Privacy Policy

Last updated: 18 October 2026.

This Privacy Policy explains how EventMonster collects, uses, shares, and protects personal data, in line with the UK General Data Protection Regulation, the EU General Data Protection Regulation, and the Data Protection Act 2018.

EventMonster is currently in beta release. While the platform is in active beta testing, we maintain standard technical and organisational safeguards to protect all personal data entrusted to us.

For account data, EventMonster acts as the data controller. This includes your name, email address, organisation details, login credentials, and records of how you use the platform. We use this data to operate your account, provide customer support, secure the platform, and, where you have not opted out, send you service updates. Our lawful basis for this processing is performance of our contract with you and, for security and service-improvement purposes, our legitimate interests.

Where an organiser sells tickets, collects donations, or manages RSVPs through EventMonster, the attendee, donor, or guest data submitted (such as name, email, home address, postcode, and Gift Aid tax declarations) is controlled by that organiser, not by EventMonster. EventMonster acts as a data processor on the organiser's behalf for that data, processing it solely to operate the ticketing, voluntary donation, and declaration schedules configured by the organiser. Organisers are responsible for establishing their own lawful basis for processing. For Gift Aid declarations, HMRC statutory rules require full donor names, home addresses, and declaration records to be securely retained for 6 tax years for audit purposes. If you are an attendee or donor with questions about how your data is processed, you should first contact the event organiser; EventMonster will assist organisers in fulfilling data subject rights where required.

We do not sell personal data to any third party, and we do not use attendee or guest data collected on an organiser's behalf for EventMonster's own marketing.

Online payments are processed directly by Stripe using the organiser's own connected Stripe account, under Stripe's own privacy policy. EventMonster does not receive or store full card numbers or other sensitive payment credentials; we may receive limited transaction metadata (such as amount, donation portion, and payment status) needed to confirm ticket purchases and generate receipts.

We use a limited set of third-party service providers and processors to operate the platform, including our cloud hosting and database provider, transactional email delivery (for ticket delivery, Gift Aid receipts, RSVP confirmations, and account emails), web and product analytics providers (Google Analytics and PostHog, described below), and Stripe for payment processing. These providers process data under contract with us and only for the purposes we specify. Some of these providers may process data outside the UK or EEA; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

We use essential cookies and session storage required for the platform to function securely, such as keeping you logged in. Where you have opted in via our cookie consent banner, we also use analytics, provided by PostHog and Google Analytics (GA4), to understand how people discover and browse public organiser and event pages, navigate checkout, and engage with platform features. This analytics data is processed with privacy protections in place: it is not linked to your account credentials or payment details, IP anonymization is applied, and tracking does not run without your consent. We do not use third-party advertising cookies or cross-site tracking pixels of any kind. You can update or withdraw your analytics cookie consent at any time using the cookie preferences link in our footer; doing so stops any further analytics collection immediately.

We retain account data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, or dispute-resolution obligations. Organisers control the retention of their own attendee and guest data and can delete it from their dashboard; statutory Gift Aid audit records are retained in compliance with HMRC's mandatory 6-year retention schedule.

Under UK and EU data protection law you have the right to request access to, correction of, deletion of, or a portable copy of your personal data, and to object to or restrict certain processing. To exercise these rights over your EventMonster account data, or if you are an attendee unable to resolve a request directly with an event organiser, contact us using the address below. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority.

EventMonster is not directed at children, and we do not knowingly collect personal data from anyone under 16 without appropriate parental or guardian consent having been obtained by the organiser or account holder responsible for that data.

In the event of a personal data breach that poses a risk to individuals, we will notify affected organisers and, where required by law, the relevant supervisory authority, without undue delay.

We may update this Privacy Policy from time to time to reflect changes in the law, our beta testing status, or how EventMonster operates; the date at the top of this page will be updated when we do, and material changes will be highlighted where appropriate.

Data requests and privacy questions can be sent to the address below.

Data requests: [email protected]