Evenir
Back to Homepage DPO Contact
Statutory Compliance Charter

GDPR & Data Protection Policy

Compliance Standard: UK GDPR / Data Protection Act 2018 (Art. 28) • Direct DPO Contact: support@evenir.co.uk

1. Purpose & Scope of Data Protection Policy

Evenir operates an enterprise-grade cloud event operations and microsite platform. We understand that trade show organisers, conference producers, and corporate summit hosts handle sensitive corporate and personal data belonging to international delegates, VIP speakers, government officials, and commercial exhibitors.

This Data Protection Policy articulates Evenir's statutory responsibilities and operational protocols under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU GDPR where European Economic Area (EEA) delegates attend events hosted on our network.

2. Article 28 Data Processing Agreement (DPA) Terms

Whenever an Event Organiser creates an account or launches an event microsite on Evenir, Evenir acts as a Data Processor on behalf of the Organiser (the Data Controller). Pursuant to Article 28 of the UK GDPR, the following terms govern all processing of attendee personal data:

  • Processing Strictly on Controller Instructions: Evenir processes attendee records, pass tokens, and demographic responses only in accordance with documented instructions from the Organiser.
  • Staff Duty of Confidentiality: All Evenir engineering, operations, and support staff with access to database clusters are bound by strict contractual non-disclosure agreements and undergo annual data protection training.
  • Technical and Organisational Measures (TOMs): Evenir maintains technical controls including AES-256 data encryption at rest, TLS 1.3 encryption in transit, strict client isolation across multi-tenant database partitions, rate-limiting anti-brute-force defenses, and automated security patches.
  • Sub-Processor Engagement: Evenir maintains an authorized register of third-party sub-processors (including Stripe, Mandrill, Twilio, and AWS). Organisers are notified of any intended changes to sub-processors.
  • Assistance with Data Subject Rights: Evenir equips Organisers with self-service studio tools to export attendee records (CSV format), rectify errors, or permanently purge records in fulfillment of Subject Access Requests (SARs).
  • Deletion or Return of Data: Upon contract conclusion or upon request from the Controller, Evenir securely purges or returns all delegate personal data, unless applicable UK law requires prolonged statutory retention.

3. Exhibitor Lead Retrieval & Badge Scanning Governance

Evenir provisions digital Lead Retrieval tools and installable Progressive Web App (PWA) barcode scanners for exhibition stand representatives. To ensure strict GDPR compliance on exhibition floors:

  • Affirmative Badge Scan as Electronic Consent: When an attendee physically presents their badge or QR token to be scanned by an exhibitor at an event booth, this physical act serves as affirmative electronic consent for the exchange of contact details between the attendee and the specific exhibitor company.
  • Lead Export Policy Enforcement: Organisers configure lead export policies in Evenir Studio, determining whether exhibitors receive full demographic profiles, restricted contact details, or instant CSV downloads.
  • Exhibitor Duty of Lawful Processing: Once an exhibitor exports attendee leads, the exhibitor becomes an independent Data Controller for that data and must provide their own privacy notice before initiating marketing communications.

4. 72-Hour Personal Data Breach Notification Protocol

Evenir maintains a comprehensive Security Incident Response Plan (SIRP). In the event of a confirmed personal data breach affecting delegate or organiser records:

Evenir Incident Escalation Timeline:

  1. Containment & Forensics: Within 4 hours of detection, our security operations team isolates affected clusters and initiates forensic analysis.
  2. Controller Notification: Evenir notifies affected Event Organisers (Controllers) without undue delay and in all events within 48 hours of becoming aware of a confirmed breach, providing incident details, scope, and mitigation actions.
  3. Support for Regulatory Filings: Evenir assists Controllers in fulfilling their obligation to report the incident to the Information Commissioner's Office (ICO) within the statutory 72-hour window where required.

5. International Data Transfers & Standard Contractual Clauses

Evenir's core database clusters are hosted within the United Kingdom (London AWS Region) and European Union. Where technical sub-processors process data internationally (e.g. Stripe or Mandrill infrastructure located in the United States), transfers are governed by:

  • The UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (SCCs); or
  • The UK Extension to the EU-US Data Privacy Framework (DPF) adequacy regulations.

6. Data Protection Officer (DPO) Contact

For inquiries concerning our Data Protection Policy, Article 28 DPA execution, or to submit a regulatory notice:

Evenir Data Protection Office

Electronic Mail: support@evenir.co.uk

Postal Jurisdiction: United Kingdom

Direct Support Ticket: Submit a Data Protection Inquiry