Legal

Privacy Policy

Last updated: 1 January 2026 • Effective from: 1 January 2026

EventLeadCapture ("we", "our", "us") is committed to protecting your personal information and being transparent about how we use it. This policy explains what data we collect, why we collect it, and your rights under the UK GDPR and Data Protection Act 2018.

1. Who we are

EventLeadCapture is a lead-capture platform for exhibitors and event attendees, operated from the United Kingdom. If you have questions about this policy, contact us at privacy@eventleadcapture.com.

2. What data we collect

We collect data in two contexts:

Account & usage data (when you register or use the platform):

• Name and email address
• Company name and logo (optional)
• Account credentials (password stored as a secure hash — never in plain text)
• Event and form configuration you create
• Your usage activity and login history

Lead data (collected via your event forms on behalf of your organisation):

• Name, email address, job title, and company of event attendees who complete your forms
• Any additional fields you configure in your form
• Submission timestamp and the form or event it was submitted through

3. How we use your data

We use your account data to:

• Provide, maintain, and improve the EventLeadCapture service
• Send transactional emails (account confirmation, password resets)
• Respond to support requests
• Comply with legal obligations

Lead data you collect through your forms is processed on your behalf. You are the data controller for that data; we act as the data processor.

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance — to deliver the service you signed up for
• Legitimate interests — to secure and improve the platform, and to prevent fraud
• Legal obligation — where we are required to retain or share data by law
• Consent — where you have opted in to marketing communications (you may withdraw at any time)

5. Data retention

We retain your account data for as long as your account is active plus 30 days after deletion, to allow for account recovery. Lead data is retained for as long as you maintain your account, or until you delete it. Billing records are retained for 7 years as required by UK tax law.

6. Data sharing

We do not sell your data. We share data only with:

• Infrastructure providers — hosting, database, and storage providers who process data on our behalf under Data Processing Agreements
• Payment processors — for billing purposes only (we do not store payment card details)
• Law enforcement — where legally required

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict or object to certain processing
• Data portability (receive your data in a machine-readable format)
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email privacy@eventleadcapture.com. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use a single session cookie to keep you logged in. We do not use tracking, analytics, or advertising cookies. No cookie consent banner is required for strictly necessary session cookies.

9. Security

We use industry-standard measures including encrypted connections (HTTPS), hashed passwords, and restricted database access. No system is completely secure; if you discover a vulnerability, please contact us at security@eventleadcapture.com.

10. Changes to this policy

We may update this policy from time to time. Where changes are material, we will notify you by email or via a notice in the platform at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.

11. Contact

EventLeadCapture
Email: privacy@eventleadcapture.com