Your account

Data protection

Remove one person's details or a whole event's, see every removal in one log, and find out where the data is held.

For the people who register for your events, GDPR makes you the data controller and Tito your processor. When somebody asks you to remove their details, you can do it yourself, from their record, straight away.

Remove somebody's details

Open the record and choose the entry from its Actions menu:

on an attendee's page, Anonymize their data…
on an order's page, Anonymize the buyer and attendees…, for the buyer and everyone on the order
on an invitation's page, Anonymize their data…, for the invitee, their guests and any tickets they claimed
on a customer's page in Customers, Anonymize this customer…
on a person's page on the Waitlist, Anonymize their data…
on a ticket request, Anonymize their data…

The next page lists what goes and what stays, for that person. Type their name to confirm. It happens as soon as you confirm, and you can't undo it.

go.tito.io/acme/summer-fetes-summer-fete/admin/attendees/HKM5T4/anonymize

What goes

their name, email address, phone number, company, job title and billing address
every answer they gave, and any file they sent with their answers
for a buyer or a customer, every link tag their orders arrived with that isn't a utm_* campaign tag, including ad click ids like gclid and tags you added yourself
who each email we sent them went to, and what it said
their entry in Contacts, and their email address on the Mailing list
their details in the record's history, and in its webhook, workflow and API logs

What stays

the ticket, order or invitation itself, with its reference and status, and its place in every count
a waitlist entry or ticket request, with its reference and status
what was bought, what was paid and when, and the payment reference
campaign tags like utm_source, so you can still see which link sold it
invoices, receipts and credit notes already issued, exactly as they were issued
their unsubscribe, while anything else of theirs that stays can still be emailed

Paid orders have to stay on record for seven years after the last payment, which is why the money and the documents stay. The record says it was anonymized, by whom and when.

An order still waiting for a bank transfer is canceled when its buyer is anonymized, so a payment that arrives later doesn't send tickets to an empty address. The confirm page tells you first. An order whose tickets were already sent isn't canceled.

Anonymizing a customer removes their details from the orders and quotes they placed. The attendees on those orders stay, because they're often other people.

Anonymizing somebody on the waitlist, or a ticket request, removes them from that entry or request only. If they took a place, or their request was approved, the order or invitation stays, and the confirm page links to it. Somebody still waiting leaves the list, and a request nobody has decided yet is withdrawn.

A team member who can see only some events can anonymize the people on them, but not what the account holds of them beyond those events. Their entry in Contacts, an unsubscribe and their address on other events' Mailing list stay, unless this event is the only place they appear, and the confirm page says so. Somebody who can see every event can remove the rest. A team member like this can't anonymize a customer, who can have bought for any event.

What Tito can't remove

Stripe and PayPal keep their own record of a payment, with the buyer's name and email address. Stripe also keeps a card saved with a ticket request that was already approved or turned down. A service you connected, like Brella, keeps the details it was sent, and so does anything your webhooks sent them to. Emails already delivered stay in the person's inbox. Remove their details from Stripe, PayPal and any service you connected too.

The same person on another order?

The confirm page says how many other orders, tickets and invitations carry the same email address. Anonymize each one from its own page.

Anonymize a whole event

When you're done with an event, you can remove everybody on it at once and keep its orders. An event that has taken payments can't be deleted, so this is how you clear its people. The account's owner can do it on any event.

Open the event, then choose Anonymize attendee data… from the ⋯ menu beside its name. Type the event's name, then select Anonymize in 30 days.

go.tito.io/acme/summer-fetes-summer-fete/admin/anonymize

Nothing happens for 30 days. Until then:

a red bar at the top of every page of the event shows the day it will happen
everybody who can manage the event gets an email about it
registration stays open, and anybody who registers before the day is anonymized too

Select Keep attendee data on the red bar to stop it. Anyone who can manage events can keep it, until the day comes.

On the day, every buyer, attendee and invitee who registered before then is anonymized, and so is everybody on its waitlists, ticket requests, quotes and Mailing list. Somebody still paying for an order is anonymized once they've finished. If they're paying by bank transfer and it's still unpaid after its due date, the order is canceled and they're anonymized. The person who asked gets an email when it's done.

What goes and what stays is the same as for one person, with these differences:

a customer in Customers goes only if all their orders and quotes are on this event
a contact in Contacts goes only if the person isn't on any of your other events, and you didn't add or import them yourself
copies in the API request log aren't searched, because that log is deleted after 90 days

Anonymize attendee data… isn't in the menu?

Only the account's owner sees it, and not on an event that's waiting to be deleted or already waiting to be anonymized.

People who don't finish registering

Somebody who gives their name and email and then stops at the payment page has an abandoned order. Their details are kept only to take that payment, and what happens to them depends on Collect emails from people who don’t finish registering in the event's Checkout settings.

With it off, which is how every event starts, nobody on your team can see them, in Orders, search, an export or the API, and they can't be emailed. Their details are removed once their checkout expires.
With it on, buyers see “We may email you about this event” before they pay. Anyone who stops after seeing it is listed under Abandoned in Orders, and you can message them until the event ends. Their details are removed when the event ends.

Anybody you message can remove their own details sooner, from the page they reach by unsubscribing. That removes their details from the unfinished order only. Their unsubscribe isn't undone, and their contact, Mailing list sign-ups and other orders aren't removed.

The data-protection log

Data protection on Activity lists every person anonymized, every event deleted and every event anonymized, with who did it and when. Details removed from an abandoned order are listed too, whether the buyer removed them or they went automatically. A line about a person names the record by its reference, never the person.

Anonymize their data… isn't in the menu?

The account's owner and admins can anonymize somebody. Staff, door and viewer team members can't, and nor can anybody in test mode, where there are no real people.

Where the data is held

Team Tito is an Irish company, and accounts are hosted in the EU on Amazon Web Services. Data residency in Account settings shows which region your own account is in. See Data residency.

Who else handles it

Amazon Web Services EU holds the servers, the file storage and the email. Stripe EU processes payments. The current list of everyone else is on Tito's trust page.

Security

Tito is ISO 27001 certified. Data is encrypted at rest, scanned for vulnerabilities continuously, and tested by an outside firm once a year.