Privacy Policy

1. Who we are

This policy explains how ("EventMU", "we", "us") handles personal data on this platform. It applies to the public event pages, checkout, attendee accounts, and the organizer tools.

It does not apply to an organizer's own website, mailing list, or anything they do with your data outside the platform, or to third-party sites we link to.

2. Us and the organizer

When you buy a ticket, two parties end up holding your data:

• We hold it as the operator of the platform — to run your account, process the transaction, issue the ticket, and keep the service working and secure.
• The organizer of the event holds it as the party you are actually buying from — to admit you at the door, contact you about the event, and meet their own record-keeping obligations.

Each of us is separately responsible for what we do with it. We do not control how an organizer uses attendee data after an event, and we do not sell or rent attendee lists to anyone. If you want an organizer to delete what they hold, contact them; if you want us to delete what we hold, see section 9.

3. What we collect

Information you give us

• Account: name, email address, and the credential you sign in with (a password stored only as a cryptographic hash, or a passkey).
• Checkout: the buyer name and email, attendee names and emails for each ticket, and any billing details the event requires.
• Registration answers: responses to the questions an organizer adds to their registration form — these vary by event and may include dietary requirements, organization, job title, or similar.
• Correspondence: messages you send to support, and the record of our reply.
• Organizer profile: if you run events, the business details, contact information, and payout details you provide.

Information created by using the service

• Orders and tickets: what you bought, when, at what price, in which currency, and the resulting ticket numbers.
• Attendance: check-in time and the device or team member that scanned you in, plus any certificate issued to you afterwards.
• Delivery records: whether the emails we sent you were accepted, and which documents you downloaded.
• Technical data: IP address, browser and device type, pages requested, and timestamps, kept in server and security logs.

Information we do not collect

We do not store full payment card numbers, expiry dates, or security codes. Card details are entered on the payment provider's systems and never reach ours. What we receive back is a transaction reference, the outcome, and at most the card brand and last four digits.

4. How we use it

We use personal data to:

• take payment, issue tickets, and give you and the organizer a record of the order;
• admit you to the event and confirm your attendance;
• send service messages you cannot opt out of while an order is live — confirmations, tickets, event reminders, and notices about changes or cancellations;
• deliver announcements, documents, and certificates the organizer publishes to their attendees;
• support you when something goes wrong, including investigating a payment or a missing ticket;
• detect and prevent fraud, abuse, and unauthorized access, and to keep an audit trail of sensitive administrative actions;
• produce aggregate statistics about how the platform is used, in a form that does not identify you;
• meet our legal, tax, and accounting obligations.

We rely on the performance of our contract with you for anything necessary to complete an order, on our legitimate interest in running a secure and functioning service for the operational uses above, on your consent for optional marketing, and on legal obligation where the law requires us to keep records.

Marketing email about other events is optional and is sent only if you opt in. Every marketing message carries an unsubscribe link, and unsubscribing never affects the tickets you already hold.

5. Who we share it with

• The organizer of the event you bought into — they receive the buyer and attendee details and the registration answers for their event, and nothing about your activity on other organizers' events.
• Payment providers — to take the payment and process any refund. They handle your card details under their own privacy terms.
• Infrastructure and email providers — hosting, storage, and the services that deliver our transactional email, acting on our instructions only.
• Analytics chosen by an organizer — some organizers connect their own analytics or advertising tags to their event pages. Where they do, that provider receives the page-view data described in section 6.
• Authorities and advisers — where we are legally required to disclose, or to establish or defend a legal claim.
• A successor — if the business is sold or reorganized, under equivalent protection to this policy.

We do not sell personal data.

6. Cookies and tracking

We use a small number of cookies:

• Essential: a session cookie that keeps you signed in and protects forms against cross-site request forgery. The service does not work without these.
• Referral attribution: if you arrive through an affiliate link, an encrypted cookie records which referral applies to which event, so the referrer is credited if you buy. It expires after a set period and holds no profile of you.
• Preferences: your light or dark theme choice.

We also count how many distinct visitors reach each stage of an event page — viewed, started checkout, purchased — keyed to your browser session rather than to your identity, so organizers can see conversion without seeing individuals.

Where an organizer has connected their own analytics or advertising tag to their event, that runs on their event pages under their control and their privacy notice. You can block it with your browser settings or an extension; blocking it does not affect checkout.

7. How long we keep it

• Order, payment, and invoice records: for as long as tax and accounting law requires, typically seven years.
• Account details: while your account is open, and for a short wind-down period after you close it.
• Registration answers and attendance records: for the life of the event record, so certificates stay verifiable and disputes can be resolved.
• Security and audit logs: normally up to 24 months.
• Support correspondence: normally up to 24 months after the matter is closed.

When a retention period ends we delete the data or irreversibly anonymize it.

8. Security

Traffic is encrypted in transit. Passwords are stored as salted hashes and are never recoverable in plain text; passkeys keep the private key on your own device. Access to production data is limited to the people who need it, roles inside an organizer team are least-privilege by default, and sensitive administrative actions are logged.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law. If you believe you have found a vulnerability, please report it to us privately before disclosing it publicly.

9. Your rights

Subject to the conditions and exemptions in applicable data protection law, you may ask us to:

• confirm what personal data we hold about you and give you a copy;
• correct data that is inaccurate or out of date;
• delete data we no longer have a lawful reason to keep;
• limit or object to a particular use, including profiling for marketing;
• withdraw consent you previously gave, without affecting what was done before you withdrew it.

Write to . We may ask you to verify your identity first, and we will reply within the period the law allows. Requests that would force us to break a legal retention obligation — deleting a paid order that we must keep for tax purposes, for example — will be declined in that part and explained.

If you are unhappy with our response you may complain to the data protection authority in your jurisdiction.

10. International transfers

Our infrastructure and service providers may process data outside . Where that happens we require the provider to apply protection equivalent to this policy and to the standards required by applicable law.

11. Children

The platform is not intended for children under 13, and accounts may not be created by them. Where an event admits minors, tickets are bought by a parent or guardian, who is responsible for the details submitted. If you believe a child has given us personal data directly, contact us and we will remove it.

12. Changes

We update this policy when the service or the law changes. The date at the top of the page always reflects the current version. If a change materially affects your rights we will give notice by email or on the platform before it takes effect.

13. Contact

Privacy questions and requests: . Everything else: our contact page.