Privacy Policy
Last updated 8 October 20261. Who we are
Attendly is an event-management platform for local venues, councils, charities, museums, PTAs, schools and community groups in the United Kingdom, operated by Nexabyte. We provide online sign-ups, ticketing and door check-in. In this policy, “Attendly”, “we”, “us” and “our” refer to the operator of the service; “you” refers to the person whose data we process.You can contact us about this policy or any data-protection matter at privacy@attendly.co.uk.2. Our two roles: controller and processor
Attendly handles personal data in two roles. The distinction matters for your rights:Controller — for organiser accounts — When an organiser signs up and uses Attendly, we decide how their account data is handled, so we are the data controller for that information.
Processor — for attendee data — When an organiser collects registrations, check-ins and payments for their event, the organiser is the controller of that attendee data and decides why it is collected. Attendly processes it on the organiser’s behalf and under their instructions.
3. The personal data we process
Organiser account data (we are the controller)
Account details: your name, email address, organisation name, and the password hash used to sign you in.
Workspace and role information: which organisations and events you belong to and your permissions.
Payout setup: where you sell tickets, the Stripe Connect account identifiers and payout status returned by Stripe (we never see your full bank details).
Communication preferences and any messages you send us, including problem reports from the mobile app, which include your device model and app version.
Attendee data (the organiser is the controller; we are the processor)
Registration details: name, email address, phone number and organisation, plus the names of anyone else an attendee books for, when the organiser asks for them.
Check-in records: attendance and time of entry, used for door check-in, capacity and fire-safety / attendance registers.
Payment data for paid events: the buyer’s name and email, the amount, and a Stripe payment reference. Card numbers are entered directly with Stripe and are never stored on Attendly’s systems.
Data we collect automatically
To keep the service secure and working we process limited technical data such as your IP address, device and browser type, and essential session cookies. We also process product-analytics usage data — pages viewed and actions taken — collected without cookies, to understand and improve the service. When you’re logged in, that usage data is linked to your account ID, never your name or email address. We do not use advertising trackers, track you across other companies’ apps or websites, or sell your data.The Attendly mobile app
Analytics: the screens you open and actions you take, with your device model, operating system and app version, linked to your account ID.
Crash and performance reports: what went wrong or ran slowly, with your device model and operating system. They can include your account ID.
Camera: used only to scan QR codes at check-in. We don’t store or upload camera images.
Face ID and fingerprint login: handled entirely by your device. We never receive your biometric data.
Offline check-in: event and attendee lists are kept on your device so check-in works without a signal. They are deleted when you log out.
4. Why we use your data, and our lawful bases
Under the UK GDPR we must have a lawful basis for each purpose. The table below sets out the main purposes for which Attendly processes personal data and the basis we rely on.Purpose
Data used
Lawful basis
Providing the registration and ticketing service
Account details, registration details, payment references
Contract — to deliver the service you or your organiser asked for
Running the event: check-in, capacity, attendance and fire-safety registers
Registration details, check-in records
Legitimate interests — the organiser’s interest in running a safe, well-managed event
Taking payment for paid events
Buyer name and email, amount, Stripe payment reference
Contract — to complete the ticket purchase
Keeping financial and tax records for payments
Order and payout records
Legal obligation — UK tax and accounting law
Security, fraud prevention and protecting the service
Technical data, account and login activity
Legitimate interests — keeping the platform and its users safe
Understanding and improving how the service is used
Technical data, pages viewed and actions taken, linked to your account ID when you’re logged in
Legitimate interests — improving the product for all users
Marketing and product update emails
Name and email address
Consent — you can unsubscribe at any time
7. International transfers
Attendly’s core database, authentication and storage are hosted in eu-west-2 (London, UK). Some sub-processors may process limited data outside the UK and EU. Where that happens, the transfer is protected by an appropriate safeguard — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.8. How long we keep data
Account data — kept while your account is active and for a short period afterwards so the account can be reactivated or closed cleanly.
Registration and check-in records — kept for as long as the organiser needs them for the event and their own records; the organiser, as controller, sets this period.
Payment, order and payout records — retained for the statutory period required by UK tax and accounting law (currently at least six years).
Marketing preferences — kept until you withdraw consent, plus a suppression record so we can honour your unsubscribe.
9. Your rights
Under the UK GDPR you have the right to:access the personal data we hold about you;
have inaccurate data corrected (rectification);
have your data erased in certain circumstances;
restrict or object to how we process your data;
data portability — receive your data in a portable format; and
withdraw consent at any time, where we rely on consent.
10. How we protect data
We use encryption in transit, role-based access controls, audited infrastructure and reputable sub-processors. Payment card details are handled entirely by Stripe, a PCI-DSS Level 1 service provider, and never touch Attendly’s servers. No system is perfectly secure, but we work to protect your data and to detect and respond to incidents.11. Children’s data
Attendly is intended for use by event organisers, who are adults. Some events may involve children’s data (for example a school event). Where that is the case, the organiser is the controller and is responsible for obtaining any necessary consent and for handling that data lawfully.12. Changes to this policy
We may update this policy as the service evolves or the law changes. We will revise the “last updated” date at the top of the page and, for significant changes, give you reasonable notice.13. Contact and complaints
Questions about this policy or your data? Email privacy@attendly.co.uk or get in touch via our contact form.You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office, at ico.org.uk. We would appreciate the chance to address your concern first.© 2026 Attendly. Built in the UK for community events.