This privacy policy explains how Attendium collects, uses and shares personal data, and the rights you have over it.
Who we are. Attendium AB, Reg. No. 556864-9999, Stockholm, Sweden ("Attendium", "we"). For anything in this policy, contact us at support@attendium.com.
For some data we are the controller — we decide how and why it is processed. This covers your Attendium account, our website, billing, support, marketing and aggregate statistics.
For content our customers manage in the service — guest lists, event registrations, invitation responses and ticket buyer details — the event organizer is the controller and Attendium is their processor under a data processing agreement. If you are a guest or ticket buyer and want your data corrected or deleted, contact the event organizer; we act on their instructions and will refer requests to them.
Account holders: registration details (name, email address, company and invoice details), content you upload to the service, support conversations, and service logs (your actions with timestamps and IP address). Payment card details are collected directly by our payment provider — we never store card numbers.
Event guests and ticket buyers: the details you enter when registering for an event or buying a ticket (as requested by the organizer), ticket and pass data including check-ins, approximate location derived from your IP address at purchase, and payment via our payment provider.
Website and app visitors: cookie and usage data as described under Cookies and tracking.
Where we are controller, we process personal data for:
Where we process on an organizer's behalf, the organizer determines the purposes and is responsible for having a lawful basis.
We group cookies and similar technologies into four categories: Essential (sign-in and core functionality), Preferences, Analytics (Google Analytics, Firebase Analytics in our mobile apps) and Advertising (Google Ads, Meta Pixel). Non-essential categories are used only after you consent, and you can change your choices any time at attendium.com/privacy-settings.
We honor the Global Privacy Control browser signal: when your browser sends it, advertising tracking is disabled regardless of other settings.
Our AI features (such as AI-assisted guest import) run within the EU. Your input and the generated output are never used to train AI models. Input is deleted shortly after processing; if you flag a result as wrong, the related input and output are kept for up to 30 days so we can diagnose the problem, unless your account has opted out of such review (email support@attendium.com). Details are in the AI features addendum.
To give organizers aggregate audience statistics, we estimate an approximate gender from names. The estimate is statistical, is only ever shown in aggregate (never per person), is not exposed through our API, and organizers can disable the feature. Our legal basis is legitimate interest; you can object via support@attendium.com.
We do not sell personal data. We share it only with:
Our services are hosted in the EU, and core processing stays in the EU. Where a service provider processes personal data in the US (for example customer support), it does so under the EU-US Data Privacy Framework or equivalent safeguards — each provider's location is stated in the sub-processor list. If you consent to analytics or advertising cookies, those providers may process data in the US under safeguards such as the EU-US Data Privacy Framework.
We keep personal data only as long as needed for the purposes above. When data is deleted — by you, by an organizer, or because you delete your account — it is removed from our active systems promptly and from all backups within 7 days. Invoicing records are kept as long as bookkeeping law requires. AI input follows the shorter windows described under AI features.
All connections are encrypted in transit, data is encrypted at rest, and passwords are hashed. More at attendium.com/security.
If you are in the EEA, UK or Switzerland you can ask us to access, correct, delete, restrict or export your personal data, object to processing based on legitimate interest (including direct marketing), and withdraw consent at any time without affecting earlier processing. Contact support@attendium.com; we may need to verify your identity. Where the event organizer is the controller, we will refer your request to them.
You can also lodge a complaint with a supervisory authority — in Sweden the Swedish Authority for Privacy Protection (IMY, imy.se) — or with the authority where you live.
In the past 12 months we have collected these categories of personal information: identifiers (name, email, IP address), commercial information (purchases and subscriptions), internet activity (service logs, cookie data), approximate geolocation, and inferences (the aggregate gender estimate described above). We collect them from you or from the event organizer, and disclose them to the service providers listed above for business purposes.
We do not sell personal information. The only "sharing" for cross-context behavioral advertising is through advertising cookies, which you can decline at attendium.com/privacy-settings or via the Global Privacy Control signal, which we honor as an opt-out.
You can request to know, access, correct or delete your personal information, opt out of sharing, and you will not be discriminated against for exercising these rights. We honor these rights for all US residents regardless of which state laws technically apply. Contact support@attendium.com.
Attendium accounts require you to be at least 18 (or have a guardian's approval where the law allows). Guest data submitted by organizers may include children; the organizer is the controller for that data and responsible for its lawful use.
We may update this policy as the service evolves. We will notify you of material changes in the service before they take effect; the current version is always at attendium.com/privacy-policy.
Questions or requests: support@attendium.com.