Cristina Achim:
"Responsible data use rests on strong security, clear processes and deliberate product decisions. Nothing else a supplier says about data is worth discussing until that foundation is real."
One distinction underpins all of it. The organiser is the data controller and Visit is the data processor. The organiser decides what is collected and why, and the attendee list belongs to them, not to us. We do not sell it, mine it across events, or use one organiser’s audience to benefit another. When an organiser asks for their data to be exported or erased, we do it.
Below are the seven questions I would put to a supplier, and our own answers. I think a supplier should answer all of them before the commercial conversation goes any further.
The 7 questions, and Visit's answers
| # | What to ask | Visit's answer |
|---|---|---|
| 1 | What data is collected, and why is each field needed? | The organiser sets the schema. We argue for removing any field without a stated purpose, because a shorter form is a design decision in the attendee's favour. Questions can be built once at organisation level and reused across every event in the portfolio, so the same field is not asked three different ways across a show cycle. |
| 2 | Where is the data hosted? | AWS Ireland. It stays within the EU. |
| 3 | What certifications are held, and for what? | ISO 27001 for information security management, PCI SAQ-A for payment handling, and ISO 20121 for event sustainability, which replaced our earlier BS 8901 certification. |
| 4 | Who can access it, and how is access controlled? | Role-based access. Every permission is granted at No Access, Read Only or Read/Write level, and roles are assembled from those permissions. |
| 5 | How are staff trained to handle sensitive information? | Each new employee is fully trained on the Visit system and our data compliance processes. Permissions and roles are being granted gradually to ensure they get a full grasp of the said data compliance processes. |
| 6 | Who owns the attendee data? | The organiser. Always. We are the processor. |
| 7 | Does the data create clear value for the attendee? | That’s our focus for every data point and functionality we add to the system. However, the choice of how those items are used sits with the organiser. In our experience, most of the time, organisers are mindful of the choices they make, trying to use the data in the best interests of the participant. |
These questions are what separates data collection from data management. If a supplier hesitates on any of them, that hesitation is your answer.