When you run an event on ShowRave, you receive personal data about your ticket buyers, their name, email address, and order details. Under data protection law, including GDPR in the UK and Europe, you have responsibilities for how you collect, store, and use that data. This article covers the essentials. If your events involve significant data processing, consult a qualified data protection adviser.
You are a data controller for your event
As an event organiser, you are a data controller for the attendee data you receive through ShowRave. This means you are responsible for deciding how that data is used and ensuring it is handled lawfully. We act as a data processor on your behalf when we collect and store attendee data for your events.
Use attendee data only for the purpose it was collected
Attendees provided their name and email address to buy a ticket to a specific event. You may use that data to:
- Manage entry at the event (checking the guest list, scanning tickets)
- Send communications directly related to that event, for example, logistics updates, reminders, and post-event follow-ups
- Fulfil any AddOn orders placed alongside the ticket
You must not use the data for unrelated marketing, add attendees to general mailing lists without their explicit consent, or share the data with third parties for their own use. Our Terms of Service require organisers to handle attendee data in compliance with applicable law.
Store data securely
Any attendee data you export (for example, a CSV attendee list) must be stored securely. Do not leave exported files accessible in shared folders without access controls. Delete exported files when they are no longer needed for the event.
Respond to data subject requests
If an attendee contacts you to request access to, correction of, or deletion of their personal data, you must respond within the timeframe required by applicable law (typically 30 days under GDPR). If the attendee's request relates to data held by ShowRave rather than data you hold separately, direct them to us via the contact page.
Data retention
Do not hold attendee data for longer than necessary. Once an event has concluded and any follow-up communications are complete, you should delete exported attendee lists unless you have a specific legitimate reason to retain them (for example, financial record-keeping requirements).
If you run events for children
If your event is aimed at attendees under 16, additional data protection requirements apply. Consult applicable guidance in your jurisdiction before processing data for events targeted at children.
Related articles: