Privacy Policy

1. Who is responsible for your data

eHaris Events is a platform that independent organisers use to run their own events. That means two different organisations handle your data, for different reasons, and which one you need depends on what you are asking about.

In practice: ask the organiser about anything to do with a specific event — why they wanted your passport number, what they did with the list afterwards, or to be removed from their mailing. Ask us about your account, your ticket history, our own emails, or if an organiser will not respond. We will always help you reach them, and where we are the processor we will pass your request on and support them in answering it.

Where an organiser runs their own branded registration page against our API, they present their own privacy notice and their own terms. Ours still describes what happens to the data once it reaches us.

Our details are in section 17. The controller for platform data is eHaris International LLC (registration QFC 01336), 9th Floor, Office No. 1, Tech Circle, QFC Tower 1 No. 98, Doha, State of Qatar. We are established in the Qatar Financial Centre, so the data protection rules that apply to us are the QFC Data Protection Regulations 2021, overseen by the QFC Data Protection Office.

2. What we collect

What you give us

• Identity and contact — name, email address, phone number. For an account, also your password (stored only as a hash we cannot reverse).
• Registration details — anything else the event asked for. The platform offers organisers a standard set (salutation, first, middle and last name, company, job title, and the name to print on a badge) and lets them write their own questions. See section 3.
• Your preferences — events you save, organisers you follow, language and country, and the marketing permissions you have granted or withdrawn.
• Anything you write to us — support messages, appeals, and feedback.

What is created as you use the platform

• Orders — what you registered for, ticket types, quantities, add-ons, discount codes used, totals and fees, the reference number, and the order's status over time.
• Payment records — the payment method type, the provider's transaction reference, and whether it succeeded. We never see or store your card number. Card details are entered on the payment provider's own hosted page.
• Attendance — when you arrived, whether a badge was printed, entry and exit scans at gates, and for online events whether and how long you joined.
• Reward points — balance, what earned or spent them, and expiry.
• Communications — that an email was sent to you, when, which one, and whether it was delivered. We keep the delivery record; we do not retain the body of routine transactional emails.
• Consent records — each permission you gave or withdrew, the exact wording you were shown, the version of the terms, when, from which page, and the IP address it came from. We keep these deliberately: a permission with no evidence behind it is not a permission, and the law requires us to be able to show how and when it was obtained.
• Technical and usage data — IP address, browser and device type, pages visited, and an anonymous visitor identifier used to understand how people find events (section 9).

What we get from others

• Sign-in providers — if you sign in with Google, we receive your name, email address and profile picture, not your password.
• Payment providers — the outcome of a payment, and refund and chargeback notifications.
• Meeting providers — attendance records for online events.
• Organisers — if an organiser adds you to an event or imports a contact list, we receive what they upload. They are responsible for having the right to give it to us.

3. Questions organisers add

Organisers can add their own questions to a registration form. We do not choose those questions, and the answers belong to the organiser's copy of your data, not to your account profile.

4. Why we use it

Where we rely on consent, refusing costs you nothing but the thing you refused — you can always register for an event without agreeing to receive marketing.

5. Who we share it with

• The organiser of the event you registered for — your name, contact details, answers to their questions, order and attendance. This is the point of registering, and it is not optional. It does not extend to organisers of events you did not register for.
• Their team, agencies and outlets — the people the organiser has authorised, and any agency acting for them, limited to what their role permits.
• Check-in devices at the venue — desks, kiosks, gates and the badge printer, which read the details needed to admit you and print your badge.
• Our sub-processors — the service providers in section 6, who act only on our instructions.
• Payment providers — to take payment and process refunds.
• Authorities — where we are legally required, or to establish or defend legal claims. Where a venue or a regulator requires attendee information as a condition of the event, the organiser is responsible for telling you before you book.
• A buyer of our business — if we are acquired or merged, under equivalent protections; we would tell you.

We do not sell personal data, and we do not share it with advertising networks for their own purposes.

6. Our sub-processors

These providers process personal data on our behalf. Each is bound to use it only for the purpose we engaged them for.

Organisers may connect their own email or payment provider instead of ours. Where they do, that provider is the organiser's choice and appears in the organiser's own privacy notice, not this table.

7. Where your data goes

We are based in the State of Qatar. Some of the providers in section 6 operate outside Qatar, so your data may be processed in other countries whose laws differ. Where that happens we rely on contractual protections with those providers requiring them to protect the data to the standard described here.

An organiser may also be based outside your country. Registering for their event necessarily sends your details to them.

8. Marketing and consent

We treat marketing as something you opt into, never something you get by default because you bought a ticket. There are three separate permissions, each independent, each unticked until you tick it:

• From eHaris Events — our own event recommendations and news.
• From an organiser — their future events. Given per organiser: agreeing to hear from one does not sign you up to any other.
• From partners and sponsors — separate again, and rarely needed.

Each message identifies its sender and carries a one-click unsubscribe. You can also manage every permission from your account, and withdrawing one takes effect across future events — a purchase later on will not quietly opt you back in.

Withdrawing marketing consent does not stop the operational messages about a booking you hold: you will still get your ticket, and you will still be told if the event moves.

Where an organiser markets to you using their own systems after exporting their attendee list, their notice governs it and the unsubscribe has to be honoured by them.

9. Cookies and tracking

10. How long we keep it

11. How we protect it

Data is encrypted in transit. Passwords are stored as hashes and never in a readable form. Organiser payment and email credentials are encrypted at rest. Access inside the platform is limited by role, so a person can only reach the organisations and events their permissions cover. Attendee details inside a ticket QR are encrypted so that only authorised check-in devices can read them, while the reference number stays readable by an ordinary camera.

No system is perfectly secure. If a breach occurs that puts you at risk, we will notify you and the relevant authority as the law requires.

12. Your rights

Depending on where you live, you can ask to:

• see the personal data we hold about you, and get a copy;
• correct anything inaccurate — much of it you can edit yourself in your account;
• delete data we no longer have a reason to keep;
• object to, or ask us to restrict, processing based on our legitimate interests;
• withdraw consent at any time, without affecting what was done before you withdrew it;
• receive your data in a portable format.

Write to privacy@eharis.com. We will respond within 30 days and will verify who you are first — usually by writing to the address already on the record, so that a request cannot be used to extract someone else's data.

Where your request concerns data an organiser controls, we will pass it to them and tell you we have. Some rights have limits: we cannot delete records we must keep for tax, and we cannot delete the record of an unsubscribe without risking contacting you again by mistake.

13. Staff access and impersonation

Our staff can access account data where it is needed to support you, investigate abuse, or keep the platform running. The platform also lets a platform administrator sign in as another user in order to reproduce a problem they have reported. While that is happening, a banner is displayed in the session so it is never invisible, and the action is written to an audit record.

We mention this because it is the kind of capability most policies leave out, and because you are entitled to know it exists.

14. Automated decisions

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Automated checks flag suspected fraud, abuse and bot traffic, and may block a request or hold an order — a person reviews anything that affects an account, and you can ask for that review by contacting us.

15. Children

The platform is not intended for children, and accounts are for adults. Children may of course attend events, and an adult may register on their behalf — where an organiser collects a child's details, the organiser is responsible for the additional protections that requires under whichever data protection regime applies to them, which for an organiser registered in Qatar outside the financial centre can include obtaining prior regulatory permission.

If you believe a child has given us personal data directly, tell us and we will remove it.

16. Changes

We will publish any update here with a new version number and effective date. Where a change materially affects how we use data we already hold, we will tell you before it takes effect. This version is 2026-08-09, in effect from 9 August 2026.

17. Contact and complaints

eHaris International LLC (registration QFC 01336)
9th Floor, Office No. 1, Tech Circle, QFC Tower 1 No. 98, Doha, State of Qatar
+974 66342747

Privacy questions and requests: privacy@eharis.com

If you are unhappy with our response, you can complain to the QFC Data Protection Office, which supervises data protection in the Qatar Financial Centre, or to the data protection authority in your own country. We would rather hear from you first and put it right.

See also our Terms & Conditions, which set out the roles this policy refers to.