Privacy Policy

2. Data Controller vs. Data Processor Roles

3. Categories of Personal Data We Collect

• Identity & Profile Data: First name, last name, job title, company name, demographic survey answers, speaker bios, and headshot images.
• Contact Data: Business email address, telephone numbers, postal addresses, and WhatsApp/SMS communication opt-in flags.
• Credential & Badge Data: Cryptographic badge codes (e.g. `EVN-XXX-XXXX`), Code128 barcodes, 2D QR tokens, and tamper-proof CPD certificate verification hashes.
• Lead Retrieval & Interaction Data: Exhibition booth visit timestamps, qualifying survey answers, hot/warm/cold lead ratings, stand notes recorded by licensed exhibitors, and 1-on-1 B2B meeting appointment schedules.
• Technical & Telemetry Data: IP addresses, browser types and versions, operating system details, device screen resolutions, email open telemetry (via 1x1 tracking pixels), and offline PWA service worker synchronization queues.
• Commercial & Transaction Data: Invoicing history, package subscriptions, and Stripe tokenized payment receipts. (Evenir never stores raw credit/debit card numbers; all payments are tokenized securely through Stripe PCI-DSS Level 1 infrastructure).

4. Lawful Bases for Processing (UK GDPR Article 6)

We process personal data only when an explicit statutory basis exists under UK GDPR:

• Performance of Contract: To provision your event workspace, process tickets, deliver badge passes, and enable exhibitor lead scanning;
• Legitimate Interests: To protect our platform against cyber attacks, prevent fraud, generate system diagnostic proof, and optimize server performance;
• Legal & Regulatory Obligations: To comply with HMRC tax accounting, VAT invoicing, and statutory reporting obligations;
• Explicit Consent: Where delegates opt in to receive commercial sponsor brochures, WhatsApp schedule notifications, or marketing alerts.

5. Approved Sub-Processors & Data Sharing

Evenir does not sell or lease personal data. To provide high-availability SaaS operations, we transfer data to vetted third-party infrastructure providers:

6. Data Subject Rights (UK GDPR)

Individuals whose personal data is processed by Evenir have fundamental rights under UK data protection legislation:

• Right of Access (SAR): Request a copy of all personal data held about you;
• Right to Rectification: Request correction of inaccurate or incomplete records;
• Right to Erasure ("Right to be Forgotten"): Request deletion of your attendee profile or lead record where statutory grounds apply;
• Right to Restrict or Object: Restrict processing or object to automated profiling;
• Right to Data Portability: Obtain your data in a structured, machine-readable format (CSV/JSON);
• Right to Withdraw Consent: Unsubscribe from email or SMS notifications at any time.

*Note: For event attendee records where Evenir acts as a Data Processor, we will forward your request directly to the contracted Event Organiser (the Data Controller) for authorization and completion.

7. Security Architecture & Data Retention

Evenir implements rigorous physical, organizational, and technical safeguards. All data in transit is protected using TLS 1.3 encryption. Data stored in our database clusters is encrypted at rest using AES-256 standards. Each client account operates in strict database isolation to guarantee zero cross-client data leakage.

We retain personal data only for as long as necessary to satisfy the commercial event objectives, provide post-event reports, issue CPD certificates, and comply with tax and audit regulations (typically 6 years for financial transaction ledgers). Organisers may purge attendee rosters and lead export records at any time from Evenir Studio.

8. Contact Our Data Protection Team

To exercise your data subject rights, submit a privacy enquiry, or contact our Data Protection Team: