Draft updated: 27 July 2026

Approval status: the website measurement sections below are an implementation-matched draft. Optional Google tracking must remain disabled until EventGen’s owner and privacy adviser/DPO approve the purposes, legal basis, providers, retention, international transfers and final wording.

Evengage Ltd, trading as EventGen (“EventGen”, “we”, “us” or “our”), is a company registered in England and Wales under company number 16480174. This Privacy Policy explains how we collect, use, retain, disclose and protect personal data in connection with the EventGen.ai website, dashboard, event portals, applications, APIs and related services (together, the “Platform”).

This Privacy Policy applies where we act as controller, including for website visitors, prospective customers, organisers, account users and our own business contacts. Where a customer uses the Platform to process attendee, registrant, exhibitor, speaker or other event-participant data on its behalf, that customer is normally the controller and we act as its processor under our Data Processing Agreement. The customer’s own privacy notice also applies to that processing.

1. Who is responsible for your data

Evengage Ltd is the controller for the processing purposes that we determine, including account administration, billing, Platform security, service improvement, our website and our own communications. Our registered office is 129 Little Bushey Lane, Bushey, England, WD23 4SB.

For Customer Content processed on an organiser’s instructions, the organiser is normally the controller and Evengage Ltd is the processor. We may still act as an independent controller for limited purposes required to operate and protect our business, such as fraud prevention, service security, billing, legal compliance and establishing or defending legal claims.

2. Personal Data We Collect

2.1. Account and Profile Data

When you create an account, we collect:

Name (first name, last name)
Email address
Password (stored in hashed form only)
Company name and job title (optional)
Phone number (optional)
Country, city, and timezone (optional)
Profile photo (optional)
LinkedIn URL and X (Twitter) handle (optional)

2.2. Usage Data

We automatically collect information about how you interact with the Platform:

Pages visited and features used
Date and time of access
Actions performed (e.g., creating events, managing registrations)
Session duration and frequency of use

2.3. Technical Data

We automatically collect technical information from your device:

IP address
Browser type and version
Operating system
Device type and screen resolution
Referring URL

2.4. Cookies and Similar Technologies

We use essential cookies and similar storage that are necessary for the Platform to function or to remember privacy choices. These include:

Authentication session cookies
Security tokens (CSRF protection)
User preference cookies (e.g., theme selection, cookie consent acknowledgement)

The marketing website includes an optional, configuration-gated Google Tag Manager foundation. Google consent signals default to denied and the container does not load unless approved configuration is present and the visitor grants the matching choice. If enabled after approval, consented analytics may process page paths, page titles and limited interaction events; consented advertising measurement may process campaign values and advertising click identifiers. The website excludes campaign query strings, click IDs and contact-form contents from its analytics event payloads.

Before advertising consent, a paid touch may remain temporarily in page memory during client-side navigation but is not written to browser storage. After advertising consent, allowlisted campaign values and click identifiers may be held in tab-scoped session storage for up to 30 minutes of inactivity and no more than four hours so the paid source is not lost while a visitor explores the website. The latest paid touch is forwarded only to the dashboard sign-up route under its acquisition-capture contract. Denial or withdrawal clears that record.

The final optional Google configuration, provider disclosures and legal basis require owner/privacy approval before activation. See the Cookie Notice for the implemented categories and controls.

2.5. Communications Data

If you contact us for support or provide feedback, we collect the content of your communications, including email addresses and any attachments.

2.6. Event and Customer Content

Customers may configure the Platform to collect names, contact details, organisation and role information, registration responses, accessibility or dietary requirements, profile information, photographs, documents, attendance, session, meeting, purchase and communication records, and other fields selected by the customer. Customers determine which fields they collect and must avoid collecting data that is unnecessary for their event.

2.7. Transaction, Billing and Provider Data

We process subscription, invoice, payment-status and transaction-reference information. Payment card details are generally collected directly by our payment provider and are not stored by us. Where customers connect their own communications, payment or identity providers, we process the configuration and limited provider identifiers needed to operate that connection; secret credentials are protected and access-restricted.

2.8. AI and Document Processing

If a customer chooses an AI-assisted feature, relevant prompts, configurations, records or documents may be sent to an AI service provider to produce the requested output. We use those inputs to provide the requested feature, maintain security and quality, and investigate faults. Customers must ensure they have authority to submit the data and should not submit unnecessary special-category or highly sensitive data. Material AI-assisted actions remain subject to user review or the customer’s configured workflow.

2.9. Sources

We obtain personal data directly from you, from the customer or authorised users administering an event, from people who register or interact with a portal, from connected services at the customer’s direction, and automatically from use of the Platform. If a customer imports personal data, the customer is responsible for the lawfulness, accuracy and transparency of that import.

3. How We Use Your Personal Data

We use your personal data for the following purposes and on the following legal bases:

Purpose	Legal Basis (GDPR Art. 6)
Providing and operating the Platform	Performance of contract (Art. 6(1)(b))
Account creation and authentication	Performance of contract (Art. 6(1)(b))
Sending transactional emails (password resets, invitations, account notifications)	Performance of contract (Art. 6(1)(b))
Improving and developing the Platform	Legitimate interest (Art. 6(1)(f))
Preventing fraud and ensuring security	Legitimate interest (Art. 6(1)(f))
Billing, payment administration and accounting	Performance of contract, legitimate interests and legal obligation, as applicable
Service monitoring, troubleshooting and audit records	Legitimate interests in operating a secure and reliable service
Customer-configured AI processing	Customer instructions where we are processor; contract or legitimate interests where we are controller
Responding to support requests	Legitimate interest (Art. 6(1)(f))
Optional website analytics and paid-campaign measurement, if approved and enabled	Consent where required; final assessment and wording pending owner/privacy approval
Complying with legal obligations	Legal obligation (Art. 6(1)(c))
Sending marketing communications (product updates, tips)	Consent or legitimate interests where applicable law permits, including any valid business-contact or existing-customer rules

4. Data Sharing

We do not sell your personal data to third parties. We may share your personal data with:

4.1. Service Providers and Sub-processors

We use service providers for hosting, storage, security, email and messaging delivery, authentication, payments, AI, support and other operational functions. They may process personal data only for the contracted purpose and are subject to appropriate data-protection obligations. Our current provider list, purposes and principal processing locations are published on our Sub-processors page.

Cloud hosting and infrastructure (e.g., data storage, compute services)
Email delivery services (for transactional and marketing emails)
Authentication providers (including supported social sign-in providers)
Payment processors (if applicable, for subscription billing)
Google measurement services (only if the optional, consent-gated GTM/Analytics/Ads configuration is approved and enabled)

4.2. Legal Requirements

We may disclose your personal data if required to do so by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3. Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your data.

5. International Data Transfers

Some providers or their support operations are located outside the United Kingdom. Where a restricted transfer occurs, we use an applicable adequacy regulation, the UK International Data Transfer Agreement or Addendum, the European Commission Standard Contractual Clauses as adapted for UK use, or another lawful safeguard. We assess relevant providers and apply proportionate technical and organisational measures. A copy or summary of the relevant safeguard may be requested from privacy@eventgen.ai, subject to lawful redactions.

Transfers to countries with an adequacy decision from the UK Secretary of State or the European Commission;
Standard Contractual Clauses and the UK International Data Transfer Addendum;
Other legally recognised transfer mechanisms.

6. Data Retention

We retain your personal data for as long as your Account is active or as needed to provide you with the Platform. Specifically:

Account and Customer Content: Retained while the Account is active and deleted or anonymised following verified Account closure and any notified retrieval period, subject to backup cycles, customer instructions and lawful retention.
Usage, audit and technical data: Category-specific operational records are ordinarily retained for between 30 and 180 days. Selected administrative or security evidence may be retained for up to 12 months, or longer where reasonably necessary to investigate abuse or protect legal rights.
Marketing-site privacy and paid-attribution storage: Privacy choices are retained in local storage for up to 180 days. After advertising consent, allowlisted paid-attribution values are retained in tab-scoped session storage for up to 30 minutes of inactivity and no more than four hours. Provider-side retention, if optional Google services are approved, must be selected and documented before activation.
Communications data: Retained for up to 24 months after the last communication.
Billing, tax, legal and compliance records: Retained for the period required by applicable law, ordinarily at least six years and longer where required for an open audit, dispute or legal obligation.
Suppression records: A minimal record may be retained for as long as necessary to honour an unsubscribe, objection, complaint or permanent delivery suppression.

After the applicable retention period, we will securely delete or anonymise your personal data.

7. Registrant Data (Data Processor Role)

7.1. When event organisers use the Platform to collect data from Registrants, the event organiser is normally the data controller and Evengage Ltd acts as its processor.

7.2. We process Registrant data on documented customer instructions, including the Terms, the customer’s configuration and our Data Processing Agreement, unless the law requires otherwise.

7.3. Event organisers are responsible for:

Providing appropriate privacy notices to their Registrants;
Obtaining any necessary consents for data collection;
Ensuring their use of Registrant data complies with applicable data protection laws;
Responding to data subject requests from their Registrants.

7.4. We will assist event organisers in responding to data subject requests to the extent technically feasible and as required by applicable law.

7.5. Customers control the active retention and deletion of Registrant data through the Platform, subject to technical, contractual and legal limits. Following Account closure, Customer Content is handled under Section 6 and the Data Processing Agreement.

8. Data Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit (TLS/SSL)
One-way password hashing using an industry-standard adaptive algorithm
Access controls and authentication mechanisms
Tenant and event scoping, audit records, backups and security reviews

However, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.

9. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

Right of access: You may request a copy of the personal data we hold about you.
Right to rectification: You may request correction of inaccurate or incomplete personal data.
Right to erasure: You may request deletion of your personal data in certain circumstances.
Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances.
Right to data portability: You may request a copy of your personal data in a structured, commonly used, machine-readable format.
Right to object: You may object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at privacy@eventgen.ai. We will respond without undue delay and normally within one month. Where the law permits an extension for a complex request or multiple requests, we will tell you within the initial one-month period.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

If your request concerns data held by an event organiser, please contact that organiser first. We will assist the organiser where we act as its processor.

10. Marketing Communications

We send marketing communications only where permitted by applicable law, for example with consent or where a valid existing-customer or business-contact rule applies. You can object or withdraw consent at any time by:

Clicking the “unsubscribe” link in any marketing email;
Updating your marketing preferences in your Account settings;
Contacting us at privacy@eventgen.ai.

Withdrawal of marketing consent does not affect transactional communications necessary for the operation of the Platform (e.g., password resets, security alerts, billing notifications).

11. Automated processing and AI

The Platform may help customers configure workflows, analyse content, match participants or assess documents. EventGen does not use solely automated processing to make decisions about individuals that produce legal or similarly significant effects for our own purposes. Customers are responsible for determining whether their configured use involves such a decision, providing required information and safeguards, and enabling meaningful human review where required.

12. Children’s Privacy

EventGen organiser Accounts are intended for people aged 18 or over. Customer events may, however, involve children or young people. In those circumstances, the customer, as controller, is responsible for establishing an appropriate lawful basis, providing age-appropriate privacy information, obtaining any required parental authorisation and configuring proportionate access controls and retention periods. We process that data only on the customer’s documented instructions unless the law requires otherwise.

If you believe a child’s personal data has been submitted improperly, contact the relevant event organiser or privacy@eventgen.ai. We will assist the organiser and take appropriate action.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and notify you through the Platform. Your continued use of the Platform after such notification constitutes your acknowledgement of the updated Privacy Policy.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Evengage Ltd, trading as EventGen
Company number 16480174
ICO registration: ZC207549
Registered office: 129 Little Bushey Lane, Bushey, England, WD23 4SB
Data Protection Enquiries
Email: privacy@eventgen.ai
General Support: support@eventgen.ai