To sell tickets, you need less data from your guests than most registration forms ask for. Every additional field is effort for the guest, a storage obligation for you and, if in doubt, a question you have to answer during an audit. The General Data Protection Regulation (GDPR) calls this data minimisation: you collect what is necessary for the purpose, no more.
The question before every field
For every data field there is exactly one sensible test: what specifically happens with this information? If the answer is “it might come in handy later”, the field does not belong in the form.
Which guest data you need to sell tickets
- Email address. Without it, the ticket does not arrive.
- Name. Necessary for personalised tickets, not for non-personalised ones.
- Billing details. Only if an invoice is issued.
That is the complete list for a simple event. Everything else needs a reason of its own.
What needs an additional reason
The date of birth makes sense for age restrictions, otherwise not. You do not need the postal address for a digital ticket. Phone numbers are practical in case of cancellations, but only if you also state that purpose. Dietary information at conferences is a special case, because it allows conclusions about religion or health and therefore counts as specially protected data under Article 9 GDPR. It should be requested on a voluntary basis and deleted early.
Retention with an expiry date
Invoices and booking records are subject to the retention periods under tax law. Everything else needs a date on which it disappears. One possible schedule:
- Entry logs: a few weeks after the event
- Attendee lists not linked to invoices: a few months
- Newsletter consents: until withdrawn, with proof of consent
What matters is less the exact period than the fact that there is one at all and that it applies automatically.
Photos and consent
The photographer on site is a topic of its own. A notice at the entrance does not replace consent for close-ups of individual guests. Different rules apply to wide shots of a crowd. Clarify beforehand what your photographer is supposed to deliver, not afterwards.
Where the data is stored
The server location is stated in every privacy policy you show your guests. With tickee, the data is stored exclusively on servers in Germany; it is not marketed and not passed on. That spares you the discussion about transfers to third countries and makes the information you give guests considerably shorter.
This article does not replace legal advice. It sorts out the questions you should ask your data protection officer before the form goes online.