your information.

1. Who we are

Workforce Asia Summit 2026 is organised by Sentiva LLC (Sentiva, we, us), registered at 254 Chapman Rd, Ste 208 #20742, Newark, Delaware 19702, United States. Sentiva LLC is the data controller responsible for personal information collected through this website and at the summit.

For anything about the summit, email summit@sentiva.ai. For questions about this policy, or to exercise any of the rights in section 11, email our data protection contact at dpo@sentiva.ai.

2. Which law applies

We apply Sri Lanka’s Personal Data Protection Act No. 9 of 2022, as amended by Act No. 22 of 2025 (the PDPA). The operative provisions of that Act commence on 1 January 2027; we apply them to this website and the summit from launch rather than waiting for that date.

Where the EU or UK General Data Protection Regulation applies to you, we will honour the equivalent rights under that law. Where the law of your own country gives you stronger protection than this policy describes, that stronger protection applies.

3. Information we collect

We collect information you give us directly, limited technical information needed to operate and secure the site, and photography and video recorded at the summit itself. We do not buy personal information from anyone else.

• Register interest. Your email address.
• Partnership enquiries. Your name, work email, organisation, job title and the message you send us.
• Technical information. Your IP address, location derived from that IP address, browser and device type, and the pages you visited. This is collected in server logs by our hosting provider, as described in sections 6 and 9.
• At the summit. Photography, film and audio recorded at the event, which may include your image, likeness, voice, name, job title and organisation. Described in section 5.

We do not ask for sensitive personal information, and we ask that you do not include any in a free-text message. If, closer to the summit, we ask for accessibility or dietary requirements, we will explain at that point why we need them, ask for your explicit consent, use them only to arrange your attendance, and delete them shortly after the event.

4. How we use it, and our legal basis

• Summit updates. To send you speaker announcements, programme updates and registration information for Workforce Asia Summit 2026, and to tell you about future editions of the summit. Our basis is your consent, which you can withdraw at any time — see section 10.
• Partnership enquiries. To respond and discuss how your organisation might take part. Our basis is our legitimate interest in responding to business enquiries, and taking steps to enter into a contract with you.
• Running the site. To operate, secure and improve this website and to prevent abuse of our forms. Our basis is our legitimate interest in running a functioning, secure site.
• Reporting on and promoting the summit. Photography and video, as described in section 5. Our basis is our legitimate interest in reporting on, promoting and building the summit.
• Meeting our legal obligations. Where we have to keep or disclose information to comply with the law.

We do not sell your information, we do not share it with sponsors or partners for their own marketing, and we do not use it to make decisions about you by automated means. If that changes — for example if we introduce badge scanning at the summit — we will update this policy and ask for your consent separately.

5. Photography, filming and recording at the summit

The summit is photographed, filmed and recorded throughout. We use that material to report on and promote the summit and future editions of it, and to market Sentiva and its products and services, in any medium and without a time limit.

We do not rely on your consent for this. Our basis is our legitimate interest in reporting on, promoting and building the summit, and being recorded is a condition of attending, as set out in our Terms and Conditions. If you do not wish to appear in photography or video, please do not attend.

Other attendees and members of the media also take photographs and video at the summit. We do not control them and are not responsible for material they capture or publish. The venue operates its own CCTV under its own privacy notice; those recordings are not ours and we do not keep them.

6. Who we share it with

We share personal information only with service providers who help us run the summit and this website, and only to the extent they need it to provide that service. Each is bound by a written data processing agreement. Currently these are:

• Vercel Inc. Website hosting, United States. Records server logs including your IP address and IP-derived location.
• Resend (Plus Five Five, Inc.). Delivery of the emails our forms generate, and the mailing list itself — if you register your interest, Resend holds your email address and your subscribed or unsubscribed status on our behalf. United States.
• Our email provider. Enquiries you send us arrive in, and are kept in, the summit team’s mailbox.
• Vercel Web Analytics. Page view counts, with no cookie and no persistent identifier. United States.
• Google (Google Analytics). Site usage measurement, only if you accept optional cookies. United States and other countries where Google operates.

We will add photographers, a registration platform and a payment provider to this list as the summit takes shape, and will update this policy when we do. We keep a current list of our processors and will provide it on request. We may also disclose information where the law requires it.

7. Where your information goes

Our hosting and email providers are based in the United States, so information collected through this site is transferred to and processed there. Those transfers rely on the contractual safeguards in our agreements with each provider, including the standard contractual clauses published by the European Commission and the equivalent United Kingdom transfer mechanism.

Section 26 of the PDPA requires controllers to adopt instruments specified by the Data Protection Authority of Sri Lanka before transferring personal information out of Sri Lanka. The Authority has not yet issued that specification. When it does, we will adopt the instruments it specifies and update this section.

8. How long we keep it

• Register-interest email addresses. For 3 years from our last contact with you about the summit, so that we can tell you about future editions, and then deleted. If you unsubscribe or ask us to delete your details, we act on that straight away rather than waiting for that period to run.
• Partnership enquiries. For 3 years from our last contact with you, unless we sign a partnership agreement, in which case that agreement sets the period.
• Photography and video. Indefinitely, because it forms part of the permanent record and promotional material of the summit.
• Server logs. For a short period set by our hosting provider, after which they are deleted automatically.
• Analytics. Vercel Web Analytics keeps aggregate counts only. Google Analytics cookies expire after two years, or immediately if you withdraw consent.

Once ticketing opens we will hold payment and invoice records for the period Sri Lankan tax and accounting law requires, which is longer than the periods above. We may also keep a record of any report made under the conduct section of our Terms and Conditions for as long as we need it to act on it. You can ask us to delete your details sooner at any time — see section 11.

9. Cookies and local storage

We use no advertising cookies and no advertising trackers, and we do not load fonts from third-party servers.

• Your cookie preference. Kept in your browser’s local storage so we do not ask again on every visit. Strictly necessary to give effect to the choice you made, so it is set without consent. Clear it any time through your browser settings.
• Vercel Web Analytics. Counts page views and visits. It sets no cookies and uses no persistent identifier, so it cannot follow you between sites or sessions. Because nothing is stored on your device, it runs without consent.
• Google Analytics. Tells us which parts of the site are useful. It sets cookies named _ga and _ga_<id> that identify your browser across visits for up to two years. These are only set if you accept optional cookies.

You can change your choice at any time using the Cookie Preferences link in the site footer. If you reject optional cookies, Google Analytics is switched off and the cookies it set are deleted. Rejecting them does not affect your ability to use the site.

10. Marketing and unsubscribing

We only send summit updates to people who have registered their interest, and we use those email addresses for nothing else. That includes telling you about future editions of the summit, so you may hear from us after November 2026 — until you tell us to stop.

When you register we send you a confirmation email straight away. Beyond that we have not yet sent any summit updates. Every update we send carries a one-click unsubscribe link, and the confirmation email carries an unsubscribe option too.

Unsubscribing is permanent: your address goes onto a suppression list, and if you later fill in the registration form again we will not add you back to the list without you telling us to.

You can withdraw your consent at any time, before or after we start sending, by emailing summit@sentiva.ai. Withdrawing consent does not affect anything we sent lawfully beforehand.

11. Your rights

Under the PDPA you can ask us to:

• confirm whether we hold personal information about you, and give you access to it;
• correct it if it is inaccurate, incomplete or out of date;
• erase it, where we are processing it unlawfully, where you have withdrawn the consent we relied on, or where the law or a court requires us to;
• stop processing it, or refrain from a particular use; and
• withdraw any consent you have given us.

Note two things about the PDPA specifically: it does not create a right to data portability, and the right to erasure is narrower than under the GDPR — it applies on the three grounds above rather than generally. Where the GDPR or UK GDPR applies to you, you have the wider set of rights that law gives, including portability and the right to object to processing based on our legitimate interests.

To make a request, email dpo@sentiva.ai. We will respond without undue delay and within one month. If a request is complex we may extend that by up to two further months, and we will tell you before the first month is up if we need to. There is no charge for making a request.

12. Complaints

If you are unhappy with how we have handled your information or refused a request, please tell us first at dpo@sentiva.ai so we can try to put it right.

You can also appeal to, or complain to, the Data Protection Authority of Sri Lanka at dpa.gov.lk. If you are in the EU or the UK, you may instead lodge a complaint with the data protection supervisory authority for your country.

13. Children

This site and the summit are intended for working professionals, not children. We do not knowingly collect personal information from anyone under 16. Where someone under 16 takes part through our student programme, registration must be arranged by their university or institution with the consent of a parent or guardian, and we will not collect their information through the public forms on this site.

If you believe someone under 16 has given us their information, email dpo@sentiva.ai and we will delete it.

14. Security

The site is served only over an encrypted connection (HTTPS), so information you submit is encrypted in transit. Access to enquiries is limited to the members of the summit team who need it. Our processors are chosen partly on their security posture and are each bound by a data processing agreement. We do not store payment card details, and will not do so when ticketing opens — that will be handled by a payment provider.

No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

15. If something goes wrong

If personal information we hold is lost, disclosed or accessed without authorisation, we will assess what happened promptly, take steps to contain it, and notify the Data Protection Authority of Sri Lanka where we are required to. Where the incident is likely to put you at risk, we will tell you as well, and explain what happened and what you can do.

16. Changes to this policy

As the summit develops we may update this policy — in particular to cover registration, ticketing and payments, and any processing we add at the event. The date at the top of this page shows when it was last revised. Where a change materially affects how we use information you have already given us, we will say so at the top of this page and, if we hold your email address, tell you directly.

17. Contact

Questions about the summit: summit@sentiva.ai. Questions about this policy, or to exercise your rights: dpo@sentiva.ai.