Version 1.0 · Internal use — further updates planned
Effective date: 8 October 2026
Operator: PNP Events Ltd
Privacy contact: Phil Neal
Contact email: phil@pnpevents.co.uk
This notice explains how personal information is handled when people use BoB and when customer or operational information is imported into it. It covers account administration, reporting, security, support and agreement acceptance. It supplements the relevant organisation’s customer and employment privacy notices.
Key points
- PNP Events Ltd operates BoB and manages its user accounts and security.
- Your organisation controls the customer data it asks BoB to process.
- BoB can contain identifiable ticketing and order records, even when dashboards show totals.
- Access, administrative actions and agreement acceptance may be logged.
- Mapping and other service providers may receive information needed for their functions.
- You can contact Phil Neal about your information and privacy rights.
- Accepting the User Agreement does not give consent to optional processing.
1. Who is responsible for your information
PNP Events Ltd is the controller for BoB user-account administration, platform security and the operational records it manages for its own purposes.
For customer, ticketing and operational information, the controller is the organisation that determines why and how that information is used. PNP may be that controller for its own events. Where another organisation provides information for its own reporting purposes, PNP processes it on that organisation’s instructions under the applicable contractual arrangements.
Your organisation remains responsible for its own collection notices and lawful basis. Contact us if you need help identifying the responsible organisation.
Privacy contact: Phil Neal, PNP Events Ltd.
Email: phil@pnpevents.co.uk.
Phil is the designated privacy contact; this notice does not describe him as a formally appointed Data Protection Officer.
2. Information BoB handles
Depending on your account, organisation and enabled features, information may include:
- Name, business email, account identifier, organisation memberships, roles and permissions.
- Password hashes, invitation records, session identifiers and account security information.
- Sign-in times, IP addresses, browser information and relevant access or administrative activity.
- Agreement version, document identifier, acknowledgement, acceptance time and associated technical information.
- Support correspondence, issue descriptions and attachments you provide.
- Ticket and order identifiers, purchases, prices, fees, refunds, event details and customer contact or address information received from connected systems.
- Postcodes, addresses and derived location coordinates used for geographic reporting.
Data comes from you, your organisation’s administrators, connected ticketing systems such as ETIX, historical source-system imports and platform activity. Raw imported records may contain more personal information than appears on a dashboard. Rounded coordinates and internal identifiers can remain personal data.
3. Why information is used and the lawful basis
For processing where PNP is the controller, the proposed bases are:
| Purpose | Lawful basis |
|---|---|
| Administer authorised accounts, invitations, access and support | Legitimate interests in providing and administering a business platform |
| Protect accounts, investigate faults or misuse and maintain security logs | Legitimate interests in a secure and reliable service |
| Record agreement acceptance and maintain an audit trail | Legitimate interests in evidencing authorised use, accountability and handling disputes |
| Deliver PNP’s own operational and geographic reporting | Legitimate interests in understanding event performance and planning operations |
| Fulfil a specific statutory obligation | Legal obligation, where the identified obligation requires the processing |
Our legitimate interests must be balanced against individuals’ rights and expectations. Customer-data processing for another organisation follows that controller’s documented instructions and lawful basis.
Account identity and access information are needed to provide an authorised BoB account. If the necessary information is not supplied, access may not be possible. Agreement acceptance is an access condition, not consent to optional processing.
Right to object: You can object to processing based on legitimate interests by contacting Phil Neal and explaining your circumstances.
4. Access and service providers
Information is accessible to authorised users according to their organisation, role and permissions. Authorised platform administrators may access it to administer and support BoB.
Relevant providers may include cloud hosting and database services, email delivery, connected ticketing systems, mapping and geocoding services, and authorised technical support providers.
The reviewed BoB configuration supports Google Maps for browser maps, postcodes.io for postcode lookup and HERE for address geocoding. A postcode or address may be sent to a geocoder; browser map providers may receive technical information such as IP address and map requests. These functions are distinct from displaying aggregate map counts.
Support or incident details may be transferred to a configured issue-management service such as GitHub. Do not include unnecessary customer information, credentials or sensitive attachments in reports.
Before onboarding the first external customer: Confirm the providers actually enabled, their contractual roles and the information they receive. The source-code capabilities do not establish the current live configuration.
5. International processing
BoB hosting is on AWS in EU West, as confirmed by PNP Events Ltd. External services and remote support may involve processing outside the UK or Europe. AWS publishes a UK GDPR addendum and transfer safeguards; Google Maps, HERE and GitHub also publish international-processing and transfer terms. Their application to BoB’s enabled services and accounts remains under review.
Before onboarding the first external customer: Insert the confirmed locations and applicable transfer arrangements for enabled providers. Where required, these may involve UK adequacy regulations or appropriate contractual safeguards and a transfer assessment. Phil Neal will be the contact for obtaining information about the applicable safeguards.
This notice does not claim that all information remains in the UK or that particular safeguards have already been verified.
6. Retention
Information is kept only for as long as needed for its purpose. Relevant criteria include account access, tenant service arrangements, reporting needs, incident investigation, legal obligations and the establishment or defence of claims.
- Account information is retained while access is needed, then reviewed for deletion or minimisation.
- The approved policy retains agreement acceptance history while a user has access and for three calendar months after their final BoB access ends, then deletes or anonymises identifiable acceptance records. Audit logs have a separate 24-month policy and operational/job logs a 90-day policy. These periods describe the policy; automated enforcement is still being verified.
- Imported customer and order records follow the controller’s retention instructions and documented operational requirements.
- Support records are reviewed against the continuing need to resolve issues and retain useful evidence.
- Backup copies follow a separate rotation schedule and may persist after deletion from active systems.
Keeping a complete version history does not justify indefinite retention of identifiable records. Before onboarding the first external customer: Confirm the actual retention and backup arrangements; do not substitute proposed periods for implemented controls.
7. Cookies and similar technologies
BoB uses cookies for sign-in sessions and the selected organisation. In the reviewed implementation, the ordinary session has a 12-hour server expiry; “keep me signed in” extends this to 14 days. The selected-organisation cookie can remain for up to one year. Browser settings may remove cookies earlier.
Blocking session cookies can prevent sign-in. The organisation-selection cookie stores a preference; its applicable cookie exemption or consent requirement must be assessed.
Third-party maps or future optional analytics may use additional technologies. Before onboarding the first external customer: Check the live site and describe any additional cookies, their purposes and controls. Acceptance of the User Agreement does not substitute for any required cookie consent.
8. AI features and automated decisions
Where AI-assisted features are enabled, prompts and relevant reporting context may be processed by the configured AI provider. Do not enter personal or confidential information unless the feature and processing have been authorised.
Before enabling or describing a live AI feature: Confirm the provider, information sent, retention, training settings and transfer arrangements.
The reviewed dashboard reporting and access controls do not establish a system making solely automated decisions about individuals with legal or similarly significant effects. Any introduction of such a use requires a separate assessment and appropriate information for affected people.
9. Your rights and complaints
Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability of your information. You may object to legitimate-interest processing. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.
Contact Phil Neal using the contact details above. We may need proportionate information to verify your identity. Where PNP processes information for another controller, we will assist that organisation with your request. Rights are subject to applicable conditions and exemptions.
You can raise a privacy complaint with us and with the UK Information Commissioner’s Office: ICO complaints, telephone 0303 123 1113.
10. Security and changes to this notice
BoB uses controls including password hashing, session management and role-based permissions. Access to personal information should be limited to authorised purposes. No system can guarantee complete security; report suspected exposure promptly to Phil Neal.
We will update this notice when relevant processing changes and make the current version available to users. A privacy-notice update does not itself require consent. Material User Agreement changes are handled through BoB’s separate acceptance process.
Planned updates before customer onboarding
This notice is available for PNP’s current internal use. It will be updated before the first real external customer is onboarded. The review will confirm enabled providers, their contractual roles, processing locations and applicable international-transfer safeguards; SMTP2GO’s account region; cookie and AI configuration; and the implementation of retention, deletion and backup expiry. The legitimate-interest assessments and customer data-processing arrangements must also be completed.
The three-month acceptance-record policy is approved but is not yet represented as a verified automated deletion control. Customer onboarding must not proceed until the review is complete and this notice accurately reflects the deployed service. Contact Phil Neal at phil@pnpevents.co.uk for information about these updates and applicable safeguards.