Privacy Policy

Last updated: 18th August 2026

This policy explains how Add to Event Limited ("Add to Event", "we", "our", or "us") collects, uses, and protects personal data when you use our Platform at addtoevent.co.uk or interact with us in connection with it.

Add to Event Limited is the controller of the personal data described in this policy. We are a company registered in England and Wales (company number 09342225) with our registered office at Camburgh House, 27 New Dover Road, Canterbury, CT1 3DN.

This policy should be read alongside our Terms of Use. Cookies are covered in our separate Cookie Policy.

• We collect personal data from Event Organisers and Suppliers so we can run the Platform and connect them.
• We don't sell your personal data.
• We use it to operate the Platform, communicate with you, prevent fraud, and improve our services.
• You can update your details, manage your marketing preferences, and exercise your data protection rights at any time. The "Your rights" section explains how.
• If you have a question about how we handle your data, contact our data protection team at data@addtoevent.co.uk.

The personal data we collect depends on how you use the Platform. We collect data directly from you when you sign up, submit a Quote Request, send or respond to messages, post a Review, contact our support team, or otherwise interact with the Platform. We also generate data about how you use the Platform (usage data) and, in limited circumstances, supplement it with publicly available information about your business.

If you're an Event Organiser

When you submit a Quote Request or create an Account as an Organiser, we collect:

• Contact and identity information: name, email address, telephone number, postcode, and address where relevant to the event.
• Event details: the information you provide about the event you're planning, including date, location, guest numbers, and any specific requirements.
• Quote and message history: the Quote Requests you submit and the messages you exchange with Suppliers through the Platform.
• Reviews: any Reviews you leave about Suppliers, including the content of those Reviews.
• Support communications: records of your interactions with our support team, including emails, chat transcripts, and recorded communications (see the "Recorded communications" section).
• Usage data: information about how you interact with the Platform, such as pages visited, features used, and devices and IP addresses used to access the service.

If you're a Supplier

When you sign up as a Supplier and use the Platform, we collect:

• Account and contact information: name, business name, email address, telephone number, business address, and postcode.
• Business and verification information: insurance details, qualifications and certifications, VAT number, company type, and any identity or business verification documents we ask you to provide.
• Listing content: the descriptions, images, video and audio, service categories, and location information you publish on your Listings.
• Quote and message history: the Quote Requests you respond to, the Quotes you submit, and the messages you exchange with Organisers through the Platform.
• Credit balance and usage history: the credits you have purchased, used, or had issued to you, and the activity associated with that usage.
• Reviews received: the Reviews left about you by Organisers and any responses you provide.
• Payment and billing information: the payment details you provide to purchase credits, and the records of those transactions. We don't store full card details ourselves; these are held by our PCI-DSS compliant payment provider.
• Support communications: records of your interactions with our support team, including emails, chat transcripts, and recorded communications (see the "Recorded communications" section).
• Usage data: information about how you use the Platform, including logins, activity patterns, response rates, and devices and IP addresses used to access the service.

Most of the personal data we hold comes directly from you. In some cases we may also receive or generate data from:

• Publicly available information about Suppliers' businesses (for example, from a Supplier's own website, Companies House, or business directories), which we may use to enhance Listings, verify business information, improve listing quality, and maintain the accuracy of information displayed on the Platform, in line with our Terms of Use.
• Our payment provider, in connection with credit purchases and any chargebacks or refunds.
• Fraud prevention and identity verification services, where we use them to protect the Platform.
• Analytics and advertising providers, for the limited purposes described in the "How we use your personal data" and "Cookies" sections.

We use personal data only where we have a lawful basis under UK GDPR. The sections below set out the main purposes for which we use personal data, the categories of data involved, and the lawful basis we rely on.

Operating the Platform and your Account

• What we use it for: Setting up and managing your Account, authenticating your access, displaying your Listings (Suppliers), routing Quote Requests to relevant Suppliers, enabling messages and Quotes between Organisers and Suppliers, processing credit purchases (Suppliers), and providing the features described in our Terms of Use.
• Data we use: account and contact information, listing content (Suppliers), quote and message history, credit balance and usage history, payment and billing information.
• Lawful basis: Performance of our contract with you (UK GDPR Article 6(1)(b)).

Communicating with you about the service

• What we use it for: Sending operational and transactional communications about your Account, Quote Requests, Quotes, payments, security, and changes to our Terms or this policy. Responding to your support enquiries.
• Data we use: account and contact information, support communications, quote and message history.
• Lawful basis: Performance of our contract with you for transactional and service communications that are necessary to provide the Platform (such as receipts, security notifications, and Account management). Our legitimate interests in keeping you informed for wider operational communications that are not strictly necessary to perform the contract.

Marketing communications

• What we use it for: Sending you promotional emails or messages about features, content, surveys, and offers from Add to Event that we think may be relevant to you.
• Data we use: account and contact information, usage data, marketing preferences.
• Lawful basis: Your consent, where consent is required (UK GDPR Article 6(1)(a) and PECR). For Suppliers who are existing business customers, our legitimate interests in marketing related services to them, subject to PECR's soft opt-in conditions and your right to opt out at any time. You can object to marketing at any time using the options in the "Service and marketing communications" section.

Fraud prevention, security, and protecting the Platform

• What we use it for: Detecting and preventing fraud, abuse, and unauthorised access; verifying identity where appropriate; investigating complaints, suspected fraud, misuse of the Platform, breaches of our Terms of Use, and reports of unlawful or inappropriate conduct; protecting users and third parties.
• Data we use: account and contact information, usage data, quote and message history, payment information, support communications, and information from fraud prevention or identity verification providers.
• Lawful basis: Our legitimate interests in operating a safe and trustworthy Platform; legal obligation where required.

Improving the Platform and our services

• What we use it for: Analysing how the Platform is used, identifying issues, developing new features, internal reporting, and informing business decisions. Where data is used in anonymised or aggregated form, see the "Anonymised and aggregated data" section.
• Data we use: Usage data, account and contact information (limited), quote and message history (limited).
• Lawful basis: Our legitimate interests in improving the Platform.

Complying with our legal obligations

• What we use it for: Meeting our obligations under tax, accounting, consumer protection, and other applicable law; responding to lawful requests from regulators, courts, or law enforcement; keeping records we are required to keep.
• Data we use: Whichever categories are relevant to the obligation.
• Lawful basis: Legal obligation (UK GDPR Article 6(1)(c)) for mandatory compliance activities. Our legitimate interests in defending legal claims for discretionary retention or use of information in connection with claims management and defence.

UK data protection law treats some types of personal data as more sensitive - for example, information about health, religion, ethnicity, or sexual orientation. We do not intentionally collect special category data and we ask that you don't share it through the Platform unless it is necessary for the event services you are arranging.

In practice, some Quote Requests and messages may include details that touch on these categories - for example, dietary requirements, accessibility needs, religious or cultural requirements for an event, or other event-related information that's relevant to the services being booked. Where this information is voluntarily provided in connection with arranging event services, we process it only to facilitate those services and in accordance with applicable data protection law. We rely on your explicit consent (UK GDPR Article 9(2)(a)) where required.

We send two distinct types of communications, and your control over them works differently.

Service communications

These cover the operation of your Account and your use of the Platform, and may be sent by email, in-platform notifications, or, in some cases, SMS. Examples include:

• Notifications about Quote Requests, Quotes, and messages.
• Receipts and billing notices for credit purchases.
• Account, security, and password notifications.
• Updates to our Terms of Use, this Privacy Policy, or other policies.
• Replies from our support team.
• Notices about service availability, maintenance, or incidents.

We send service communications whenever they are necessary to provide the Platform or comply with our obligations to you. You cannot opt out of service communications while you have an active Account, although you can close your Account at any time.

Marketing communications

These are communications we send to tell you about features, content, surveys, and offers from Add to Event that we think may be relevant to you. Examples include newsletters, product updates, promotional offers, and event-related content.

To make our marketing more relevant, we may group users into audience segments based on the information they have provided and how they use the Platform. This means you may see different content from another user. You can opt out of marketing at any time using the options below.

You can manage your marketing preferences at any time by:

• Updating the settings in your Account.
• Clicking the unsubscribe link in any marketing email we send.
• Emailing our customer support team at support-team@addtoevent.co.uk.

Withdrawing marketing consent doesn't affect the lawfulness of any marketing we sent before you withdrew it, and it doesn't stop us sending you service communications.

From time to time, we may record telephone, video, or other voice communications between you and our team - for example, calls with our support, sales, account verification, or complaints handlers. This only covers calls between you and Add to Event; we don't record calls between Organisers and Suppliers, or any other calls you have through the Platform.

Where we record a call, we do so in our legitimate interests in operating a well-run service: keeping a record of what was discussed, training and supporting our team, resolving disputes, and detecting and preventing fraud or other abuse. Where we record a call for a different reason that requires consent, we will ask for it separately.

Access to recordings is limited to authorised members of the Add to Event team and our service providers, who are bound by appropriate confidentiality and data protection obligations. We keep recordings for no longer than is necessary for the purposes set out above, and longer where we need to in connection with an ongoing complaint, dispute, investigation, or legal claim.

If you would like a copy of a recording in which you took part, or want to ask us to delete one, please email data@addtoevent.co.uk and we'll respond in line with the "Your rights" section below.

In addition to using personal data for the purposes set out above, we derive anonymised and aggregated data from activity on the Platform. Anonymised data is data that no longer identifies any individual user. Aggregated data combines information across many users so that no single user is identifiable from it.

We use anonymised and aggregated data for:

• Internal and external reporting on category performance, marketplace activity, and trends.
• Improving the Platform and developing new features.
• Marketing and communications about Add to Event and the events industry.
• Training and improving artificial intelligence, machine learning, and other automated systems we use internally.

Because anonymised and aggregated data does not identify any individual user, UK data protection law does not normally apply to our use of it in this form. Where we generate anonymised or aggregated data from personal data, we do so in our legitimate interests in operating and improving the Platform.

When a Supplier receives personal data about an Organiser through the Platform - for example, when an Organiser submits a Quote Request that the Supplier responds to, or when the Supplier exchanges messages with the Organiser - the Supplier acts as an independent controller of that personal data.

This means the Supplier has its own obligations under UK GDPR and other data protection law in relation to that personal data, including providing the Organiser with their own privacy information, holding it lawfully, keeping it secure, retaining it only as long as needed, and responding to any rights requests the Organiser makes directly to the Supplier.

Add to Event and the Supplier are not joint controllers, and the Supplier's processing of Organiser personal data is not governed by this policy. Suppliers should make sure they have their own privacy policy or notice covering how they handle personal data they receive through the Platform.

Add to Event may, from time to time, offer additional products alongside the main Platform. These products may have their own terms and their own privacy notice covering the personal data they collect.

Where you use one of these products alongside the Platform, we may link your accounts and share personal data between products to provide a single, joined-up experience - for example, recognising you as the same user, billing across products, or providing combined reporting. We do this in our legitimate interests in operating Add to Event's products in a connected way, and on the basis of our contract with you where the linking is needed to provide a feature you've signed up for. Where additional consent is required for any particular sharing, we will ask for it separately.

Where a separate product has its own privacy notice, that notice will describe how personal data is collected and used within that product, and how it interacts with the data covered by this policy.

We may offer ways for you to connect external accounts (for example, your email account) to Add to Event. Where we offer an integration of this kind, we use the access you grant only for the features you have signed up for, in line with the rules of the connected service and the safeguards described in this policy.

Information that you import into your Account through an integration is handled in the same way as any other personal data covered by this policy. You can disconnect an integration at any time through your Account, or through the account settings of the connected service.

The Platform is intended for use by people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you are under 18, please do not create an Account or submit personal data to us.

Some service categories on the Platform are for events involving children - for example, children's entertainers or children's party catering. Where you submit personal data about a child as part of a Quote Request (for example, a child's age, dietary requirements, accessibility requirements, or other event-related information), that information is handled in line with this policy. You should only submit personal data about a child if you are the child's parent or guardian, or you otherwise have authority to do so.

If we become aware that we hold personal data of someone under 18 without the appropriate authority, we will delete it as soon as practicable. If you believe we hold personal data of a child in error, please contact us at data@addtoevent.co.uk.

If you apply for a job through our careers page or by contacting us directly, we collect personal data from you to assess your application. This typically includes your name, contact details, work history, qualifications, and anything else you choose to share with us in your application.

We use this information to consider your application, communicate with you about it, and, where you join us, to begin our employment relationship. The lawful basis for this processing is our legitimate interests in recruitment and, where you sign an employment contract with us, performance of that contract.

We may use a third-party applicant tracking or HR system to manage applications. We keep recruitment data for as long as needed to consider your application and for a reasonable period afterwards in case other suitable roles arise, unless you ask us to delete it sooner.

We share personal data only where we need to, and only with recipients who have appropriate safeguards in place.

Between Organisers and Suppliers

The Platform connects Organisers with Suppliers, which means some personal data is shared between them through the Platform:

• When an Organiser submits a Quote Request, the limited information needed for Suppliers to decide whether to respond is made available to relevant Suppliers in the category and area. Full contact details are only shared with a Supplier once they have responded with a Quote.
• Once an Organiser and Supplier are in contact, they can exchange messages and any further information needed to discuss the event.
• Reviews left by Organisers are published on Supplier Listings and visible to other users of the Platform.
• Supplier Listings, including the business name, location, service categories, photos, and Reviews, are publicly visible on the Platform and may be indexed by search engines.

Suppliers handle personal data they receive about Organisers as independent controllers (see "Suppliers as independent data controllers").

Our service providers

We share personal data with service providers who help us run the Platform. They process personal data only on our instructions and under appropriate data protection terms. The main categories are:

• Hosting and infrastructure providers, who store and serve the data behind the Platform.
• Our payment provider, who handles credit card and other payments. We don't store full card details ourselves.
• Email, messaging, and notification providers, who deliver service and marketing communications on our behalf.
• Customer support and CRM tools, which we use to manage support enquiries and customer relationships.
• Analytics and product measurement tools, which help us understand how the Platform is used.
• Session analytics and user experience tools, which help us understand how visitors interact with the Platform - for example, which pages they visit, where they click, and how they scroll. Where you are signed in to your Account, these interactions may be linked to your Account so we can spot patterns for specific users or user groups. We use these tools solely to improve the Platform.
• Artificial intelligence and machine learning providers, who support certain Platform features. Where we use these providers, we operate under terms designed to prevent your personal data from being used to train their general AI models.
• Consent and preference management tools, which help us record and respect your choices about cookies and other tracking.
• Fraud prevention, identity verification, and security providers, which help us protect the Platform and its users.
• Professional advisers, such as accountants, lawyers, and insurers, where we need their advice or services.

If you would like more information about the specific service providers we use, please contact us at data@addtoevent.co.uk.

Other recipients

We may also share personal data with:

• Law enforcement, regulators, courts, or other authorities, where required by law or to defend our legal rights.
• Potential purchasers, investors, lenders, advisers, and transaction counterparties, in connection with any proposed or completed investment, financing, merger, acquisition, sale, or restructuring of Add to Event. We will provide notice and update this policy where required.
• Advertising and marketing platforms, where we may share limited contact information (such as an email address) for retargeting and to reach similar audiences. We rely on our legitimate interests in doing so, and you can object at any time using the options in the "Service and marketing communications" section. These platforms handle the information under their own data protection terms and privacy policies.
• Anyone with your consent, where you have asked us to share your information with a specific third party.

We don't sell personal data to third parties.

Add to Event is based in the United Kingdom and most of the personal data we hold is stored and processed in the UK or the European Economic Area (EEA).

Some of our service providers are based in, or transfer personal data to, countries outside the UK and EEA, including the United States. Where this happens, we make sure the transfer is protected by one of the safeguards required by UK data protection law, which may include:

• Adequacy regulations, where the UK government has decided that the receiving country provides an adequate level of protection.
• The UK Extension to the EU-US Data Privacy Framework, for transfers to certified providers in the United States.
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

If you would like more information about the transfer mechanism we use for a particular provider, please contact us at data@addtoevent.co.uk.

We keep personal data only for as long as we need it for the purposes set out in this policy, and then delete or anonymise it. How long that is depends on the type of data and why we hold it.

While your Account is active

We keep your Account and related personal data for as long as your Account is open and you are using the Platform.

After your Account is closed

When you close your Account, we keep some personal data for a limited period after closure for legitimate business, accounting, and legal reasons. The main retention rules are:

• Account-related data, including your contact details, Listings (Suppliers), Quote and message history, and support communications: held for a period after closure to handle final administration, complaints, and disputes, and then deleted or anonymised. We may keep some of this data longer where it is needed in connection with a complaint, dispute, fraud investigation, legal claim, or legal or regulatory obligation.
• Reviews left by Organisers about Suppliers: kept in connection with the Listings they relate to, in line with our Terms of Use. Reviews may be retained after a Supplier's Account is closed where the Listing is preserved as part of the Platform's review history.
• Financial records, including invoices and payment records: kept for at least six years from the end of the relevant accounting period, in line with HMRC and accounting requirements.
• Marketing data: kept until you opt out of marketing, and for a short period after that to honour your preferences.
• Recorded communications: as set out in the "Recorded communications" section above.
• Logs, security, and usage data: kept for the period needed for security, fraud prevention, and analytics purposes.
• Data we are required to keep for legal, regulatory, or dispute-resolution reasons: kept for as long as the relevant obligation, claim, or matter requires.

Where personal data is held in backup archives and cannot be deleted immediately, we keep it securely isolated from active processing until it is deleted or anonymised in the normal course of our backup cycle.

Suppliers' access to their data

While your Supplier Account is active, you can access most of your data through your Account, including your Listings, Quote and message history, credit balance and usage, and Reviews received. We don't currently offer a comprehensive downloadable export of your Account data, but you can save or copy your own content for your records at any time. After your Account is closed, you can still request access to personal data we hold about you under your data protection rights (see "Your rights and how to exercise them").

Anonymised data

Once personal data has been anonymised so that it no longer identifies you, we may keep and use it indefinitely as set out in the "Anonymised and aggregated data" section.

UK data protection law gives you a number of rights in relation to the personal data we hold about you. Not all rights apply in every situation; we'll let you know if a particular right doesn't apply to your request and why.

Your rights

• Right to be informed: to know how we collect and use your personal data. This policy is the main way we explain that.
• Right of access: to ask for a copy of the personal data we hold about you (often called a "subject access request").
• Right to rectification: to ask us to correct personal data that is inaccurate, or complete personal data that is incomplete. You can update most of your details directly through your Account.
• Right to erasure: to ask us to delete personal data we hold about you in certain circumstances - for example, where the data is no longer needed for the purpose we collected it for, where you withdraw consent that was our lawful basis for processing, where the processing was unlawful, or where you have objected to processing and we have no overriding legitimate grounds to continue. This is sometimes called the "right to be forgotten". There are exceptions - for example, where we need to keep data to comply with a legal obligation or in connection with a legal claim.
• Right to restrict processing: to ask us to limit how we use your personal data in certain circumstances - for example, while we look into a concern you've raised about accuracy, where processing is unlawful but you want us to keep the data instead of deleting it, or where we no longer need the data but you need us to keep it in connection with a legal claim.
• Right to data portability: to ask us to provide certain personal data you've given us in a structured, commonly used, machine-readable format, or to send it to another provider. This right applies where our processing is based on your consent or the performance of a contract, and is carried out by automated means.
• Right to object: to object to our use of your personal data where we rely on legitimate interests, based on reasons specific to your situation. Where you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. You have an absolute right to object to direct marketing at any time.
• Rights in relation to automated decision-making: see the "Automated decision-making" section below.
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time. Withdrawing consent doesn't affect the lawfulness of anything we did before you withdrew it.

How to exercise your rights

To make a request, email our data protection team at data@addtoevent.co.uk. Where possible, please tell us which right you want to exercise and give us enough information to identify the personal data you're asking about.

We aim to respond as quickly as we can, and in any event within one month of receiving your request. Where a request is particularly complex or you've made several requests, we may extend this by up to two further months, in which case we'll let you know within the first month and explain why.

There is no fee for exercising your rights, except in limited circumstances permitted by law (for example, where a request is clearly unfounded or excessive).

We may offer Platform features that use artificial intelligence or machine learning to help you work more efficiently - for example, by suggesting or drafting Quotes and messages based on Quotes and messages you have previously sent, or by helping match Suppliers to Quote Requests. Where you use one of these features, we process the personal data needed to generate the relevant suggestion or output, including information from your Account and your previous activity on the Platform. This may include learning from your previous Quotes, messages, and other content so that the suggestions generated for you reflect your own style and preferences.

We do this in our legitimate interests in providing useful Platform features and improving the experience of using Add to Event. We may use the AI and machine learning providers described in "Who we share your personal data with" to power these features, under safeguards designed to prevent your personal data from being used to train their general AI models. Suggestions generated by AI are intended to assist you and do not replace your own judgement about the content you send through the Platform.

As these features develop, we may introduce options that take routine actions on your behalf, such as sending automatic replies. Where any such feature would have a significant effect on you, we will give you the option to opt out or request human review.

We don't make decisions that have legal or similarly significant effects on you using solely automated means without human involvement.

The Platform uses a range of automated processes to operate efficiently - for example, organising and routing Quote Requests, updating Listing visibility, sending notifications, and flagging activity that may need attention. Two examples that may be of particular interest:

• Supplier ranking and matching. When Suppliers appear on Listings pages or are matched to Quote Requests, the order in which they appear is determined by an algorithm that takes into account factors like location, category, activity, reviews, and other signals. More information about how Supplier ranking works is available on our ranking information page.
• Fraud prevention and security checks. We use automated systems to flag activity that may indicate fraud, abuse, or a security issue. Where these systems flag something that could have a significant effect on a user, our team reviews the activity before taking action.

If you'd like to understand more about an automated process that affects you, or you'd like a human review of a decision you believe was taken without enough human involvement, please contact us at data@addtoevent.co.uk.

We take the security of your personal data seriously. We use a combination of technical and organisational measures to protect it against unauthorised access, loss, alteration, or disclosure. These include access controls, encryption where appropriate, secure hosting, and regular review of our systems and processes.

No security measure is perfect, and we can't guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, in line with UK GDPR. Where the breach is likely to result in a high risk to you, we will also let you know without undue delay, and explain what happened, what we are doing about it, and what steps you can take.

If you think your Account has been compromised, please contact us as soon as possible at data@addtoevent.co.uk.

We use cookies and similar technologies on the Platform. Some are needed for the Platform to work; others help us understand how it's used or support marketing.

A full description of the cookies we use, the purposes they serve, and how to manage your cookie preferences is set out in our separate Cookie Policy.

We may update this policy from time to time, for example to reflect changes in the way we operate, changes in the law, or feedback from users and regulators.

Where we make a material change, we will give you advance notice before it takes effect, for example by posting a notice on the Platform, sending you an email, or both. The "Last updated" date at the top of this policy shows when it was most recently revised.

Add to Event has not appointed a statutory Data Protection Officer. Our data protection matters are handled internally by our data protection team, which can be contacted at data@addtoevent.co.uk.

If you have a question about this policy, want to exercise your data protection rights, or have a concern about how we are handling your personal data, please email our data protection team at data@addtoevent.co.uk. We will reply as quickly as we can, and within one month at the latest, as set out in the "Your rights" section. We would always prefer the chance to put things right directly, so please come to us first if you have a concern.

If you remain unsatisfied after we have responded, you have the right to complain to the Information Commissioner's Office, which regulates data protection in the UK. Their website is ico.org.uk.