Privacy

Privacy policy

What we collect, why, who sees it, how long we keep it, and how to see it or have it deleted. Written against how the site works today.

These pages are written by us against how the site actually works, and have not yet been read by a lawyer. Where a figure is not settled it is shown in square brackets rather than guessed.

Last updated 5 October 2026

Who we are and how to reach us

The Expys (the Expo Awards, the Executive Awards, the Entrepreneur Awards and The Expys Global) is run by Wiktis Pty Ltd, ABN 72 692 004 970, of 155 King St, Sydney NSW 2000, Australia. This policy covers expys.org and expoawards.org, the member portal, and every email and text we send. We are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles, and where you are in the United Kingdom or the European Economic Area, by the UK GDPR and the GDPR.

Write to privacy@expoawards.org about anything in this policy. We answer from the address your account or ticket is under, so write from it.

What we collect, and when

We collect only what each thing you do needs. Here is each thing, and what it takes.

Signing in: your email address, and if you use Google or LinkedIn, the name and (from LinkedIn) the profile photo they hand us. A password, if you set one, is stored only as a hash by our sign-in provider.
Your account: the country you are based in (it decides tax and currency) and the currency you prefer.
Entering: your name, title, company and what it does, its size and entity type, your bio, tagline, goal, years in events, your photo, a company logo, a hero image or video, your LinkedIn, Instagram and X links, your website, and your written entry. For the Executive and Entrepreneur Awards, also your organisation, headcount, trading-since date, years in business and a revenue band, each self-declared.
Proving a profile: for LinkedIn, the id LinkedIn returns when you sign in with it; for Instagram, the handle you type and the author of a comment on our pinned post, read through Instagram's API; for a website, a code we give you to place in a DNS record or a file.
Nominating: your name and email address, the name and email address of the person you put forward, their LinkedIn or Instagram, why, and how you know them. A nomination is confirmed by a link in your email. On the Expo Awards nomination record we keep a salted hash of your address, not the address.
Voting: your email address, kept as a salted hash on the vote, and a salted hash of your connection and browser to spot bulk voting. Your name, and on the Executive Awards your employer and your role, which that vote asks for. A vote is confirmed by a link in your email. On an Executive or Entrepreneur vote we also keep the part of your address after the at sign, on its own, in plain text: it is how we refuse free and throwaway mailboxes and how we hold the published cap that stops a quarter of an entrant’s votes coming from inside their own employer. It is the domain alone, never the address, and it cannot be turned back into one.
Buying a press pack and writing a release: the pack, and your answers to a six-question interview about what you entered and why, a quote in your own words, your company in one line, facts we can check and where it should be seen. Every draft, and the desk's notes on it.
Dropping media: the file, a poster frame taken from a film, its type and size, the version of the media terms you agreed to (2026-09-28.1 today) with a hash of their exact text, the moment you ticked the box, and a salted hash of your connection and browser at that moment. Location data and camera data (EXIF, XMP) are stripped from every picture in your browser before a byte leaves your machine.
Submitting a show reel: the show, your name, email, phone and role, notes, the files, the licence version and text you agreed to, the moment, and your connection and browser at that moment.
Applying for a role or the talent track: your name, email, LinkedIn, why, a CV, your social links, city, showreel and outlet where the track asks, the consent text you agreed to, and your connection and browser at that moment.
Sponsoring: the company, the contact's name, email and phone, notes, the package, and what was paid.
Preferences: the after-party questionnaire, the Interested button and the "which one are you" question. Section 8 sets these out in full.
Paying: nothing about your card. Stripe holds the card and hands us the amount, the currency, the Stripe ids for the session, the payment and the customer, and the country and email Stripe recorded. We keep one row per Stripe Checkout Session, opened or paid, with what it was for, the amount and which campaign brought you, so we can work out what an advertisement cost us; it carries no name.
Visiting: the cookies in section 5, and first-party page events (which page, which programme, which variant, a random visitor id, and the attribution cookie). We do not record your IP address on a page event. Where you follow one of our role links we keep one row saying that the link was followed, with the role, the programme and the campaign; it carries no name, no address and no IP address.

What we do with it

To run the awards: to take and confirm entries, nominations and votes, to build and show your public page, to count the vote and certify it, to name finalists and winners, and to keep the programme honest.

To take money and account for it: to charge the right price and the right tax, to issue receipts and invoices, to refund, and to keep the tax records the law requires.

To deliver what you bought: press packs and releases, media kits, badges and tiles.

To write to you: transactional email the site cannot work without, lifecycle email you can unsubscribe from, and text messages only where you ticked the box.

To choose what you are shown: which experiences, add-ons, events, emails and the one partner placement in your portal, from what you have told us by entering.

To measure and buy advertising, as section 6 describes.

To understand the audience as groups, which is what we can honestly tell a sponsor.

Cookies and local storage

The site has no cookie banner today, and this is why: every cookie below is first party, none carries your name, and the one that carries your email address is set only by a form you filled in. The list is complete; a cookie not on it is not ours. Each is written by name in the code, and a test refuses a new tag without a line here.

Your browser also keeps, in local storage on your own device and never sent to us: the entry basket, the sponsor basket while you build them; the email address you last pressed Interested with, so the button remembers you; and a flag per audience so a placement is counted once.

sb-*-auth-token: Your signed-in session, set by Supabase, our database and sign-in provider. Holds a signed token, not your password. Life: While you stay signed in. Removed when you sign out..
expys_access: That you have entered the launch password. Holds a hash of it, never the password. Life: 90 days.
expys_attr: Where you came from: utm_source, utm_medium, utm_campaign, utm_content, utm_term, and the click ids the ad networks mint (fbclid for Meta, gclid for Google, li_fat_id for LinkedIn, ttclid for TikTok, rdt_cid for Reddit), plus the landing page, the referring site (host and path only, never a search query), the time, and the same for your first ever visit. It also holds the audience group we have placed you in, which we call your role (for example founder, tattoo artist, chief marketer, exhibitor), the programme that role belongs to, how we came to think so (you chose or added an award, you read an award or programme page, or you followed one of our role links such as expys.org/r/founder), the link you followed, and a random id for that click. A role is always one of a fixed list we wrote, worked out from the award and never from anything you typed. No name, no address, no free text. Read back when you enter, nominate, buy or RSVP so the record knows which channel brought you. Life: 90 days.
expys_vid: A random visitor id, so the price box test and the funnel counts can tell one browser from another. Never tied to your account. Life: One year.
expys_pb: Which of two price box designs you were shown, A or B, so you keep seeing the same one. Life: One year.
expys_persona, expys_persona_seen, expys_persona_joined, expys_persona_role: Which one you said you are (organiser, supplier, sponsor and so on) when the site asked, and that it has asked, so it does not ask again. Life: One year.
expys_virtual_rsvp: The email address you gave when you RSVPed to the virtual awards night, so the form remembers you. This is the one cookie that holds your address. Life: 180 days.
expys_li_state: A random value while you connect LinkedIn from your portal, so the reply can be checked as yours. Life: 10 minutes.

Basic traffic analytics

We also use Vercel Web Analytics, a basic count of page views, provided by Vercel Inc., the company that hosts and serves this site. It records the page you visited, the site that referred you, your country, and the type of device and browser you used. It sets no cookie and keeps no record that identifies you.

Alongside it, Vercel Speed Insights, from the same company, measures how quickly our pages load: the page visited, the timings it took to load, and your device, connection type and country. It also sets no cookie and keeps no record that identifies you.

We remove the query string and any page anchor before either tool sends anything, so a link carrying a signed receipt token, a Stripe session id, or an advertising campaign tag reports only the page it points to. Page views from the admin area and the member portal are not sent to either tool, because that is our staff and our members at work, not a visit.

Advertising, pixels and the conversions APIs

We buy advertising on Meta, LinkedIn, Reddit, Google and TikTok, and we measure it with the tags below. Each one is switched on or off by us in the site's configuration; a tag that is off is not loaded at all, and no data reaches that platform. Where a tag is on, this is what it does.

None of them is ever sent your name, your written entry, your questionnaire answers or your vote. Where a server-side event carries an email address or phone number it is a SHA-256 hash of the trimmed, lower-cased value, which the platform can match against its own users and cannot turn back into the address.

You can stop all of it. Each platform's own ad settings control what it does with what it receives, and any browser setting or extension that blocks trackers blocks every tag here. The attribution cookie can be cleared like any cookie.

Purchases at the launch test price are left out of every server-side event, so a fifty-cent test never teaches a platform to buy fifty-cent customers.

Meta Pixel (Facebook and Instagram): Tells Meta that a browser visited this site and which pages it saw, which audience it identified itself as, and when it entered, nominated, chose an award, added to a basket, started an entry, started a checkout, cast a vote, read a pack or paid. Every event carries the role and programme from the attribution cookie in section 5, so that an advertisement for one programme is not shown to the audience of another, and so that somebody who has bought stops being shown the advertisement for what they bought. A completion carries the categorical facts of the entry (the programme, the category, the band, the country, the industry, the headcount band) and never your name, your email address, your written entry or your vote.
Meta Conversions API: The server-side twin of the pixel. When a payment settles, our server tells Meta about the purchase with a SHA-256 hash of the email address, phone number and country Stripe gave us and of our own id for the buyer, so Meta can match the sale to the click. Hashed, never in the clear, and never a name. The other events the pixel fires are also relayed by our own server: your browser posts the event, its id and its categorical parameters to /api/track on this site, and our server passes them to Meta together with the IP address and browser user agent of the request, Meta's own _fbp and click identifiers where you have them, and a hash of the random visitor id. A role link (an address beginning /r/ or /p/) reports that it was followed in the same way, before the page loads. The pixel and the relay carry the same event id, so Meta counts the event once. We do not store your IP address; it is passed on and not kept. The relay refuses anything that is not a fixed word, a number or a list of them, so nothing you typed can travel through it.
LinkedIn Insight Tag: Tells LinkedIn that a browser visited, which audience it identified itself as, and that a landing page was seen, a vote cast, a pack downloaded, a persona chosen or a sign-in completed, each as a numbered conversion.
LinkedIn Conversions API: The server-side twin. When a payment settles, our server tells LinkedIn about the purchase with a SHA-256 hash of the email address and the li_fat_id from the attribution cookie, so a LinkedIn ad can be credited with a sale.
Reddit Pixel: A page visit on every page, and a Lead or Purchase mirrored from the Meta events of the same name, with the kept campaign, programme and angle.
Google Tag Manager, carrying Google Analytics 4, Google Ads and the TikTok Pixel: One container that receives the same events the pixels above receive (page view, audience, lead, add to basket, checkout, purchase) with the same event id, and fires GA4, Google Ads conversions and the TikTok pixel from it. GA4 measures which pages are read and for how long. Google Ads and TikTok credit their ads with the completions.
TikTok Events API: The server-side twin of the TikTok pixel. When a payment settles, our server tells TikTok with a SHA-256 hash of the email address and phone number and the ttclid from the attribution cookie.

Partners and sponsors

Inside your member portal we show one partner placement. Which one you see is chosen on our own server, from what you told us when you entered: the programme, the award shelf, the country or region you compete in, and whether you have paid. The partner is never told who you are. Your name, your email address, your entries and your votes are never passed to them, and following a placement carries nothing about you to their site. We count how many times a placement was seen and followed, so we can tell a partner what they got, and that count names the placement, never you.

A sponsor who buys a message to our audience never receives the list and nothing is exported, because we send it ourselves from our own address.

What you tell us about yourself

Some of what we hold is not your name or your address. It is what you like. Here is all of it, what we do with it, and what we never do with it.

What we ask. Three things. Your member profile: your title, the company you work for, what that company does at a show and roughly how many people work there. The Interested button on a tier or a package: one press, which means you would like to hear more about that one thing. And the "which one are you" question on the home pages: one word from a list.
What we never ask. There is nothing about your health, and nothing about drugs or sexual company. There is no hidden score standing in for either. Every answer is one of a short list we wrote down first, so there is nowhere for something we did not ask for to end up. The Interested button offers nothing to type at all.
Why we ask. To decide what we offer you, which packages and emails you are shown. And to understand the audience as groups, which shapes our advertising and is what we can honestly tell a sponsor about it.
It changes what you are offered. That is the point of asking, so it should not be a surprise: your answers and your presses decide which experiences, add-ons, events and emails you are shown, and they may mean you are offered something another guest is not. They never decide whether you may enter an award, and they never touch an entry, a vote, a result or your standing.
Advertising. We do not send your questionnaire answers or your presses to any advertising platform. They stay on our own servers. What those platforms receive, where they are switched on, is set out in section 6.
Sponsors and partners. Your answers, your presses, your title and your company are never handed to a sponsor or a partner. What a sponsor is told is counts, as section 7 says.
The count on a button is real. The number beside Interested is the number of people who pressed it. Nothing is seeded, padded or rounded up. Below 10 presses we show no number at all rather than one that flatters us.
Seeing it and deleting it. Write to privacy@expoawards.org from the address your ticket or account is under and we will send you everything we hold under these headings, and delete any of it you ask us to. You can also change it yourself: answering the questionnaire again replaces your old answers rather than adding to them, pressing Interested a second time withdraws it, and the profile fields are yours to edit in your portal.

The public vote

A vote is recorded against a salted hash of your email address, never the address, so that one address counts once. Your name, and on the Executive Awards your employer and your role, are kept with the vote. No running total is published anywhere. The count is independently certified, and the certifier sees counts, not voters.

On the Executive and Entrepreneur Awards the domain of your address is kept beside the hash, in plain text and on its own. It does two published jobs and nothing else: free and throwaway mailboxes are refused on the Executive ballot, and no more than a quarter of an entrant’s counted votes may come from their own employer’s domain. A vote past that cap is recorded and not counted, and we tell you nothing about anybody else’s.

A voter wall, which would list the names of voters who chose to be named, is built but switched off. If it is switched on, your name appears only with the consent you give at the moment you vote, and you can take it down with one click; the vote itself stays counted.

Security and data breaches

Every table is protected by row level security, and the only key that reads or writes personal information is held on our own servers, never in a browser. Passwords are hashed by our sign-in provider. Emails, connections and browsers on nomination and vote rows are salted hashes. Files a member drops are held in private storage and checked byte by byte before anyone can see them. Card details never touch us.

If a breach of personal information is likely to result in serious harm we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and where the GDPR applies, the relevant authority within 72 hours.

How long we keep it

For as long as you hold an account, a ticket or an entry with us, and after that until you delete your account or ask us to remove it. There is no automatic expiry on this site today, so if you want something gone, delete your account or ask, and it is gone. A retention schedule for accounts that go quiet is [to confirm].

What we keep after that, whatever you ask, is what the law requires: the record of every payment (orders, receipts, invoices, the GST treatment) for [seven years, to confirm against the Australian tax and company record-keeping periods], against an anonymised member id; votes already counted; a licence you gave us for footage; and one record of your email address on our do-not-contact list, so that we never email you again.

Salted hashes on nomination attempts and promotion-code attempts, which enforce the daily limits, are of no use after a day and may be cleared at any time [retention to confirm].

Your rights

You can ask us what we hold about you, ask us to correct it, ask for a copy of it in a common format, ask us to stop using it for a purpose, or ask us to delete it. Write to privacy@expoawards.org from the address your account or ticket is under. We answer within 30 days, and we do not charge for it.

You can change most of it yourself in your portal: your profile, your media, your sign-in methods, your country, your preferences, and whether your page is public.

You can unsubscribe from lifecycle email with the link in any of them, and from texts by replying STOP. Transactional email (a sign-in link, a receipt) keeps coming while you hold an account, because the site cannot work without it.

If you are not happy with how we handle a request you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), and where the GDPR applies, to the supervisory authority where you live.

Deleting your account

Your portal has a Delete account door, under More. It tells you what happens in plain words, asks you to type DELETE, and does it. You get one plain email confirming it is done. It is permanent.

What goes: your name, email address, phone number, photo, logo, social links, bio, tagline and every other word you wrote about yourself, in every table that carried them; your public page and its address; your uploaded media and any press release drafts; your sign-in, including a Google or LinkedIn link and the copied LinkedIn photo. Where your name or address was on a nomination you sent or received, a vote you cast, a reservation, an RSVP, a reel submission, a job application or an email we sent you, it is replaced there too.
What stays: paid orders, receipts, invoices and tax records, because Australian tax law and Stripe require them, kept against an anonymised member id rather than your name. Votes you have already cast stay counted, against the salted hash of your address so it cannot vote again. Show footage you licensed to us stays under that licence, with your contact details removed. One record of your email address stays on our do-not-contact list so that we never email you again. Stripe keeps its own record of the payment under its own policy.
The record: each deletion writes one audit row saying what was anonymised, what was removed and what was kept and why, with a salted hash of the address so we can answer "did you delete me" without keeping the address.

Children

The sites are for people working in events and business. You must be 18 to hold an account or to buy. We do not knowingly collect information from anyone under 16, and if we learn we have, we delete it.

Changes to this policy

We change this policy when the site changes, and the date at the top is the date of the version you are reading. A short note of what changed is kept at the foot of this page. A change that widens what we collect or who we share it with is emailed to account holders before it takes effect.

What changed on 5 October 2026

Rewritten in full from the placeholder list, which named one pixel and no processors. Every true sentence from it is kept.
Named the processors and the countries: Supabase (Virginia), Vercel, Stripe, SendGrid, Twilio, Anthropic, Mux, Instantly, and the five ad platforms.
Added the complete cookie list by name, with what each holds and how long it lives, and the local storage the browser keeps.
Named every advertising tag the site can load (Meta Pixel and Conversions API, LinkedIn Insight Tag and Conversions API, Reddit Pixel, Google Tag Manager carrying GA4, Google Ads and the TikTok Pixel, and the TikTok Events API), what each collects, and that each is switched on or off by us.
Added what is collected by the press release interview and the machine drafting, the media drop, the reel submission, the careers form, the sponsorship reservation and the ticket order.
Added the account deletion door, what it removes, what it keeps and why, and the audit row.
Added the experience partner register: the supplier companies we buy the add-on days from, the business contact details they publish themselves, the rates, and our correspondence with them.
Added security, data breach notification, retention, your rights, children, and the complaint path.
28 September 2026: added the role held on the attribution cookie (the audience group an award or a role link places you in), the role links at /r/ and /p/, the role and programme carried on every advertising event, the relay of browser events through /api/track to the Meta Conversions API with the IP address and user agent of the request, and the row kept when a role link is followed.
28 September 2026: the Executive and Entrepreneur Awards vote opened, and this policy says what it keeps that the Expo Awards vote does not. Their ballot asks an Executive voter for their employer and their role, and the domain of a voter’s address is kept in plain text beside the salted hash so that free and throwaway mailboxes can be refused and the published 25 per cent own-employer cap can be held. The address itself is still never stored.
28 September 2026: added Vercel Web Analytics, a basic page view count with no cookie, no query string and no admin or portal traffic in it.
28 September 2026: added Vercel Speed Insights, page load timings measured the same way, with the same cookie, query string and admin/portal exclusions.
Figures still to confirm are in square brackets.
5 October 2026: the live nights, seats and tables parts of this policy no longer apply, because the programme is online. The cookies for night votes and live pricing, and what a seat or a table took, are no longer listed.