Privacy Policy

Last updated: 1 June 2026

Introduction

This Privacy Policy describes how M Events Ltd ("Mevents", "we", "us") handles personal data when you use the Mevents Attendee Hub application (the "App"), available as a web application and as native mobile applications for iOS and Android.

In this policy:

• "You" refers to any attendee or registered user who accesses an event through the App.
• "Event Organiser" refers to the business or individual that operates an event you have registered for and that uses the Mevents platform to manage that event.
• "Ticketing system" refers to any third-party platform through which you purchase a ticket or register for an event.

Who We Are

The App is operated by M Events Ltd, a company registered in England and Wales (company number 16909833), with its registered office at 124 Acomb Road, York, North Yorkshire, United Kingdom, YO24 4EY.

For questions about this policy, contact us at [email protected] or +44 (0)1904 900131.

Our Role and the Role of the Event Organiser

Accounts are not created through the App. Your account is created by the Event Organiser, or by their ticketing system, when you register or purchase a ticket for an event. The App provides authenticated access to that existing account.

Under applicable data protection law, including the UK General Data Protection Regulation (UK GDPR), the Event Organiser is the controller of personal data relating to your attendance at their event. Mevents acts as a processor on the Event Organiser's behalf, processing that data only as necessary to provide the platform.

For platform operations that we perform independently — such as authenticating your login, sending one-time passcodes, and maintaining our infrastructure — Mevents is the controller, because these activities are carried out for our own purposes rather than on the Event Organiser's instructions.

Data We Collect

We process the following categories of personal data:

• Email address — to authenticate your account using a one-time passcode (OTP) sent to your email.
• Name and registration details — received from the Event Organiser or their ticketing system when you register for an event (for example, full name, display name, and ticket type). This data is not entered through the App.
• Event interaction data — including schedule selections, chat messages, direct messages, and session attendance records.
• Push notification tokens — if you enable notifications, a device token is generated and shared with Google Firebase Cloud Messaging to deliver notifications to your device.
• Camera and microphone data — when you join an interactive video session, the App requests access to your device's camera and microphone. This data is transmitted to Zoom (see Third-Party Services below) and is not recorded or stored by Mevents.
• Device and technical data — device type, operating system, and app or browser version, collected automatically to ensure the App functions correctly.

Biometric data: If you enable Face ID, Touch ID, or fingerprint unlock, all biometric processing is performed by your device's operating system. Mevents does not access, collect, or transmit biometric data. The App stores only a local preference indicating that you have enabled this feature.

How We Use Your Data

We process your data for the following purposes:

• Authenticating your identity and providing access to your account.
• Sending one-time passcodes via email for login.
• Displaying event schedules, sessions, and announcements.
• Enabling real-time chat and direct messaging within events.
• Delivering push notifications about your events.
• Providing access to live streams and interactive video sessions.
• Providing Event Organisers with attendance and registration data for their events.

We do not use third-party analytics or advertising services, and we do not sell your personal data.

Third-Party Services

We share data with the following service providers and parties to operate the App. Unless otherwise stated, these parties act as processors and handle data only on our instructions:

• Event Organisers — as controllers of their events, Event Organisers can access your registration details and event interaction data for their events.
• Hetzner Cloud — server hosting and infrastructure.
• Cloudflare — DNS, content delivery, and security for the App and our website.
• Google Firebase Cloud Messaging — push notification delivery.
• Ably — real-time chat and live event updates.
• Mux — video stream delivery.
• Zoom — interactive video sessions. When you join a session, your camera and microphone data is processed by Zoom under Zoom's privacy policy.
• Postmark — email delivery for OTP codes and event communications.

Data Retention

We retain personal data for as long as your account is active or as needed to provide the App's services. Data may be retained beyond this period where required by law.

Your Rights and Account Deletion

Under applicable data protection law, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.

To exercise any of these rights, email [email protected] from the email address associated with your account.

When we receive a deletion request, we will delete the account-level data for which we are the controller — including login credentials and push notification tokens — within 30 days of verifying your request. Data held under the control of an Event Organiser is subject to that Organiser's own retention policies. Where appropriate, we will forward your request to the relevant Event Organiser(s) on your behalf.

Cookies and On-Device Storage

The App uses cookies, browser local storage, and on-device storage for authentication (session tokens) and user preferences (such as biometric unlock settings). We do not use third-party tracking or advertising cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be indicated by updating the "Last updated" date at the top of this page. Continued use of the App after a change constitutes acceptance of the revised policy.