Privacy policy

1. Who we are

1.1 EventDrake Limited is a New Zealand company (EventDrake, we or us). We provide the EventDrake event management and ticketing platform (the service) to businesses that run events.

1.2 Our privacy officer deals with questions and requests about personal information. You can reach the privacy officer, and anyone else at EventDrake, at hello@eventdrake.net.

1.3 In this policy, you means the person whose information we are talking about: an organiser, an admin, an attendee or a visitor to our website. A customer is a business that uses the service under our terms of service.

1.4 If you booked a ticket or registered for an event run by one of our customers, clause 5 is written for you and can be read on its own.

2. Our two roles

2.1 Controller of platform data. Platform data is information about our customers and how they use the service: their accounts, their admins, their transactions with us, and usage of the service. We decide how it is used, so we are its controller. Clauses 3 and 4 cover it.

2.2 Service provider for customer data. Each customer has its own space within the service, called a tenant. Everything inside a tenant is customer data, and it belongs to the customer. That includes information about the customer’s attendees: the people who book, buy, register or are booked through the tenant. For customer data, the customer is the controller and we are its service provider (processor). We handle it only to provide the service to that customer, under our data processing agreement, except for the transaction records in clause 2.3. If that is you, see clause 5.

2.3 Transaction records we keep for ourselves. Transaction records are the orders and payments in a tenant, with the customer and attendee details tied to them. Besides holding them for the customer, we keep them as our own records, for three reasons: our fees are calculated from those orders, so we need them to verify our billing; we need them to prevent fraud and deal with disputes and liability; and we need them to meet our legal obligations and to give customers the records they are entitled to. For that use we are the controller. Where the GDPR or UK GDPR applies, our legal bases are our legitimate interests and, where a law requires us to keep records, legal obligation. Clause 8 says how long we keep them.

3. Information we control

3.1 Organiser accounts and admins. For each person who has an account with us: their name, email address, role, sign-in times and whether they have set up multi-factor authentication.

3.2 Billing. Our customers’ business details and their transactions with us. Card payments for our fees and deposits go through our own Stripe account, and card numbers stay with Stripe. We don’t store them.

3.3 Accounting records. The records our accounting software holds for invoices, payments and tax.

3.4 Usage and internal statistics. How the service is used, which we keep as internal statistics. We tie this information to individuals as little as possible, and we de-identify it where practical.

3.5 Support correspondence.

• Email you send to hello@eventdrake.net, which is hosted on Google Workspace.
• Messages in our optional Telegram group for some community customers. The group is our own support channel and we are the controller for it. It is not part of the service, and we ask members not to post attendee details there.

3.6 Visitors to eventdrake.net.

• Analytics. When we turn on analytics for the website, we will use a cookieless service that doesn’t identify individual visitors.
• Enquiry forms. What you type into a form on the website is sent to us by email.
• Cookies and storage. The website keeps only what it needs to work. Our cookies and storage page lists each item.

4. How we use information we control

4.1 We use platform data for the purposes below. Where the GDPR or UK GDPR applies, each use has the legal basis shown.

4.2 Email. We send service and account email, such as invoices, security notices and notices about changes to our terms. We also send occasional product updates, and you can unsubscribe from those at any time.

4.3 What we don’t do.

• We don’t sell personal information or share it for advertising.
• We don’t use advertising trackers, and we don’t build profiles of people.
• We never use customer data to train AI models.

5. If you booked through an event that uses EventDrake

5.1 Who we are. EventDrake Limited is a New Zealand company that provides booking, ticketing and check-in software to event organisers. If you booked a ticket, registered or were booked by someone else for an event that uses EventDrake, this clause explains how we handle your information. You can contact us at hello@eventdrake.net.

5.2 The organiser is in charge of your information. The organiser of your event decides what information is collected about you and owns it. They are the controller, and we handle it for them as their service provider. The organiser’s own privacy notice tells you how they use your information, and they are your first contact for any question or request about it.

5.3 What the organiser may collect. Depending on how the organiser has set up their event, this can include your email address, phone number, legal name, badge name, preferred name, date of birth and pronouns, your answers to the organiser’s questions (which may include dietary, medical or accessibility needs), your orders and tickets, and your check-in and badge records. If someone else booked for you, the organiser holds the details they gave.

5.4 Payments. Payments go through the organiser’s own Stripe account. Your card details go directly to Stripe, and we don’t store them.

5.5 Where your information is stored. Your information is stored in the data region the organiser chose for their event site. Clause 7 lists the regions and the cases where information is accessed from outside them.

5.6 What we do with it. We store and process your information only to run the service for the organiser: hosting their event site, taking bookings, sending email on their behalf, check-in and badges, support, security and backups. Running the service also means keeping order records: we keep them for ourselves to meet our legal obligations, to verify our billing and to give organisers the records they need, as clause 5.8 explains. We don’t contact you for our own purposes, and we don’t sell your information or share it for advertising. We never use it to train AI models. The companies that help us run the service are described in clause 6.

5.7 Your accounts and names. Each organiser’s event site has its own separate login, so an account you create with one organiser isn’t shared with another. Your badge name and your legal name are separate fields, and the organiser decides which ones to collect.

5.8 How long it’s kept. While the organiser uses EventDrake, your orders stay in their records as your booking history. If the organiser stops using EventDrake, your order records, and the details tied to them, are kept for 7 years and then deleted. Everything else is deleted within 90 days after the organiser’s 30-day export window ends. Logs and backups expire on their own schedule, as clause 8 sets out. We keep your order records partly on the organiser’s behalf and partly as our own records, to check our billing, prevent fraud and deal with disputes. For that second use we are responsible for them, and you can contact us directly.

5.9 Your requests. You can ask the organiser for access to your information, or to correct or delete it. If you write to us instead, we pass your request to the organiser and help them respond. If the organiser no longer uses EventDrake, we deal with your request ourselves.

5.10 Complaints. If you aren’t happy with how your information has been handled, contact the organiser first. You can also contact us, or complain to a privacy regulator, such as the Office of the Privacy Commissioner in New Zealand. Clause 10 lists the regulators.

6. Who we share information with

6.1 Sub-processors. We use other companies to help run the service, such as Amazon Web Services for hosting and Google Workspace for support email. Each one, what it does and where it processes data is listed on our sub-processors page. We use Anthropic’s AI tools for analysis, debugging and software development, under commercial terms. Information we give Anthropic is never used to train its models.

6.2 The organiser’s Stripe account. Attendee payments go through each organiser’s own Stripe account, under that organiser’s agreement with Stripe.

6.3 Our own business tools. For platform data we also use our own Stripe account for billing, accounting software, Google Workspace for email, our Telegram support group and, once enabled, a cookieless website analytics service, as clause 3 describes.

6.4 Otherwise only when we must. We share personal information with anyone else only where the law requires it, with our professional advisers under a duty of confidentiality, or with a buyer if EventDrake or its business is sold.

7. Where your information is stored and sent

7.1 Data regions. Each tenant is created in one data region. Its data is stored in that region, and its backups are kept in a second location in the same region.

7.2 Outside the region. Information may be accessed or processed outside a tenant’s region in these cases:

• Our staff in New Zealand, who run and support the service.
• The hub in Sydney, where we manage customer accounts. It holds account data only, not the contents of tenants.
• Global edge services, which deliver event sites quickly around the world. Global services run from Northern Virginia, where limited operational data (domains, certificates and edge request logs) may be processed.
• Services based in the United States, such as error monitoring, bot protection on forms and checkout, and the AI tools in clause 6.1. The sub-processors page lists each one and where it processes data.

7.3 European Union region. Customer data in a tenant in the European Union region is stored in the European Union. The cases in clause 7.2 are the only ones where it is accessed or processed elsewhere, and each is named below with its safeguard or limit:

• our staff in New Zealand, covered by the European Union and United Kingdom adequacy decisions for New Zealand;
• the hub in Sydney, which holds account data only;
• global edge services run by Amazon Web Services, which handle only limited operational data, under the Standard Contractual Clauses; and
• each sub-processor outside the European Union, under the Standard Contractual Clauses.

We don’t use Anthropic’s tools with customer data from this region except through Amazon Bedrock in a European Union region.

7.4 Safeguards. When personal information leaves the country it was collected in, we rely on:

• the adequacy decisions of the European Union and the United Kingdom for New Zealand, which cover EventDrake itself;
• the Standard Contractual Clauses, with the UK Addendum, for sub-processors in the United States;
• comparable safeguards for information sent overseas, under information privacy principle 12 of New Zealand’s Privacy Act 2020; and
• for Australia, the steps Australian Privacy Principle 8 requires.

8. How long we keep information

8.1 We keep information only for as long as we need it, then delete it.

8.2 Transaction records. Transaction records include the customer and attendee details tied to them. We keep them for 7 years after an account ends on two grounds: on the customer’s behalf, so that the customer and its attendees can still get records of past bookings; and as our own records, because our fees are calculated from those orders and we need the records to verify our billing, prevent fraud and deal with disputes and liability. While a tenant is active, a customer can ask us to delete transaction records older than 7 years, and we do this by hand.

9. Security

9.1 We protect personal information with these measures, among others:

• customer data is encrypted in transit and at rest;
• each tenant has its own separate login pool;
• admin access is role-based, so each admin sees only what their role allows;
• multi-factor authentication is available to tenant admins and required for our staff;
• databases have point-in-time recovery, and backups are copied to the backup location paired with the tenant’s data region; and
• logs are kept for up to 365 days to investigate problems and security events.

10. Your rights

10.1 Your rights. Depending on where you live, you can ask for access to your personal information, and ask us to correct it, delete it, stop using it for a particular purpose, or give you a copy to take elsewhere. Write to the privacy officer at hello@eventdrake.net. We may need to confirm who you are before we act on a request.

10.2 Customer data. If your request is about information an organiser holds in their tenant, we pass it to that organiser, as clause 5.9 explains.

10.3 Backups. Individual records inside backups can’t be corrected or deleted. We make corrections and deletions to live data, and backups expire on their normal schedule. If we ever restore data from a backup, we re-apply the corrections and deletions made since that backup was taken.

10.4 Complaints. Please tell us first, and we will try to put things right. You can also complain to a regulator:

• in New Zealand, the Office of the Privacy Commissioner;
• in Australia, the Office of the Australian Information Commissioner;
• in the United Kingdom, the Information Commissioner’s Office; or
• in the European Union, the data protection supervisory authority in the country where you live or work, or where the problem happened.

11. Regional information

New Zealand

11.1 We handle personal information under the Privacy Act 2020 and its information privacy principles. Our privacy officer can be reached at hello@eventdrake.net.

11.2 When an organiser collects attendee information through the service, the organiser is responsible for giving attendees the notices the Act requires, including under information privacy principle 3A, through its own privacy notice.

11.3 If we have a privacy breach that the Act makes notifiable, we will tell the Office of the Privacy Commissioner and the people affected, as the Act requires. For customer data, we tell the organiser and help them meet their obligations.

Australia

11.4 We handle personal information consistently with the Australian Privacy Principles. When personal information is sent overseas, including to New Zealand and the United States, we take the steps Australian Privacy Principle 8 requires, as clause 7 describes.

11.5 You can complain to the Office of the Australian Information Commissioner.

United Kingdom and European Union

11.6 For platform data, we are the controller, and the legal bases we rely on are in clause 4: contract, legitimate interests and legal obligation. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue.

11.7 For customer data, the organiser is the controller and we are its processor under our data processing agreement. The exception is the transaction records we keep as our own records under clause 2.3: for those we are the controller, relying on our legitimate interests (verifying billing, preventing fraud and dealing with disputes) and, where a law requires us to keep records, legal obligation. You can object to our use based on legitimate interests, as clause 11.6 explains.

11.8 Transfers out of the United Kingdom and the European Union are covered by the safeguards in clause 7. You can complain to the Information Commissioner’s Office in the United Kingdom, or to a supervisory authority in the European Union.

United States and California

11.9 This part applies to residents of California under the California Consumer Privacy Act (CCPA), and to residents of other US states with similar laws.

11.10 What we collect. In the last 12 months we have collected these categories of personal information about our customers, their admins and visitors to our website, from them directly and from their use of the service, and about attendees, from the organisers whose events they booked:

• identifiers, such as name and email address;
• commercial information, such as billing details, transactions with us, and the attendee order records we keep under clause 2.3;
• internet or other electronic network activity, such as sign-in times and technical logs; and
• professional information, such as an admin’s role.

We use them for the purposes in clause 4, and keep them as clause 8 sets out.

11.11 We do not sell or share personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the last 12 months.

11.12 Customer data. For customer data, including attendee information, we are the organiser’s service provider, and requests about it go to the organiser. The exception is the transaction records we keep as our own records under clause 2.3. For those, you can write to us directly at hello@eventdrake.net.

11.13 Your rights. You can ask to know what personal information we hold about you and how we use it, and ask us to delete or correct it. Write to hello@eventdrake.net, or have an authorised agent write for you. We will confirm who you are before we act. We won’t treat you differently, or charge you more, for using these rights.

12. Children

12.1 The service is for businesses. Attendees at an organiser’s event can include children.

12.2 A parent or guardian can book for a child. The organiser is responsible for getting any consent it needs from a parent or guardian before collecting a child’s information.

13. Changes and contact

13.1 We may update this policy. Each change is dated in the version history on this page. If a change materially affects how we handle personal information, we will also tell our customers by email.

13.2 For any question or request about this policy, write to the privacy officer at hello@eventdrake.net.