You'll find this area on the ‘create event’ page at the end of the process under 'policies and conditions'. This is also where you can put your terms & conditions and refund policy.
Under the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) you must tell your attendees about any personal data you collect. This is particularly important if you collect any sensitive data, such as medical information.
Personal data is anything that can be used to identify someone. This includes:
- Email address
- Medical conditions
- ID cards
- IP address and location data
Sensitive data includes medical information or information about the protected characteristics (age, sex, race etc.) This data is categorised as special category data and is heavily regulated. You can read about this here: special category data.
You must only collect data that is absolutely necessary.
We recommend you seek professional guidance on your responsibilities under the GDPR. You can also find official information on the ICO website.
You must clearly explain what you do with your attendees' data, including:
- Noting any parties who will process the data (including Helm Tickets and any third-party integrations you use like MailChimp or HubSpot), which data is shared, and why
- What data you're collecting e.g. medical conditions, contact details
- How the data is collected e.g. through Helm Tickets
- Why you need it e.g. if you must legally have medical conditions on record for your event insurance or to protect attendees from allergens
- The legal basis for collecting it. You must meet one of the 6 legal bases for collecting the information:
- Legal obligation
- Vital interests
- Public task
- Legitimate interest
You can read more about the requirements for each one here, and you can find out more about other rights under the GDPR here.