Data Sharing and Processing Terms

Last updated: 4 October 2026. Version 1.0.

These terms form part of every agreement between IRL Ventures Ltd ("IRL") and the venues, partners, clients, subcontractors and suppliers who receive or handle personal data in connection with IRL events. They apply alongside our B2B Terms or the relevant supplier agreement. "UK GDPR" and "DPA 2018" mean the UK General Data Protection Regulation and the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025.

1. Who is controller and who is processor

A controller decides why and how personal data is used. A processor handles it only on a controller's instructions. Who is which decides who has which legal duties.

If a relationship doesn't fit this table, the parties will agree the roles in writing before any personal data is shared.

2. Sharing with Venues and partners as separate controllers

This section applies when IRL shares personal data with a Venue or other partner who uses it for their own legal responsibilities, such as running entry or meeting licence conditions.

2.1 What we share and why

We never share Date IRL preference or match data with Venues.

2.2 What each of us must do

Each of us is responsible for our own compliance with data protection law. In addition, the Venue or partner must:

1. use the data only for the purposes in section 2.1, and never for marketing, profiling, or adding people to its own mailing lists;
2. limit access to staff who need it, and make sure they keep it confidential;
3. keep it secure: no unnecessary printing; no leaving lists unattended; no forwarding to personal accounts or group chats;
4. delete guest lists within 7 days of the event, and other data as soon as it's no longer needed, unless it must be kept for an incident, insurance claim, licensing matter or legal reason, in which case it must be kept only as long as necessary;
5. not pass the data to anyone else, except to the police, the licensing authority or another body where the law requires it, or to its insurers or advisers for a claim;
6. tell IRL within 48 hours of becoming aware of any personal data breach involving the data we shared, and work with us to deal with it;
7. tell IRL promptly about any data protection request or complaint it receives that relates to the shared data, and help us respond within legal time limits; and
8. tell IRL about any data it holds about our attendees from its own systems, such as CCTV or ID scans, that we need for an incident, where the law allows.

2.3 What IRL will do

IRL will share only the minimum needed; tell attendees in our Privacy Policy that we share this data with Venues; make sure we have a lawful basis for sharing, and an additional condition for any special category or criminal offence data; and send data securely.

2.4 Contacts and review

Each of us names a contact for data protection matters. We'll review these arrangements at least once a year, or after any incident.

3. Processing terms for subcontractors and suppliers

This section is the contract required by Article 28 of the UK GDPR. It applies whenever a subcontractor or supplier ("the Processor") handles personal data for IRL ("the Controller"), including photographers, videographers, door and security staff, event staff, hosts, DJs and performers who receive guest lists or attendee information.

3.1 Details of the processing

3.2 The Processor must

1. Act only on IRL's documented instructions, including this section and any written brief, unless the law requires otherwise. If the law requires otherwise, tell IRL first, unless the law forbids it. Tell IRL immediately if an instruction seems unlawful.
2. Keep it confidential: make sure anyone working for the Processor who handles the data is bound by confidentiality.
3. Keep it secure with appropriate measures, including at least those in section 3.3.
4. Not use another processor (a sub-processor), such as a second shooter, editor or cloud service not approved by IRL, without IRL's prior written permission. Where permitted, impose the same obligations on them in writing, and remain fully responsible for them.
5. Help IRL respond to people's rights requests, such as a request to delete a photo, within 3 working days of IRL asking.
6. Help IRL meet its security, breach notification and impact assessment duties.
7. Report any personal data breach to IRL without undue delay and within 24 hours of becoming aware of it, with the details IRL needs to meet its own 72-hour reporting duty.
8. Delete or return all personal data when the services end, or earlier if IRL asks, including from memory cards, devices and cloud storage, and confirm in writing. For photos and video: deliver images to IRL, then delete all copies within 7 days of delivery, unless IRL agrees otherwise in writing.
9. Not transfer data outside the UK without IRL's written permission and appropriate safeguards.
10. Give IRL the information it needs to show compliance, and allow audits or inspections on reasonable notice.
11. Not use the data for any other purpose, including the Processor's own marketing, portfolio, social media, other clients or AI training, without IRL's written permission. IRL will never permit this for images from Date IRL, LGBTQ+ or under-18 settings, or for people who opted out.

3.3 Minimum security measures

• Phones, laptops and cameras are password or PIN-protected, with full-disk encryption where available.
• Two-factor authentication on email and cloud accounts used for IRL work.
• Guest lists are viewed on a device, not printed, unless IRL agrees. Any printed lists are kept on the person and shredded after the event.
• Memory cards are kept secure and wiped after images are delivered and backed up.
• No IRL data in personal WhatsApp groups or personal social media.
• Lost or stolen devices containing IRL data are reported within 24 hours.

3.4 Copyright and moral rights in images

For photographers and videographers: the Processor assigns to IRL, with full title guarantee, all copyright and other rights in images and footage created for IRL, including future copyright, and waives all moral rights in them, to the extent the law allows. This assignment is made in writing and signed, as required by section 90(3) of the Copyright, Designs and Patents Act 1988. If a photographer won't assign copyright, they must instead grant IRL an exclusive, perpetual, worldwide, royalty-free licence.

3.5 Liability

The Processor is responsible for any loss IRL suffers because the Processor breaks this section, including fines and claims, subject to any cap agreed in the supplier agreement.

4. When IRL processes data for clients, and how we handle security and breaches

4.1 Corporate, society and group clients

When a client gives IRL details of its staff, members or guests so we can run its event, the client is the controller and IRL is its processor for that event.

The client must:

• have a lawful basis to share the data with us, and tell its people how it will be used, including that it will be passed to IRL and to the Venue for entry;
• only send what we need, usually names, and where needed dietary or access needs; and
• get explicit consent, or have another valid condition, before sending health information.

IRL will:

• use the data only to plan and run the client's event, under the client's instructions;
• meet all the obligations in section 3.2 towards the client, as its processor;
• share it only with the Venue and suppliers needed for the event, under the terms in sections 2 and 3, which the client authorises by giving us the data;
• not add the client's people to our marketing lists or use their data for anything else; and
• keep it for 6 years with our booking records, unless the client asks us to delete it sooner. By sending us the data, the client agrees to this.

If the client's people also book IRL events in their own right, or sign up to our updates, we are a separate controller for that, under our Privacy Policy.

4.2 Our security measures

• Access to booking platforms, email, social media and our internal tools is limited to people who need it, with two-factor authentication.
• Team members and subcontractors sign confidentiality and data protection terms and are briefed on this pack.
• Guest lists are shared through secure, access-controlled links, not open attachments or group chats.
• Devices are encrypted and locked, and accounts are removed promptly when people leave.
• Date IRL data is held separately, with access restricted to the people running each event, and deleted on schedule.
• We keep a record of our processing activities, including our special category and criminal offence data, as Article 30 of the UK GDPR requires.
• We carry out a data protection impact assessment before high-risk processing, including Date IRL matching.

4.3 Handling a personal data breach

A personal data breach is any security incident that leads to personal data being lost, destroyed, altered, disclosed or accessed without authorisation. Examples include a guest list sent to the wrong person, a lost phone, a hacked account, or a photo of someone who opted out being published.

1. Contain. Whoever spots it tells Mitchell Mallary, our privacy lead, immediately, and we act to stop it, for example by recalling an email, revoking access or removing a post.
2. Assess. We work out what data was involved, how many people, and how likely and serious the risk to them is.
3. Notify the ICO within 72 hours of becoming aware, if the breach is likely to result in a risk to people's rights and freedoms.
4. Tell the people affected without undue delay if the risk is high, explaining what happened, the likely consequences, what we're doing, and what they can do.
5. Tell any client for whom we were processing the data, within 24 hours.
6. Record every breach, including ones we don't report, with what happened, its effects and what we did.
7. Learn. We review what went wrong and change how we work to prevent it happening again.

4.4 Requests and complaints

Each party must tell the others promptly about any data protection request or complaint relating to shared data, and help them respond. IRL acknowledges data protection complaints within 30 days, as the Data Protection Act 2018 requires.