Privacy Policy
How we collect, use, and protect your data
1. Who we are
Canapii Ltd is an event management technology company registered in England and Wales (company number 13234100). Our registered address is Reading, United Kingdom. We provide a platform that enables event organisers to manage registration, check-in, badge printing, virtual and hybrid event delivery, and attendee engagement.
Canapii Ltd is the data controller for the personal data collected through our website (canapii.com) and marketing activities. When we process data on behalf of event organisers using our platform, we act as a data processor.
2. What data we collect
We collect the following categories of personal data:
- Identity data: name, job title, company name
- Contact data: email address, phone number, postal address
- Account data: login credentials, account preferences, role permissions
- Event data: registration details, attendance records, session preferences, badge information
- Technical data: IP address, browser type, device information, time zone, access logs
- Location data: approximate location derived from your IP address, and - in our mobile apps only, and only where you grant permission - precise and approximate device location, including in the background. See section 3 for full details.
- Usage data: pages visited, features used, interaction patterns within the platform
- Communication data: correspondence with our team, support tickets, feedback
3. Location data and mobile app permissions
This section applies to the Canapii mobile app and to the event apps we publish on behalf of event organisers. Location access is always optional. The app asks for your permission before it accesses any location data, and every other feature continues to work if you decline.
Where you grant permission, we access location data as follows:
- Precise and approximate location (while using the app): to detect when you arrive at or leave an event venue, room, or exhibition zone that the organiser has defined, so the app can deliver the notification and content the organiser has set up for that zone.
- Background location: if you choose to allow location access all of the time, the app continues to monitor those event zones while it is closed or not in use, so that arrival and departure notifications still reach you during the event. You can decline background access and still use the app.
- Photo metadata: photos you take or select through the app may contain the location where they were captured. This is embedded by your device, not collected separately by us.
- Approximate location from IP address: used for security, fraud prevention, and to set your time zone. This applies to our website and platform as well as our apps.
Your device evaluates event zones locally. When you enter or leave a zone, we record that event - the zone, whether you entered or left, its coordinates, and a timestamp - and send it to the event organiser who defined it. We do not track or store a continuous history of your movements.
We do not sell your location data, and we do not share it with third parties for advertising, profiling, or any purpose unrelated to running the event you are attending. Location events are retained under the same rules as other event data, set out in section 8.
You can withdraw location permission at any time in your device settings - on Android under Settings → Apps → Permissions → Location, and on iOS under Settings → Privacy & Security → Location Services. Withdrawing permission stops location-based notifications and does not affect any other part of the app.
4. How we use your data
We use your personal data to deliver and improve our services, including:
- Providing and managing your account and access to the platform
- Processing event registrations and delivering event experiences
- Generating badges and managing on-site check-in
- Delivering location-based event notifications where you have granted location permission
- Sending service communications, including event confirmations and platform updates
- Improving our platform through analytics and usage patterns
- Responding to enquiries and providing customer support
- Complying with legal obligations and protecting our legitimate interests
We will only send marketing communications where you have given explicit consent or where we have a legitimate interest to do so, and you can opt out at any time.
5. Legal basis for processing
Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases:
- Contract: processing necessary to deliver services you have contracted for
- Legitimate interest: improving our services, platform security, and business analytics, where this does not override your rights
- Consent: marketing communications, non-essential cookies, and access to your device location
- Legal obligation: compliance with applicable laws, regulations, and lawful requests
6. Data sharing
We do not sell your personal data. We share data only with:
- Event organisers: when you register for an event, your registration data is shared with the organiser who manages that event
- Service providers: trusted third-party providers who help us deliver services, including hosting, email delivery, payment processing, and AI processing such as translation, transcription and content generation
- Advertising (Google Ads): only if you accept marketing cookies, our website shares information about your visit with Google through the Google Ads tag - such as the pages you view, your IP address, browser and device details, and actions like requesting a demo - so we can measure how our adverts perform. Google uses this information under its own privacy policy. We do not send your name, email address or other contact details to Google.
- Advertising (LinkedIn): only if you accept marketing cookies, our website shares information about your visit with LinkedIn through the LinkedIn Insight Tag - such as the pages you view, the page that referred you, your IP address, and browser and device details - so we can measure how our LinkedIn adverts perform. If you have a LinkedIn account, LinkedIn may match your visit to it; we only receive aggregated reports from LinkedIn, never who you are. LinkedIn uses this information under its own privacy policy. We do not send your name, email address or other contact details to LinkedIn.
- Legal requirements: where required by law, court order, or regulatory authority
For the current list of the sub-processors we use, including what each one is used for and where it is hosted, see our sub-processors page.
7. International transfers
Our platform infrastructure is hosted on Amazon Web Services (AWS). Where data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place as required by applicable data protection law.
8. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Account data is retained for the duration of your relationship with us plus a reasonable wind-down period. Event data is retained according to the organiser's data retention policy, typically no longer than 24 months after the event. Technical and usage data is retained for up to 12 months for analytics and security purposes.
When data is no longer required, it is securely deleted or anonymised.
9. Your rights
Under the UK GDPR, you have the following rights:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate or incomplete data
- Erasure: request deletion of your data where there is no compelling reason to continue processing
- Restriction: request that we limit how we use your data
- Portability: request your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests or direct marketing
- Withdraw consent: where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact us atinfo@canapii.com. We aim to respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).
10. Cookies
Our website uses cookies and similar technologies to improve your browsing experience, analyse site traffic, and measure our advertising. We use essential cookies required for the site to function. All other cookies are optional and are only set with your consent via our cookie banner.
- Marketing (Google Ads): if you accept marketing cookies, the Google Ads tag sets the _gcl_au cookie on our website to connect visits from our adverts with actions taken on our site. It expires after 90 days. Google may also set its own cookies on its domains, such as a short-lived test_cookie on doubleclick.net, as described in how Google uses cookies in advertising.
- Marketing (LinkedIn): if you accept marketing cookies, the LinkedIn Insight Tag stores the following on our website:
- li_fat_id - a cookie identifying the click on a LinkedIn advert that brought you to our site, so the visit can be connected with actions taken on our site. It is only set when you arrive from a LinkedIn advert and expires after 30 days.
- li_adsId - an identifier for your browser, kept in your browser's local storage, that LinkedIn uses to measure our advertising. LinkedIn only sets it for visitors outside the EU, EEA, UK and Quebec. It expires after six months, or sooner if you withdraw marketing consent or clear your browser data.
You can change or withdraw your consent at any time using the Cookie preferences link at the bottom of every page. Withdrawing marketing consent stops the Google Ads tag and the LinkedIn Insight Tag and removes the cookies and identifiers they stored on our website. Cookies that Google and LinkedIn set on their own domains can be removed through your browser settings, where you can also manage cookies generally.
11. Contact us
If you have questions about this privacy policy or how we handle your data, please contact us:
Canapii Ltd
Reading, United Kingdom
Email:info@canapii.com
Phone: +44 118 228 1385
Canapii Ltd is ISO 27001 certified, demonstrating our commitment to information security management best practices. Our certification covers the processes, systems, and controls used to deliver our event management platform.