“What are you doing for GDPR?” is the question on the lips of every promoter, club, conference and event organiser in the UK right now. So, the team here thought the time was right to give you a small update on the work we’ve been doing to prepare for the new legislation, which comes into force on 25 May 2018.We caught up with our GDPR project-lead and Client Services Director, Lisa Brown, for a quick chat to give you a behind the scenes look at the work we’ve been doing to make sure we’re ready for May 25th.
EG: What actions have we completed so far in preparation for the legislation changes?
LB: We have carried out an internal GDPR compliance audit to ensure we are ready for the new legislation. From this we created a GAP analysis and have projects already underway to cover these. We’ve also undertaken a huge amount of independent research, attended conferences, met with specialists and taken advice from our legal team to ensure that our new policies and processes are aligned with the incoming changes.
EG: How does the new legislation affect the customer data that is currently being collected through ticket sales?
LB: We currently acknowledge and process all requests relating to data in accordance with the Data Protection Act 1998 and in accordance with the Information Commissioner Office’s (ICO) guidance. We have mapped the flows of all of our customer data and have clarity on where our data is kept, what data we keep, who it is shared with and how it is processed. Given the nature of our business, we will continue to process personal information in order to complete the transaction of a ticket purchase and promote the events we sell for accordingly (and for other legitimate purposes we tell you about or you would expect). We also give all of our customers the option to stop receiving marketing communications from us.
However, one thing GDPR does hold businesses to account for, is the length in which such data is kept. At Ticket Arena and Event Genius we will always keep customer data for as long as we need it to carry out the services we provide, and to market events (until such a time as the customer opts-out or notifies us). Should a customer become inactive with us, we will be able to anonymise that data but retain the transactional history of the customer to keep a record of the services provided.
However, while event owners may access this data for legitimate reasons such as event management and safety, if a customer has opted-out of marketing from the event owners, then any further promotional material for the event can only be delivered to the customers by Ticket Arena (unless they have also opted out of receiving marketing communications by us).
If the customer has given permission to be contacted with further marketing materials by the event organiser, then they may send the customer marketing communications (but the event organiser must also comply with the legislation and include unsubscribe option as applicable). It is therefore important that all of our clients also have their internal processes in place before the May deadline.
EG: What are the project’s next steps?
LB: We continue to prepare for the new legislation, whilst finalising our internal policies and documentation. Once all of our actions are completed, we will ensure our clients are notified in advance of the deadline.
Want to ask us a question?
Tell us about your events and discover how Event Genius will help you deliver unforgettable experiences from the moments tickets go on sale, until the music stops.