Trust & Compliance
GDPR at Diobox
How Diobox supports your compliance with the EU and UK General Data Protection Regulation
Events run on personal data: guest lists, registrations, tickets, messages, check-ins. Diobox is built so that organizers can handle that data responsibly, and we back it with contractual commitments, technical safeguards, and the tooling you need to meet your own GDPR obligations. GDPR compliance is a shared responsibility: here is exactly what we do, and what you need to do.
Who does what under GDPR
The GDPR assigns responsibilities based on roles. On Diobox, the split is clear:
The event organizer
You decide what guest data to collect and how it's used: invitations, registration questions, ticketing, messaging, check-in. Under GDPR, you're the data controller for your guests' personal data.
The platform
We process guest data only on your instructions, to provide the Service. We never use it for our own marketing, and we never sell it. Under GDPR, Diobox is your data processor.
Two special cases: for your own account and billing data, Diobox is the controller (see our Privacy Policy). And when an exhibitor scans an attendee's badge with Lead Retrieval, that exhibitor becomes an independent controller of the lead data it captures.
What Diobox commits to
A GDPR-ready DPA
Our Data Processing Addendum meets Article 28 requirements and incorporates the EU Standard Contractual Clauses (Module 2), plus the UK Addendum and Swiss adaptations.
Lawful international transfers
Data is hosted in the United States. Transfers from the EEA, UK, and Switzerland rely on the Standard Contractual Clauses with supplementary safeguards.
Defined deletion timelines
When you delete data or close your account, it's removed from live systems within 30 days and from backups within 90 days thereafter.
Breach notification
We notify you without undue delay, and within 72 hours, of becoming aware of a personal data breach affecting your data, so you can meet your own Article 33/34 duties.
Subprocessor transparency
Every vendor that touches your data is bound by contractual protections equivalent to our DPA. The current list is available on written request, and you get 30 days' notice of changes, with a right to object.
Security by design
Encryption in transit, role-based access controls, least-privilege production access, monitoring, and tested backups. Full measures in Annex II of the DPA.
Data subject rights support
Built-in tools to export, correct, and delete guest records let you answer access and erasure requests directly. Requests we receive are routed to you within 48 hours.
No sale of data
Guest data is processed solely to provide the Service. We don't sell it, share it for advertising, or use it to train models or profile individuals.
What you need to do as an organizer
As the controller, some obligations are yours by design. When you use Diobox:
- Establish a lawful basis for processing your guests' data, typically legitimate interest for event management or consent for marketing.
- Tell your guests. Your registration flow and privacy notice should explain what you collect and how it's used, including that badge scanning shares data with exhibitors if you use Lead Retrieval.
- Get consent before messaging. SMS and WhatsApp campaigns require prior opt-in in most jurisdictions; Diobox records opt-outs automatically, but obtaining consent is on you.
- Honor rights requests. Use the platform's export, edit, and delete tools to answer guest access and erasure requests within GDPR deadlines.
- Minimize what you collect. Only ask registration questions you need, especially in free-text fields, where guests may volunteer sensitive details like dietary or accessibility information.
- Put the DPA in place. The DPA is incorporated into our Terms automatically; if your legal team needs a countersigned copy, contact us.
If you're an event guest
The organizer of your event, not Diobox, controls your data. To access, correct, or delete your information, or to opt out of communications, contact the event organizer directly. If you contact us instead, we'll forward your request to them and support their response. To stop SMS messages at any time, reply STOP.
Frequently asked questions
Where is my data stored?
On secure cloud infrastructure in the United States, protected by the technical and organizational measures described in Annex II of our DPA.
Is Diobox certified under the EU–U.S. Data Privacy Framework?
No. Diobox relies on the EU Standard Contractual Clauses (Module 2, Controller to Processor), incorporated directly into our DPA, together with the UK Addendum and Swiss adaptations. SCCs are a fully valid transfer mechanism under Chapter V GDPR and don't depend on the continued validity of any adequacy framework.
How do I get a signed DPA for my vendor review?
The DPA applies automatically as part of our Terms of Service. If your procurement or legal team requires a countersigned copy, or a completed Annex I.C for your supervisory authority, email legal@diobox.com and we'll turn it around promptly. We can also provide our transfer impact assessment (TIA) summary on request.
Who are your subprocessors?
Our current subprocessor list, which forms Annex III of the DPA, is available on written request to legal@diobox.com. Every subprocessor is bound by equivalent contractual data-protection obligations, we give 30 days' notice before adding or replacing one, and you can object on data-protection grounds.
What happens to guest data when I delete it or leave?
Deleted records are removed from live systems within 30 days and from backups within 90 days thereafter. After your subscription ends, you have a 30-day window to export your data in a standard format before the same deletion schedule applies. On request, we'll confirm deletion in writing.
How does Lead Retrieval work under GDPR?
Badge scanning is guest-initiated: an attendee chooses to have their badge scanned at an exhibitor's booth. The registration fields you designate are then shared with that exhibitor, who becomes an independent controller responsible for its own use of the data. As the organizer, you should disclose this in your registration privacy notice; guests can direct rights requests about scanned data to the exhibitor.
Can I collect sensitive (special category) data through Diobox?
The Service doesn't require it, and we recommend avoiding it. If you collect information like dietary or accessibility needs through custom fields, you're responsible for establishing an Article 9 basis (typically explicit consent) and limiting collection to what the event genuinely requires.
How do SMS and WhatsApp messages comply with EU rules?
Electronic direct marketing generally requires prior opt-in consent under the ePrivacy rules and GDPR. Diobox automatically processes and records opt-outs (including SMS STOP replies) and honors them across campaigns, but collecting valid consent before you message guests is your responsibility as the sender. WhatsApp messaging additionally follows Meta's template approval and customer-service-window rules.
Do you use guest data for AI training or advertising?
No. Guest data is processed only to provide the Service on your instructions. We don't sell it, use it for advertising, or use it to train machine-learning models.
The documents
Terms of Service
The agreement governing your use of DioboxPrivacy Policy
How we handle data as a controllerQuestions?
Our team handles GDPR inquiries, vendor security reviews, and DPA requests at legal@diobox.com, or by mail at Diobox, Inc., 2585 Broadway, Suite 250, New York, NY 10025.
This page is a plain-language overview and doesn’t modify our Terms of Service, Privacy Policy, or DPA, which control in case of any difference. It isn’t legal advice; consult your own counsel about your GDPR obligations as an organizer.