Privacy & data
Privacy notice
This notice explains how XIP Events handles personal data across the XIP website, festival workspaces, Location workspaces and event experiences.
At a glance
- We collect the information needed to provide secure, invitation-only access and run the festival service.
- Festival visitors can use the event experience without an email address or phone number.
- Visitor identifiers are scoped to one event. XIP does not build a cross-event advertising profile or continuously track location.
- We do not sell personal data.
Who this notice covers
This notice covers website visitors, XIP Admins, Festival Owners, Location Managers, named Location staff and people using an event QR experience. A festival organisation may publish additional information for its own processing.
Who is responsible
The responsible organisation depends on the purpose. The festival organisation normally decides why its event information and venue operations are used. XIP Events operates the platform and may be responsible for service security, account access and its own legal obligations. The invitation or event notice must identify the controller and lawful basis for the specific processing.
Details to complete before launch: XIP legal entity, registered address, named privacy contact or DPO, and the controller details for each participating festival organisation.
Information we collect
| Context | Examples |
|---|---|
| Workspace users | Name, email, phone, organisation, job title, Worker ID, role, invitation history, access changes and security audit records. |
| Named Location staff | Name, email, Worker ID and Location association. Contact-only staff do not receive an XIP account or system access in the current service. |
| Festival visitors | An event-scoped pseudonymous participant ID, optional display name, QR touchpoint and time, recommendations shown, starred favourites, ratings, groups and feedback. |
| Photos, where enabled | The image, event and upload time. Photos are stored privately for the organiser review workflow. |
| Security and support | Device, network and sign-in information, access logs, incident records and privacy-request evidence. We do not store passwords in the XIP application. |
How we use it
| Purpose | How it is used | Lawful basis |
|---|---|---|
| Secure access | Send one-time invitations, verify an account and route a person to their assigned workspace. | Documented by the relevant controller before collection. |
| Festival operations | Show dates, Locations, contacts, messages, issues and permissions to authorised people. | Documented by the festival controller, commonly contract or legitimate interests where appropriate. |
| Event experience | Provide requested recommendations and produce thresholded, anonymous service statistics. | Documented for the event; consent is used where the controller requires it. |
| Security and compliance | Prevent misuse, investigate incidents, answer rights requests and meet legal obligations. | Legitimate interests or legal obligation, as recorded by the relevant controller. |
Recommendations are event-scoped and explainable. XIP does not make solely automated decisions that produce legal or similarly significant effects.
Sharing and service providers
Access is shared with the participating festival organisation and authorised Festival Owners or Location Managers for the assigned event. XIP may use providers that host or deliver the service, including Supabase for authentication and database services, Vercel for hosting, Resend for invitation email, Cloudflare R2 for private photos when that feature is enabled and EU Mixpanel for anonymous interaction aggregates and service counts across advertising, event management and desktop/mobile visitor views. Service counts use fixed page and action labels without recognising individual people. Mixpanel receives no comments, photos, form contents, account or participant IDs, phone identifiers or cross-event device identity. Providers receive only the information needed for their service and must be covered by the appropriate contract.
We may disclose information to regulators, professional advisers or public authorities where the law requires it. We do not sell personal data.
International transfers
Some service providers may process data outside the UK. The final notice must name each transfer, destination, safeguard and UK transfer mechanism in the transfer register before that processing starts.
How long we keep it
| Data | Default limit |
|---|---|
| Workspace account and access records | While your access is active, then normally 12 months after revocation or workspace closure. |
| Event participant identity and session links | Removed within 90 days after the event closes. |
| Pseudonymous event interactions and visitor messages | Up to 24 months, then only approved anonymous aggregates remain. |
| Audit, security and privacy-request records | Normally 12 months, unless a legal hold or investigation requires longer. |
| Uploaded visitor photos | 14 days after upload while the pilot lifecycle is active; the event deletion job may remove them sooner. |
| Browser-local event data | Participant IDs, offline queues and visitor names are limited to 90 days; venue feedback is limited to 24 months. |
A documented legal hold, unresolved security investigation or other legal requirement can temporarily suspend deletion. Deletion jobs retain only the evidence needed to show that the job ran.
Security
XIP uses private database schemas, row-level access policies, server-authorised operations, private media storage, short-lived sign-in links, refresh-token rotation, no-store responses for sensitive reads and audited access changes. Secrets and service credentials stay server-side. No security measure removes all risk, so report a suspected compromise promptly.
Your rights
Depending on the controller and circumstances, you can ask for access, correction, erasure, restriction, portability or an objection review. You can withdraw consent where consent is the basis. Signed-in users can open the account menu to update their details, download their workspace data or submit a request. We may need to verify your identity and will normally respond within one month.
Contact the organisation that invited you or use the XIP Events contact form. You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Cookies and browser storage
Essential session cookies support sign-in and security. The event pilot also uses first-party browser storage for event-scoped participant IDs, offline actions and temporary visitor details. We do not use advertising cookies. Clearing browser storage removes that device’s local cache; it does not delete hosted records.
Changes and contact
We will update this page when the service or its data uses change. The page shows its latest update date. If the final controller, lawful-basis or provider details are missing from this draft, ask the organisation that invited you before sharing personal data.