Under the GDPR, you as the organiser are usually the controller of your attendees' data. Your event platform is a processor that handles it on your behalf. That split shapes most of this list.
Each point says what to check in general, and how it works in the AttendBeacon event platform. Use it to compare with whichever tool you use.
1. Ask only what you need
Write down why you ask each field. If you cannot name a use, drop the field.
- Name and email are needed: the ticket is for a person and is sent to them.
- Company and job title help on badges at a business event, and mean little at a meetup. In the AttendBeacon event platform they are asked by default and can be switched off per event.
- Ask a question only for the ticket types that need it, so a speaker question does not reach every attendee.
- Dietary and access needs can reveal health information. Ask them only if you will act on them, say why, and limit who sees the answers.
2. Make consent real
Consent must be freely given, specific and unambiguous. In practice:
- No pre-ticked boxes. A consent question is a box the attendee ticks themselves. In the event platform nobody can tick it for them, not even an organiser who issues a ticket.
- One purpose per box. Photos, sponsors and your newsletter are three separate questions.
- No ticket in exchange for marketing. Do not make registration depend on newsletter consent.
- Sponsors are a separate choice. Sharing details with sponsors is optional, never required and never ticked for anybody. Lead scanning only works for visitors who agreed.
3. Tell people what happens
Your privacy notice should say who you are, what you collect, why, on what legal basis, who receives it, how long you keep it and how people can use their rights. "Who receives it" includes your event platform, your payment provider, and any CRM or mailing tool you connect.
Put the notice where people register. For example, link it in the FAQ on your event page and refer to it in your consent questions.
If you send registrations to your CRM, say so. The event platform's CRM connection syncs nothing until an administrator confirms that the privacy notice covers it. A Mailchimp or Brevo list only receives people who ticked the consent question you chose.
4. Have a processing agreement
Your platform processes data for you, so you need a data processing agreement with it. For the AttendBeacon event platform, the terms say that you are the controller and the platform is the processor, and a data processing agreement is available on request.
Keep a record of every processor you use for the event, with what each one receives.
5. Know where the data lives
Ask your provider where the data is stored, and what leaves the EU.
The AttendBeacon event platform runs in Microsoft Azure in the EU. The app and database are in Sweden Central. Uploads, keys and logs are in West Europe, in the Netherlands.
Some things go further by their nature. Push messages pass through Apple's, Google's or Mozilla's push service, encrypted end to end. A wallet pass is stored by Apple or Google when an attendee adds one. Email ends up with each recipient's own mail provider. Microsoft is a US company, and a US company can be subject to US law. The EU sovereignty page lists all of it.
6. Keep card details out of your systems
Card and bank details should never pass through your own tools. In the event platform, attendees pay on the page of your own Mollie or Stripe account. The platform keeps only the payment's reference and status.
7. Limit who sees what
Give each person the access their role needs, and no more.
- Crew get the tools for their door during their shift.
- Exhibitors get leads only from visitors who agreed to share.
- Room screens show arrivals as counts, never names.
- The leaderboard shows a first name and an initial, and anybody can leave it.
- Survey results are shown per question, without names.
8. Leave trackers off your registration pages
Analytics and advertising pixels on a registration page usually need consent of their own. The AttendBeacon event platform has no analytics or tracking scripts on its website, in the workspace or in the event app. It uses functional cookies only, such as the one that keeps an attendee signed in.
9. Decide how long you keep it
Set a retention period before the event, not after. Keep attendee data as long as you need it for the event and its follow-up, and keep invoices as long as tax law requires.
In the event platform, you can delete an event now, or schedule its deletion for a date you choose. Its registrations, check-ins, files and messages go with it. So do the invoices to its attendees, so export what tax law makes you keep first.
Some data goes by itself:
- sensitive answers from speakers' confirmations, 30 days after the event
- questions asked to the event assistant, 30 days after the event
- files from an import, once the event is built
10. Answer requests from attendees
People may ask to see, correct or delete their data. Have a process, and answer within a month, which is the GDPR's standard deadline.
In the AttendBeacon event app, attendees can delete their own data with Delete my data. They confirm it with a code sent to their email, for one event or for every event with that address, and you are told when they do. For a request to see their data, export the attendee list with answers and check-ins to CSV.
11. Plan for a breach
Decide in advance who leads, who informs the supervisory authority within 72 hours where that is required, and how you reach your platform's support. Put those names in your event plan.
The short version
- Every field has a purpose.
- Every consent has its own box, unticked.
- Your privacy notice is linked where people register.
- You have a processing agreement with each processor.
- You know where data is stored and what leaves the EU.
- Retention is set before the event.
- You can answer a request within a month.
For the details of how the AttendBeacon event platform handles data, read the privacy page.