Why the GDPR matters for event apps
An event networking app is built on personal data: names, roles, companies, photos, messages and meeting times. Under the GDPR, the organizer is usually the controller of that data and the app vendor is the processor. That means you choose the vendor, you are accountable for the choice, and you need a contract that defines how the vendor handles the data.
This is a practical checklist, not legal advice. For your specific event, involve your data protection officer or legal counsel.
Where is attendee data hosted?
Hosting in the EU avoids most questions about international data transfers. If a vendor hosts outside the EU, for example in the US, transfers need a legal basis such as the EU-US Data Privacy Framework or standard contractual clauses, and you should document that in your records. Our comparison of 10 event networking apps lists what each vendor publishes about its hosting.
Conferras is operated by a German company and hosts data in the EU, under the GDPR, with data encrypted in transit and at rest.
The GDPR checklist for choosing an event app
- Data processing agreement (DPA): the vendor signs a DPA under Art. 28 GDPR and lists its sub-processors.
- Hosting location: EU, or a documented legal basis for transfers outside the EU.
- Security: encryption in transit and at rest, access controls and a named contact for incidents.
- Data minimisation: only the profile fields you need, with optional fields clearly marked.
- Visibility: attendees know which profile information other attendees can see.
- Access control: you decide who can join the event, and you can remove someone.
- Attendee rights: attendees can see, export and delete their data.
- Retention: a clear plan for what happens to the data after the event.
Inform attendees before they join
Tell attendees what the app is for, which data they share and who can see it, ideally in the invitation and on the first screen of the app. Link your privacy policy and name the app vendor as a processor. Transparency also helps adoption: people fill in profiles when they understand why.
Messages, photos and LinkedIn links
Private chat messages are personal data of both participants. Profile photos and LinkedIn links are optional and should stay optional. Make sure the app does not expose more than an attendee chose to share, and that sponsors only receive data attendees have actively shared with them, for example by booking a meeting.
After the event
Decide in advance how long the app stays open after the event and when data is deleted. Keep exports such as attendee lists or analytics only as long as you need them, and only share them with sponsors on a valid legal basis. A short note in your follow-up email ("the app stays open until …") avoids surprises.