Data Processing Addendum for Organisers
Summary — Plain English
1. Roles of MyChurch.Events and Organisers
For the purposes of the processing of attendee personal data transmitted through the Platform, MyChurch.Events acts as the data controller in respect of the collection and initial transmission of that data. The organiser acts as a separate data controller (or joint controller, depending on the specific arrangement) in respect of their subsequent use of that data for event management purposes.
2. Subject Matter of Processing
The subject matter of processing is the personal data of ticket buyers and event attendees, transmitted to organisers for the purpose of managing event attendance.
3. Types of Personal Data
The personal data transmitted to organisers typically includes: name, email address, booking reference, ticket type, and check-in status. Additional data may be transmitted if required for the specific event (e.g. dietary requirements for a dinner event), where the buyer has consented.
4. Processing Instructions
Organisers must process attendee data only for the following purposes: managing event attendance, communicating with attendees about the specific event, processing refunds, and complying with legal obligations. Any other processing requires a separate lawful basis.
5. Restrictions on Marketing
Organisers must not use attendee personal data for marketing purposes unrelated to the specific event for which tickets were purchased, unless the attendee has given a separate, freely given and specific consent to receive such marketing. Consent must be obtained in compliance with UK GDPR.
6. Confidentiality
Organisers must ensure that all personnel with access to attendee personal data are bound by appropriate confidentiality obligations and are trained in data protection requirements.
7. Security Obligations
Organisers must implement appropriate technical and organisational measures to protect attendee personal data against accidental loss, destruction, alteration or unauthorised access.
8. Subprocessors
Organisers must not share attendee personal data with third-party processors without a lawful basis and without ensuring that appropriate data protection agreements are in place.
9. Data Subject Requests
If an organiser receives a data subject request (e.g. a request to delete or access personal data) relating to data originally received from MyChurch.Events, the organiser must notify MyChurch.Events at privacy@mychurch.events within 5 working days.
10. Breach Notification
If an organiser becomes aware of a personal data breach involving attendee data received from MyChurch.Events, the organiser must notify MyChurch.Events at privacy@mychurch.events without undue delay and no later than 24 hours after becoming aware of the breach.
11. Deletion of Data
Organisers must delete or return all attendee personal data upon request by MyChurch.Events or upon termination of their organiser account, unless retention is required by law.
Contact us about this policy
If you have any questions, concerns or requests relating to this policy, please contact us: