Data Processing Summary

Data Processing SummaryLast updated 28 June 2026

A short, shareable summary of how Attendly processes personal data on behalf of event organisers. It is written so an organiser can show it to their own committee, trustees or stakeholders. It sits alongside our full Privacy Policy and Terms of Service.

1. Roles at a glanceFor attendee personal data, the event organiser is the data controller — you decide what to collect and why. Attendly is your data processor — we process that data only on your instructions to provide the service. Attendly is the controller only for your own organiser account data.This means you remain in control of your attendees’ data, and we are contractually bound to process it only to run Attendly for you.

2. What we process on your behalf

Attendee registrations: name, email, phone number, organisation and any guests they add.

Check-in records: attendance and entry time, for door check-in, capacity and fire-safety / attendance registers.

Payments for paid events: buyer name and email, amount and a Stripe payment reference. Card details are handled by Stripe and never stored by Attendly.

3. Lawful bases you can rely onAs the controller you choose your lawful basis. The bases below are the ones organisers typically rely on when using Attendly. You should confirm they fit your event.

Activity

Typical lawful basis

Taking registrations and providing tickets

Contract

Running the event, check-in and fire-safety / attendance registers

Legitimate interests

Taking payment for paid tickets

Contract

Keeping financial records for paid events

Legal obligation (tax and accounting)

Your own marketing emails to attendees

Consent

4. Our sub-processorsAttendly uses a small set of trusted providers to deliver the service. Each is bound by a data-processing agreement and may use the data only to provide their service to us.

Provider

Purpose

Location

Supabase

Database, authentication and storage

EU (eu-west-2)

Stripe

Payments and payouts (Connect)

EU / UK, US under safeguards

Resend

Transactional email

EU / US under safeguards

Cloudflare

Hosting and platform security

Global edge network

Sentry

Error monitoring

EU / US under safeguards

The current list is maintained here. We will give notice of material changes to our sub-processors so you can object if needed.

5. Where data is storedAttendly’s core database, authentication and storage are hosted in the European Union (the eu-west-2 region). Any processing outside the UK and EU by a sub-processor is protected by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. Security measures

Encryption of data in transit.

Role-based access controls and least-privilege access to data.

Payment card data handled entirely by Stripe (PCI-DSS Level 1) — never stored by Attendly.

Error monitoring and audited, reputable infrastructure providers.

7. Helping with data-subject requestsIf one of your attendees exercises a right (access, rectification, erasure, objection or portability), they should contact you as the controller. Attendly will assist you in locating and actioning the relevant data within the platform so you can respond within the statutory time limit.

8. Retention and deletionYou decide how long to keep registration and check-in data for your events. Financial records for paid events are retained for the statutory period required by UK tax and accounting law. When you delete data or close your account, we remove it from active systems within a reasonable period, subject to those legal retention requirements and routine backups.

9. Questions or a formal DPAFor a copy of our data-processing terms, a more detailed data-processing agreement, or any question about how we handle data on your behalf, email privacy@attendly.co.uk. Full details are in our Privacy Policy and Terms of Service.