Use an online system to arrange events
Setting up online event booking for in-house seminars, conferences and courses is technically very straightforward with the right application. However, from a data privacy perspective there are some grave issues with what we might think of as the obvious choice.
Can I use Eventbrite when arranging University events?
The University advises against using Eventbrite when arranging events, because of concerns about how Eventbrite will use the personal data submitted to it. When attendees register for an event via Eventbrite, at this point Eventbrite own the attendees' data. This data doesn’t belong to the University. Eventbrite store attendees' data in the US and state they can also move the data to anywhere in the world. Eventbrite doesn't have any documented data retention policies, stating that attendee data will be kept by them for as long as you are registered to the service. Eventbrite also state they can transfer this data to 3rd parties and take no responsibilities for any data loss or data breaches.
The following are alternatives to Eventbrite:
At time of writing, Billetto is a potential solution more aligned to the usual event management model than Jisc Online Survey or Microsoft Forms. The latter two are more aimed at data capture, but could be utilised for event management at a pinch. Work is required to assess its wider suitability across campus, but it is presented as a potential route away from the privacy-related issues raised by Eventbrite.
If you are looking to arrange a paid-for event such as conferences, events or short courses, you must use the University Online Store. The University Online store is hosted at the University and is compliant against PCI-DSS with appropriate data retention policies already in place.
Here is some more detail about what Eventbrite says:
"If you are visiting the Services from outside the United States, please be aware that you are sending information (including Personal Data) to the United States where our servers are located. That information may then be transferred within the United States or back out of the United States to other countries outside of your country of residence, depending on the type of information and how it is stored by us.”
"We may store Personal Data itself or such information may be stored by third parties to whom we have transferred it in accordance with this Privacy Policy. We take what we believe to be reasonable steps to protect the Personal Data collected via the Services from loss, misuse, unauthorized use, access, inadvertent disclosure, alteration and destruction. However, no network, server, database or Internet or e-mail transmission is ever fully secure or error free. Therefore, you should take special care in deciding what information you send to us electronically. Please keep this in mind when disclosing any Personal Data.”
These statements regarding use of personal data highlight the concerns surrounding using Eventbrite for University purposes.
Updated June 2019