Data Control & GDPR

Ocupio operates as a data processor. Each event organiser (the company or professional body running an event) is the data controller for the personal data of their attendees. This distinction is fundamental under UK GDPR and the Data Protection Act 2018.

Ocupio does not access, sell, share or use attendee data for any purpose other than delivering the platform service. No attendee data is used for advertising, profiling, AI training or any commercial purpose beyond the event management service contracted by the organiser.

Data is collected at the point of registration, during the event, and post-event. The exact fields collected depend on the configuration set by the event organiser.

Personal data collected through Ocupio is used exclusively for the following purposes on behalf of the event organiser:

1. Event registration management — confirming places, managing waitlists, venue capacity tracking
2. Attendee communications — registration confirmations, event reminders, day-of logistics, post-event follow-up
3. On-the-day operations — QR code check-in, seating plans, dietary requirement management
4. CPD certificate generation — where applicable, personalised PDF certificates bearing the attendee's name and CPD hours
5. Post-event reporting — anonymised aggregate analytics for the organiser; named feedback where the attendee has consented
6. Data subject request management — facilitating the organiser in responding to erasure, access and portability requests

Ocupio does not use attendee data for: advertising or retargeting, profiling or scoring, AI model training, or sharing with any third party for commercial purposes.

Event organisers on Ocupio have comprehensive control over all data associated with their events. The following capabilities are available directly from the Ocupio dashboard:

All of these controls are available in the Data & Privacy Centre within the Ocupio dashboard, accessible to all admin and owner roles within an organisation.

Every individual whose data is processed through Ocupio holds the following rights under UK GDPR. These rights are exercised through the event organiser as data controller, not through Ocupio directly.

Each event organiser sets their own data retention policy within Ocupio. The available options are 6 months, 1 year, or 2 years after the event ends — or manual deletion. The organiser can change this setting at any time from their Data & Privacy Centre.

Once the retention period expires, personal identifiers (name, email, phone, dietary requirements) are automatically removed. Anonymised aggregate data — such as total attendance figures, NPS averages and CPD hours issued — is retained permanently so that the organiser's reports remain accurate.

Dietary requirements and accessibility information are treated as special category data under Article 9 GDPR. This data is used solely for operational event delivery and is not retained after the event date.

Ocupio's own data retention for platform operation data (billing, account records, audit logs) is governed by our separate Privacy Policy.

Ocupio implements the following technical and organisational measures to protect personal data:

• All data is encrypted in transit using TLS 1.2 or higher
• All data is encrypted at rest using AES-256
• Data is stored within EU/EEA data centres compliant with UK GDPR adequacy requirements
• Access to production data is restricted to authorised Ocupio personnel on a least-privilege basis
• Role-based access controls ensure that each organisation's data is logically isolated from all other organisations
• All access to personal data is logged in a tamper-evident audit trail
• Subprocessors are assessed for compliance and bound by Data Processing Agreements
• Regular security reviews and penetration testing are conducted
• Data breach procedures are in place in accordance with Article 33/34 GDPR notification requirements

Ocupio uses a small number of carefully selected sub-processors to deliver the platform service. All sub-processors are bound by Data Processing Agreements and are assessed for GDPR compliance.

Ocupio does not transfer personal data outside the UK/EEA without appropriate safeguards in place (standard contractual clauses, adequacy decisions or other approved mechanisms).

Ocupio uses a minimal number of cookies necessary to deliver the service. No third-party advertising or tracking cookies are used.

For any data protection queries, subject access requests, erasure requests, or to request a Data Processing Agreement, contact:

This page constitutes Ocupio's public data processing notice. It supplements but does not replace the full Privacy Policy and the Data Processing Agreement available to enterprise customers. For event organisers, your responsibilities as data controller are set out in the Ocupio Terms of Service.