If you are planning to use Eventbrite to ticket events related to the College:
- You must be aware that when you use Eventbrite, you are agreeing for your data to be used as described in Eventbrite’s terms and conditions as follows: “17.1 You acknowledge and agree that if you contribute, provide or make available any Content to the Services (“Your Content”), you hereby grant to Eventbrite a non-exclusive, worldwide, perpetual, irrevocable, royalty-free, transferable, sublicensable (through multiple tiers) right and licence to access, use, reproduce, transmit, adapt, modify, perform, display, distribute, translate, publish and create derivative works based on Your Content, in whole or in part, in any media, for the purpose of operating the Services (including Eventbrite's promotional and marketing services), and you hereby waive any and all moral right to use the name you submit with Your Content.”
- You must not use Eventbrite (or any other generic cloud service, which is not covered by a College service agreement) to collect, capture or process sensitive personal data.
- You must make a risk assessment of whether any personal data and/or sensitive personal data and/or sensitive organisational data (please see College’s Information Governance Policy Framework for full definitions) may be exposed as a result of the information you provide about the event combined with the personal data your guests will provide, and must not use Eventbrite if that is the case. For example, if you are organising an event about promoting a clinical trial, you may be giving away that your guests are affected by the condition covered in your event title or its content.
- You must read the Terms and Conditions of the service carefully and fully, to understand how the information you and your guests provide can be used by the service, and explain this to them in your invitation.
- You must understand that Eventbrite is a US-based company and their Data Centres are located in the US. Although they say they are bound by the EU-US Privacy Shield, the data they collect could be used in line with the US laws and you must include this information in your risk assessment and your invitation.
- Following the risk assessment, if you decide to use Eventbrite for your event, you must include a clear statement in your invitation explaining how the information your guests provide together with your event information can be used, and provide an alternative registration method for those who may not want to use their service. An example statement is provided below.
Recommended template statement to be included in your Eventbrite invitations:
Please note that Eventbrite is a third-party Cloud service, and does not provide the level of information security and data protection for your data you would normally expect from a College information service. We expect you to provide your <<the data required for registration, e.g. full name and email address>> for this event, and you will have to register with the Eventbrite service as a personal consumer. Eventbrite will ask you to create an account with them using at least your first name, last name and your email address. Their terms and conditions state (in summary) that by doing so “[paragraph 17.1] you acknowledge and agree that you grant them full right and licence to use this information for the purpose of operating their Services (including Eventbrite’s promotional and marketing services).” Please also note that Eventbrite is a company registered in the United States, and the data you provide to them is most likely to be kept in the servers outside the European Union. As a result, if you prefer not to use the services provided by Eventbrite to register for this event, as an alternative please contact us on <<contact details>> directly providing your <<details required for registration>> and we will process your registration.
Please note that this guidance generally applies to the use of any Cloud service and do not hesitate to contact the ICT Service Desk and the College Data Protection Office for help and advice, and to discuss any alternatives.