AT&T Event Guest Privacy Notice

May 2024

AT&T hosts events to discuss critical issues, collaborate with stakeholders, conduct training, and raise awareness of products and services. Personal Data must be Processed to support participation at these AT&T Events. This AT&T Event Guest Privacy Notice (the “Notice”) provides information about the Processing of Personal Data that is consistent at each AT&T Event. There will also be a privacy notice for each AT&T Event to provide the additional and detailed terms of AT&T’s Processing of Personal Data for that specific AT&T Event.

In connection with your participation at an AT&T Event, the Notice outlines:

Who is covered by the Notice?
What Personal Data about you does AT&T Process?
Why does AT&T Process Personal Data about you?
Who has access to Personal Data about you?
Where is Personal Data about you Processed?
When is Personal Data about you deleted?
How may you manage the Processing of Personal Data?

Who is covered by the Notice?

The Notice applies to individuals invited to attend an AT&T Event. It informs guests about how AT&T Processes Personal Data to register you for, and to enable your participation at, an AT&T Event. The Notice also applies to employees and contractors of AT&T, but only as to the Personal Data Processed to register your for at AT&T Event.

Throughout the Notice, “AT&T” includes our affiliated companies and third parties acting on our behalf in support of an event.

What Personal Data about you does AT&T Process?

The Personal Data you will be required to provide will be listed in the AT&T Event-specific notice. This may include your name, email address, or phone number, as well as information such as dietary restrictions, travel details, or emergency contact information. This information is referred to as “Personal Data” throughout the Notice. If Sensitive Personal Data is needed for an event, we will specifically note that and ask for additional consent.

Why does AT&T Process Personal Data about you?

Throughout the Notice, “Process” or “Processing” means any activities performed on Personal Data or on sets of Personal Data. This includes collection, storage, use, dissemination, and deletion.

Personal Data will be used to register you for and facilitate your participation at an AT&T Event.

Personal Data will be Processed:

For one or more specific purposes for which you have given consent. You may withdraw your consent at any time, but this may impact on our ability to provide you with further information.
As necessary for legitimate interests pursued by AT&T. This includes Processing for internal administrative purposes, personal and network security, and other purposes such as sending you future invitations.

Who has access to Personal Data about you?

Personal Data will be disclosed as required for stated purposes and to authorized recipients only. Recipients may include AT&T affiliates and personnel, business partners, third-party service providers, suppliers, vendors, and subcontractors. Third parties may also collect and Process Personal Data on AT&T’s behalf for the above purposes. Third parties given access to Personal Data are required to use appropriate security measures. Third parties are obligated to Processing Personal Data only pursuant to AT&T’s instructions.

AT&T may disclose Personal Data if compelled to do so by a court of law, regulators, law enforcement agencies, governmental agencies, and parties to civil lawsuits. Prior to any disclosure, AT&T examines the demand to determine whether it is legally valid, appropriate, and proportionate. AT&T may challenge such requests if these criteria are not met. AT&T may disclose Personal Data if necessary or appropriate to comply with the law or to protect or defend AT&T’s rights, property, or employees.

Where is Personal Data about you Processed?

AT&T is a multinational company but has centralized business and operational activities to better manage a global business. That centralization may result in the transfer of Personal Data to countries other than the country in which you are located. The principal countries to which Personal Data is transferred include the United States of America, Brazil, Czech Republic, India, Malaysia, Poland, Philippines, Mexico, Singapore, and Slovakia.

When AT&T transfers Personal Data between AT&T affiliates it does so based on our Intra-Group Agreement (IGA). The IGA includes standard contractual clauses for the export of Personal Data to third countries. You may review the safeguards AT&T uses for cross-border transfers by contacting the AT&T Chief Privacy Office at AskPrivacy@att.com.

Wherever Personal Data is Processed, AT&T uses appropriate security measures consistent with privacy and data protection laws.

When is Personal Data about you deleted?

Personal Data will be retained as necessary for you to participate in the AT&T Event, as consistent with law. After that, Personal Data will be destroyed by making it unreadable or undecipherable. While Personal Data is retained, AT&T implements appropriate technical and organizational measures designed to secure Personal Data. Such measures may include:

Maintaining and protecting the security of computer storage and network equipment and using security procedures that require usernames and passwords to access data.
Applying encryption or other appropriate security controls to protect Personal Data when stored or transmitted.
Limiting access to Personal Data to only those with jobs requiring such access.
Requiring AT&T personnel involved in the Processing of Personal Data to complete training and awareness programs on the requirements of privacy and data protection laws.

How may you manage the Processing of Personal Data?

AT&T is committed to honoring your rights as to the Processing of Personal Data. We have established effective and transparent policies and procedures to do so.

Your rights may include:

Right to Notice. AT&T provides you with the Notice and the privacy notice specific to each AT&T Event, detailing how Personal Data is Processed.
Right of Access. You may obtain from AT&T confirmation of whether Personal Data is being Processed and, if it is, access to the Personal Data and additional information about Processing.
Right to Revoke Consent. You may withdraw a given consent at any time and AT&T will stop Processing your Personal Data, subject to requirements to retain the data for lawful purposes.
Right to Rectification. You may have inaccurate Personal Data corrected and have incomplete Personal Data made complete.
Right to Erasure. You may have Personal Data erased, in certain circumstances.
Right to Restriction of Processing. You may have additional Processing of Personal Data temporarily prohibited while the accuracy or Processing of the Personal Data is contested.
Right to Data Portability. You may be able to have Personal Data provided to another data controller, either by you or directly by AT&T.
Right to Object. You may object, at any time and on grounds relating to your situation, to the Processing of Personal Data.

Whether, how, and to what extent a specific right applies and how it will be addressed by AT&T will depend upon;

Your location and the applicable law;
The lawful basis pursuant to which Personal Data is Processed;
The nature of the Personal Data; and
Whether we hold responsive Personal Data.

Provision of Personal Data in response to your request shall not adversely affect the rights of others.

Additional Information

Questions about the Notice may be sent to the AT&T Chief Privacy Office via AskPrivacy@att.com, as well as the point of contact for the specific AT&T Event you will be attending. You may contact the AT&T Data Protection Officer at g43881@att.com. You may file a complaint with the relevant privacy or data protection regulator or national authority. You may also have the right to seek judicial redress for alleged infringements of applicable law.