Data Processing and GDPR Information
Last updated: 4 November 2026
Roles
For guest-uploaded event content, the host (our customer) is the data controller and MyEvent is the data processor, acting only on the host's instructions (e.g. moderation settings, retention period). For account and billing data, MyEvent is the data controller.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hosting provider | Application hosting and database | UK/EU |
| Stripe | Payment processing | UK/EU/US (Stripe's own safeguards apply) |
| Transactional email / SMTP provider | Sending account and event emails | UK/EU |
Security measures
- Passwords hashed with a strong, salted algorithm; never stored in plain text
- Media stored outside the public web root, served via short-lived signed URLs
- EXIF/GPS metadata stripped from public preview images
- Role-based access control and server-side permission checks on every request
- CSRF protection, secure/HTTP-only session cookies, and login rate limiting
- Parameterised database queries throughout
- Admin actions logged in an audit trail
Data export and deletion
Hosts can request a full export or deletion of an event's data from their dashboard, or by emailing privacy@myevent.co.uk. Guests can request removal of their own individual upload directly from the gallery. All deletion requests are logged with date and outcome.
International transfers
We aim to keep data within the UK/EEA wherever possible. Where a sub-processor operates outside the UK/EEA, we rely on that provider's UK-adequate safeguards (e.g. Standard Contractual Clauses).
Data Processing Agreement
Corporate customers requiring a signed Data Processing Agreement (DPA) can request one at privacy@myevent.co.uk.