Privacy Policy | Attendly

Privacy PolicyLast updated 28 June 2026

This policy explains what personal data Attendly collects, why we use it, who we share it with, and the rights you have under the UK GDPR and the Data Protection Act 2018. We have written it to be read, not just filed.

1. Who we areAttendly is an event-management platform for schools, charities and community groups in the United Kingdom, operated by Nexabyte. We provide online sign-ups, ticketing and door check-in. In this policy, “Attendly”, “we”, “us” and “our” refer to the operator of the service; “you” refers to the person whose data we process.You can contact us about this policy or any data-protection matter at privacy@attendly.co.uk.

2. Our two roles: controller and processorAttendly handles personal data in two distinct capacities, and the difference matters for your rights:

Controller — for organiser accounts — When an organiser signs up and uses Attendly, we decide how their account data is handled, so we are the data controller for that information.

Processor — for attendee data — When an organiser collects registrations, check-ins and payments for their event, the organiser is the controller of that attendee data and decides why it is collected. Attendly processes it on the organiser’s behalf and under their instructions.

In practice this means that if you registered for or attended an event, the organiser of that event is primarily responsible for your data. We have a separate Data Processing Summary describing that relationship for organisers and their stakeholders.

3. The personal data we processOrganiser account data (we are the controller)

Account details: your name, email address, organisation name and the password hash used to sign you in.

Workspace and role information: which organisations and events you belong to and your permissions.

Payout setup: where you sell tickets, the Stripe Connect account identifiers and payout status returned by Stripe (we never see your full bank details).

Communication preferences and any messages you send us.

Attendee data (the organiser is the controller; we are the processor)

Registration details: name, email address, phone number and organisation, plus any guests an attendee adds.

Check-in records: attendance and time of entry, used for door check-in, capacity and fire-safety / attendance registers.

Payment data for paid events: the buyer’s name and email, the amount, and a Stripe payment reference. Card numbers are entered directly with Stripe and are never stored on Attendly’s systems.

Data we collect automaticallyTo keep the service secure and working we process limited technical data such as your IP address, device and browser type, and essential session cookies. We do not use advertising trackers or sell your data.

4. Why we use your data, and our lawful basesUnder the UK GDPR we must have a lawful basis for each purpose. The table below sets out the main purposes for which Attendly processes personal data and the basis we rely on.

Purpose

Data used

Lawful basis

Providing the registration and ticketing service

Account details, registration details, payment references

Contract — to deliver the service you or your organiser asked for

Running the event: check-in, capacity, attendance and fire-safety registers

Registration details, check-in records

Legitimate interests — the organiser’s interest in running a safe, well-managed event

Taking payment for paid events

Buyer name and email, amount, Stripe payment reference

Contract — to complete the ticket purchase

Keeping financial and tax records for payments

Order and payout records

Legal obligation — UK tax and accounting law

Security, fraud prevention and protecting the service

Technical data, account and login activity

Legitimate interests — keeping the platform and its users safe

Marketing and product update emails

Name and email address

Consent — you can unsubscribe at any time

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to that processing (see Your rights). You can withdraw consent to marketing at any time using the unsubscribe link in any marketing email or our unsubscribe page.

5. Cookies and similar technologiesAttendly uses only the cookies it needs to function. The essential cookies we set keep you signed in and keep your session secure; the service does not work without them, so they are exempt from the consent requirement.We do not currently use advertising or third-party analytics cookies. If we introduce any non-essential analytics in future, we will ask for your consent first and update this policy.

7. International transfersAttendly’s core database, authentication and storage are hosted in the European Union (the eu-west-2 region). Some sub-processors may process limited data outside the UK and EU. Where that happens, the transfer is protected by an appropriate safeguard — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

8. How long we keep data

Account data — kept while your account is active and for a short period afterwards so the account can be reactivated or closed cleanly.

Registration and check-in records — kept for as long as the organiser needs them for the event and their own records; the organiser, as controller, sets this period.

Payment, order and payout records — retained for the statutory period required by UK tax and accounting law (currently at least six years).

Marketing preferences — kept until you withdraw consent, plus a suppression record so we can honour your unsubscribe.

9. Your rightsUnder the UK GDPR you have the right to:

access the personal data we hold about you;

have inaccurate data corrected (rectification);

have your data erased in certain circumstances;

restrict or object to how we process your data;

data portability — receive your data in a portable format; and

withdraw consent at any time, where we rely on consent.

If you registered for an event, the organiser is the controller of your data, so please contact them first; we will support them in responding to your request. For organiser-account data, or if you are unsure who to contact, email privacy@attendly.co.uk and we will respond within the statutory time limit. Self-service export and erasure tooling is on our roadmap.

10. How we protect dataWe use encryption in transit, role-based access controls, audited infrastructure and reputable sub-processors. Payment card details are handled entirely by Stripe, a PCI-DSS Level 1 service provider, and never touch Attendly’s servers. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.

11. Children’s dataAttendly is intended for use by event organisers, who are adults. Some events may involve children’s data (for example a school event). Where that is the case, the organiser is the controller and is responsible for obtaining any necessary consent and for handling that data lawfully.

12. Changes to this policyWe may update this policy as the service evolves or the law changes. We will revise the “last updated” date at the top of the page and, for significant changes, give you reasonable notice.

13. Contact and complaintsQuestions about this policy or your data? Email privacy@attendly.co.uk or get in touch via our contact form.You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office, at ico.org.uk. We would appreciate the chance to address your concern first.