Table of Contents
1. Important information and who we are
Third party websites, applications, and integrations.
The Services include links to third-party websites and applications as well as to integration and partner providers of services associated with a particular event.
Clicking on links to third party websites, content, applications, or integrations may allow those third parties to collect or share data about you. We do not control those third-party websites or content and are not responsible for their privacy policies or the way in which they collect or use your data. Our customers have the ability to integrate a YouTube API into our Session product. Further information about how Google processes personal data via this API as well as your privacy rights is available here.
2. The personal data we collect about you
We may collect and process different kinds of personal data about you which we have grouped together as follows:
- Identity Data which includes your first name, last name, username or similar identifier, password, image, title, age and gender. This may also include government issued ID which you provide to verify your identity or audio-visual content which you appear in as you contribute to or interact with an event.
- Contact Data which includes your home address, email address and telephone number(s).
- Transaction Data which includes details about payments you have made and other details of products and services you have accessed or used through the Services. We do not store card details on our servers. Credit and debit card payments are processed by Stripe on their secure payments server and all card details are fully encrypted and stored by them.
- Technical Data which includes your internet protocol (IP) address, your login data, browser type and version, hardware information, time zone setting and location, browser plug-in types and versions, operating system and website, and other technology on the devices you use to access the Services.
- Profile Data which includes your username, password, purchases or orders made by you, preferences, feedback and survey responses.
- Usage Data which includes information about how you use the Services, as well as third-party platforms which you have linked to your use of the Services. Usage data includes metadata which provides additional context about the way the Services are being used such as length of visit, page views, navigation paths, and page interaction information (such as scrolling, clicks, mouse-overs, and mouse tracking) as well as information about the timing, frequency and pattern of use.
- Marketing and Communications Data which includes your preferences in receiving marketing from us and our third party partners and your communication preferences.
- User Generated Content which includes data you submit as part of an event or as a result of your interactions with the Services such as event materials, videos, chats, and messaging.
We do not knowingly collect or process personal data from children, and no part of our Services is directed to them. A “child” is a person (a) under 13 years old (for residents outside of the EEA/UK, except for the Republic of Korea); (b) under 16 years old or such age needed to consent to the processing of personal data in their country of residence (for residents of the EEA/UK); or (c) under 14 years old (for residents of the Republic of Korea). If you are a parent or guardian and you learn that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from a child without verification of parental consent, we take steps to remove that data from our systems.
3. How is your personal data collected?
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us your Identity Data, Contact Data and other information by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you: (a) create an account with us; (b) access the Services; (c) subscribe (or are subscribed) to the Services; (d) interact in an event; (e) request marketing to be sent to you; (f) enter a promotion or survey; or (g) give us feedback or contact us.
- Automated technologies or interactions. As you interact with the Services, we will automatically collect Technical Data. We also collect Usage Data via cookies, server logs and other similar technologies which track your interaction with the Services.
- Third-Parties. Depending on your use of the Services, we may collect data about you from third-party service providers which you have linked to your use of the Services (including social media account and single-sign-on services), your employer, an individual authorized by you (e.g. a personal assistant), your administrator, the host or organizer or other stakeholder (e.g. sponsor) of an event you register for or attend, publicly available sources, data enrichment vendors, payment and delivery service vendors, advertising networks, analytics providers (such as Google Analytics), and our business partners. The information which we receive from third parties depends on what policies that third party follows and our and your respective relationships with the third party.
4. How we use your personal data
We have set out below, in a table format, a description of how and why we use your personal data, the categories of data used for each purpose and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
||Type of data
||Lawful basis for processing
|To register you as a user of and/or provide access to the Services
|Performance of a contract with you
To process any paid entry to an event:
(a) Managing payments, fees and charges
(b) Verifying your identity and details of your payment method or credit card account
(c) Communicating with you, for example sending you confirmation of your attendance for an event.
(d) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to run our business)
To manage our relationship with you which will include:
(a) Providing access to the Services
(c) Asking you to leave a review or take a survey
(d) Investigating complaints
(d)Marketing and Communications
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to assess how users use the Services)
|To administer and protect our business and our Services (including troubleshooting, data analysis, testing, product / service improvement / development / analysis, system maintenance, support, reporting and hosting of data, compliance with legal and/or regulatory obligations, enforcing our terms and guidelines)
(f) User-generated content
(a) Necessary for our legitimate interests (to run our business, improve / develop / analyze our products / Services, administer our CRM, provide administration and IT Services, network security, to prevent fraud and in the context of a business reorganization or group restructuring exercise)
(b) Necessary to comply with a legal obligation
|To enable you to participate in a competition or complete a survey
(e) Marketing and Communications
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to develop and grow our business)
|To deliver relevant content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
(e) Marketing and Communications
(a) Necessary for our legitimate interests (to assess how users use the Services and to grow our business and inform our marketing and growth strategy)
|To use data analytics to improve our products/Services, marketing, user and partner relationships and experiences
|Necessary for our legitimate interests (to define types of users for certain services and to keep our Services and websites updated and relevant, to develop our business and to inform our product and marketing strategy)
|To make suggestions and recommendations to you about events or other services available through the Services that may be of interest to you
(f) Marketing and Communications
|Necessary for our legitimate interests (to develop the products and Services)
We use various technologies to collect information, and this may include sending cookies to your computer or mobile device. Cookies are small data files stored on your hard drive or in device memory that help us to improve the Services and your experience, see which areas and features of the Services are popular and count visits.
We may also collect information using web beacons (also known as “tracking pixels”). Web beacons are electronic images that may be used in the Services or emails and help deliver cookies, count visits, understand usage and campaign effectiveness and determine whether an email has been opened and acted upon.
Most web browsers are set to accept cookies by default. If you prefer, you can choose to set your browser to remove or reject browser cookies or via the tool provided by our third party provider, Osano. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of the Services.
Advertising and Analytics Services Provided by Others
This information may be used by Hopin and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on the Services and other websites and better understand your online activity.
For more information about Internet-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please visit www.aboutads.info/choices.
5. Disclosures of your personal data
We will share your personal data with the following recipients to achieve the purposes set out in the table “How we use your personal data” above.
- Service providers acting as processors such as those who provide our IT and system administration services.
- Providers of our cloud services such as AWS and Google.
- Stripe – for the purposes of payment transaction management. https://stripe.com/gb/privacy
- Our third-party partners, integration providers, and affiliates whom you engage with in order to facilitate the provision of the Services.
Other Third Parties
- Hosts or event organizers or other stakeholders (e.g. sponsors) whose events you attend through your use of the Services.
- Your employer if you register or access the Services using an email address with a domain that is owned by your employer. Certain information about you including your name and contact details may be provided to your employer.
- Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
- Regulators and other public authorities, including law enforcement agencies, where required by law or policy.
- Our affiliates and group companies.
- In connection with, or during negotiations of, any merger, sale or transfer of company assets, financing or acquisition of all or a portion of our business. If a change happens to our business, we will notify you.
6. International transfers
We will transfer your personal data outside your country of residence in order to provide the Services. When we transfer personal data out of the EEA or the UK, we ensure an appropriate degree of protection is afforded to it by implementing at least one of the following safeguards:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or UK Information Commissioner’s Office (as applicable); and/or
- Where we use providers based in countries outside of the EEA or the UK, we only transfer data to them under the scope of a Data Processing Agreement which incorporates the appropriate Standard Contractual Clauses, or another legally applicable data transfer mechanism, which require them to provide protection to EEA/UK data to the standard expected within the EEA/the UK.
For more information on the Standard Contractual Clauses which we have in place, please contact us via the details provided in the “Contacting Hopin” section below.
7. Data security
We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.
In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions. That said, no method of electronic transmission or storage is 100% secure and we cannot guarantee absolute security.
8. Data retention
We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint, if we reasonably believe there is a prospect of litigation in respect to our relationship with you, or as required or permitted by applicable law.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
9. Your privacy rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:
- Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and certain information to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there are valid grounds for doing so and subject to applicable law.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
- If you want us to establish the data’s accuracy.
- Where our use of the data is unlawful but you do not want us to erase it.
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
- You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Right to data portability. You may have the right to receive certain of your information in a structured, commonly used and machine-readable format and to transmit such information to another controller.
- Object to processing of your personal data where we process your data based on legitimate interest. We will assess your objection and determine whether we have any legitimate grounds/legal justification for continued processing.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
- Right to complain. EEA individuals have the right to make a complaint to the Irish Data Protection Commission (our lead EU supervisory authority) and UK individuals can complain to the Information Commissioner’s Office. You may also direct your complaint or concern to your local data protection authority.
If you wish to exercise any of the rights set out above, please contact us as set forth in the “Contacting Hopin” section below.
10. Contacting Hopin
- Full name and address of legal entity: Hopin Ltd, 5 Churchill Place, 10th Floor, London, E14 5HU
- Email address: [email protected]
Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you and customers the best service/product and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data on the basis of legitimate interests for activities where our interests are overridden by the privacy impact on you.
Performance of Contract means processing your personal data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. In respect to Hopin, that is the performance of our agreement with you to make the Services available. This does not relate to the processing of your personal data during any engagement you enter into with our third party partners or integration providers.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation.
12. California Supplemental Privacy Notice
We do not “sell” the personal information of users of the Services as the term “sale” or “sell” is defined in the California Consumer Privacy Act (“CCPA”). That means we do not sell, rent, or otherwise disclose your personal information in exchange for money or something else of value.
- Notice. You have a right to be provided with a notice at minimum of the categories of personal information collected and the purposes for which it is used at or before the points of collection.
- Right to non-discrimination. The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA, such as by denying or providing a different level or quality of goods or services, or charging different prices or imposing penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.
Requests to exercise your rights may be submitted by emailing us at [email protected] Please be prepared to provide your first and last name and email address that matches information we currently have on file. Where we are unable to verify your identity based upon this information alone, we may require additional details. We will respond to verifiable requests received from California consumers as required by law.
California Shine the Light Law
Under California’s Shine the Light law, California residents who provide us certain personal information are entitled to request and obtain from us, free of charge, information about the personal information (if any, and as defined under the law) that we have shared with third parties during the preceding calendar year for their own direct marketing purposes. We do not share your personal information in this way.