Privacy & Data Protection

Eventscape is an event operations platform. Organisations use it to run event registration, team and delegation management, accreditation, accommodation and travel coordination, invoicing and related operational workflows.

The way personal data is handled — and who is legally responsible for it — depends on the type of data:

• Event participant datacollected through an organiser’s use of Eventscape. The organiser is the Data Controller; Eventscape is the Data Processor.
• Eventscape account and business data that Eventscape needs to operate its own service. Eventscape is the Data Controller for this limited information.

The sections below explain each role in detail.

For personal data collected through an organiser’s use of Eventscape, the relevant event organiser or host is the Data Controller. This includes, for example:

• participant names and contact details;
• team and delegation information;
• dates of birth;
• accessibility or support information;
• travel details;
• accommodation information;
• accreditation data;
• participant photos;
• registration answers and any custom fields created by the organiser;
• event submissions and related operational data.

For this data, the organiser determines:

• what information is collected;
• why it is collected;
• the lawful basis for processing it;
• who it may be shared with;
• how long it should be retained;
• how participant rights requests are handled.

Each organiser is responsible for providing its own appropriate privacy notice to participants and for ensuring its use of Eventscape complies with applicable data protection law.

Eventscape provides the technology organisers use to collect, store, manage and process event information on their behalf. For that participant data, Eventscape acts as a Data Processor.

Eventscape processes this data only as necessary to provide the platform and in accordance with the organiser’s instructions, subject to Eventscape’s own legal obligations. Acting as a processor does not mean Eventscape has no responsibilities. Eventscape’s processor responsibilities include:

• applying appropriate technical and organisational security measures;
• maintaining confidentiality of the data it processes;
• managing the service providers and subprocessors it relies on;
• assisting organisers where required to meet their own obligations.

The controller–processor relationship is governed by appropriate contractual and data-processing terms between Eventscape and the organiser.

Separately from event participant data, Eventscape acts as the Data Controller for the limited information it needs to operate and secure its own service, such as:

• Eventscape account holder name and email address;
• authentication and account administration;
• security and audit information;
• billing and payment administration, where applicable;
• support requests and contact form enquiries;
• service communications;
• technical logs required to operate and secure the platform.

Eventscape uses this information to provide accounts, keep the platform secure, respond to enquiries and meet its own legal obligations. Eventscape does not sell personal data.

Organisers using Eventscape are responsible for:

• having an appropriate lawful basis for collecting personal data;
• providing their own participant privacy notice;
• collecting only the information necessary for their event;
• ensuring any sensitive or special-category data is handled lawfully;
• responding to data-subject requests;
• deciding appropriate retention periods for their data;
• ensuring the people they give access to Eventscape are authorised;
• ensuring exports and downloads are stored and shared securely once they leave Eventscape.

When your data was submitted for an event

Where your information was collected through an organiser’s Eventscape form, that organiser is normally the Data Controller. For requests such as:

• access to your data;
• correction of inaccurate data;
• deletion;
• restriction of processing;
• objection to processing;
• data portability;

you should contact the relevant event organiser first. As the Data Controller, the organiser determines whether and how event data is deleted or disclosed. Eventscape may assist the organiser with fulfilling these requests where required, acting as its Data Processor.

For your Eventscape account data

Where Eventscape is the Data Controller (see section 4), you can exercise these rights in relation to your own account and business data by contacting Eventscape. Depending on your location, you may also have the right to lodge a complaint with your local data protection supervisory authority.

Eventscape includes automatic deletion for certain data. Where an event or project has a configured deletion date, the event and its related data are automatically removed once that date passes. Some generated outputs, such as accreditation document jobs, expire and are cleared automatically, and short-lived operational records are purged on a routine basis.

For participant data, organisers remain responsible for determining whether the retention configuration they choose is appropriate for their purposes. Eventscape does not impose a single fixed retention period on all event data.

Eventscape retains account and business data for as long as needed to provide the service and to meet its own legal and operational obligations.

Eventscape uses appropriate technical and organisational measures to protect data processed through the platform, including access controls, authentication, database-level access rules and encryption in transit.

No online service can guarantee absolute security. Organisers and users also play an important role by keeping their credentials secure, granting access only to authorised people, and handling any exports or downloads securely once they leave the platform.

Eventscape uses a small number of service providers (subprocessors) required to operate the platform. These currently include:

• Supabase— database, authentication and file storage;
• Vercel— application hosting and privacy-friendly, aggregate usage analytics;
• Resend— sending transactional emails such as invitations and notifications.

These subprocessors provide infrastructure and platform services and remain subject to appropriate data-protection obligations. Eventscape uses only essential cookies needed for authentication and session management; it does not use advertising or marketing tracking.

Eventscape relies on service providers that may process data in more than one location. Where a service provider processes personal data outside the relevant jurisdiction, appropriate safeguards are used where legally required to protect that data.

Organisers with specific data-residency requirements should confirm that their intended use of the platform meets those requirements.

For privacy questions relating to Eventscape as a service, or to exercise your rights in relation to your Eventscape account data, please get in touch through our contact page.

If your question is about data submitted for a specific event, please contact the relevant event organiser, who is normally the Data Controller for that information.

We may update this notice from time to time to reflect changes to the platform or to legal requirements. When we make material changes, we will update the “Last Updated” date at the top of this page.