Privacy policy

Version 2026-10-31 · in force from 31 October 2026

1. Who we are

WhyAttend is published by P&P, SAS with a share capital of €16,250, 43 avenue Viviani, 69008 Lyon, France, 103 158 853 RCS Lyon (see the legal notice). P&P is the controller of the processing described in this policy, except for the lists of pre-registered visitors (section 3), which we process on behalf of the show’s organiser.

For any question about your data: support@whyattend.com.

2. Visitors asking for a briefing

This section applies when you use a trade show’s WhyAttend page or widget.

What we collect

• What you enter: your company’s website, your job title, the show goals you pick and, if you describe your company yourself, that description.
• The company you type in a show’s WhyAttend bar, on the show’s website: as you type, the text is sent to us, then to Logo.dev, to suggest companies (name, website, logo). We keep the text and the suggested names and websites for 6 months to answer the same search again; they are not linked to you or to your IP address. The logos are loaded from Logo.dev (img.logo.dev), which receives your IP address when they are displayed.
• The briefing written from it, and its language.
• Anonymous statistics for the organiser: language, goals picked, sector, country and business model of the company, match with the show, clicks on the show’s registration link. They contain neither the company nor the job title, and are not linked to an identifier or an IP address.
• Your IP address, to protect the service: blocking abusive traffic, daily limits per IP address, and the bot check (Cloudflare Turnstile). For the bar’s searches, we keep only a pseudonym of your IP address, made with a secret key and changed every day.

We do not ask for your name, your e-mail address or your phone number, and we do not set tracking or advertising cookies. Your browser may keep a few settings locally (your language, the briefings you marked as favourites); they stay on your device and are not sent to us.

Please do not enter another person’s personal information in the fields: a job title, not a name.

Why, and on what basis

To write and display the briefing you ask for, to let you open it again from its link, to give the organiser anonymous statistics on use, and to secure the service. The legal basis is our legitimate interest, and that of the show’s organiser, in providing the service you request and protecting it from abuse.

Who sees it

Anyone with the link of a briefing can open it: share it only with people you choose. The show’s organiser sees only anonymous counts, never your company or your job title; a category of fewer than 5 visitors is merged with others so that no one can be singled out.

How long

• Briefings and the related statistics: 90 days after the end of the show, then deleted automatically.
• Daily counters per IP address: 2 days.
• Searches typed in the bar and their suggestions: 6 months, with no link to a visitor.
• Pseudonyms of IP addresses of the bar’s searches: 3 days.

3. Pre-registered visitors

Some organisers send us the list of the visitors already registered for their show, so that each one receives a briefing in the organiser’s e-mail campaigns. We then act as the organiser’s processor, under a data processing agreement; the organiser is the controller and the first contact for your rights.

• Your name and e-mail address are used only to put your briefing back on the right line of the file returned to the organiser. They are never sent to the AI and never appear in the briefing. The files that contain them are deleted 7 days after the batch is processed, or earlier at the organiser’s request.
• Your company is identified from your e-mail domain or the company name in the list, using public business registers (Pappers, the EU VIES VAT service).
• The briefing itself keeps only the company, the job title and the priorities inferred from them, and follows the rules of section 2.

4. Organisers and their teams

What we collect

• Identity and contact details of the organisation’s members: first name, last name, professional e-mail address, company, login data.
• What you tell us when you sign up: your role and how you heard of WhyAttend and, if you choose to give them, the number of shows you run a year, the visitors expected at your next show and your phone number. And how you first came to our website (see article 6).
• Billing details: company name, VAT number, country, billing e-mail address, payments, invoices and balance movements. Card details are entered on Stripe’s pages and never reach our servers.
• Use of the organiser space and of the service, the shows and their settings, and referrals.
• Exchanges with our support.

Why, and on what basis

• Providing the service, the organiser space, billing and support: performance of the contract.
• Keeping invoices and accounting records: legal obligation.
• Service e-mails (low balance, invoices, validation of a sponsored placement), security, fraud prevention, and improving the service: legitimate interest.
• Calling you back if you gave us your phone number at sign-up, and knowing which channels bring us our organisers: legitimate interest.
• News about WhyAttend sent to customers, and our commercial follow-up of organisers (welcome, reminders while their show is not published yet, offers): legitimate interest, with an unsubscribe link in each message.

How long

• Organisation data: while the organisation is open, then 3 years after its closure or last activity.
• Invoices and accounting records: 10 years, as required by French commercial law.
• Detailed usage records: about 2 years.

5. Contact form and prospects

When you write to us from the contact form, we receive your name, your work e-mail address and your message, through the Web3Forms service, which forwards them to us by e-mail. We use them to answer you and, if you are interested, to follow up commercially. The legal basis is our legitimate interest in answering the requests we receive. We keep these exchanges for 3 years after our last contact with you.

6. This website

www.whyattend.com sets no advertising cookie. With your consent, given or declined in the banner of the home page, it sets only these cookies:

• wya_ref: the code of a referral link you arrived by, kept 90 days, so that the organisation that recommended us is credited if you sign up.
• wya_aff: the code of an affiliate link you arrived by, kept 90 days, so that our affiliate partner is credited if you sign up.
• wya_src: how you first came to the site, kept 90 days: the campaign codes of the link you followed (utm_…), the website you came from, the first page you saw and the day. It is read only if you sign up, to know which channels bring us our organisers; it holds no identifier and follows you nowhere else.
• _ga and _ga_…: Google Analytics’ audience measurement, kept 13 months: the pages seen, how you came (campaign codes, previous website) and whether you signed up, counted with a random identifier. Google signals and ad personalisation are off, and the addresses we send it never contain a referral, affiliate or invitation code nor an e-mail address.

The same choice applies to the sign-in, sign-up and affiliate application pages of the organiser space (app.whyattend.com/organizer), which ask for it in their own banner if you have not answered here: Google Analytics is never used on the visitor pages of a show, nor once you are signed in to the organiser space.

Your choice itself is kept 6 months in a wya_consent cookie, then the banner asks again; you can change it at any time from “Cookies” at the bottom of the home page. Declining erases these cookies, Google Analytics’ included. Without your consent, nothing is kept: the codes of the link you arrived by, and how you came, only go to the sign-up buttons of the page you are on. Each arrival through an affiliate link counts one click for that affiliate, with no cookie and no personal data: neither your IP address nor any identifier is kept with it.

Its fonts are loaded from Google Fonts, which receives your IP address when the page is displayed. Our host keeps technical logs to run and secure the site.

7. Who receives the data

Only the P&P staff who need it, and the providers below, each for its own task and under a contract that binds it to confidentiality and security. We do not sell personal data.

We may also disclose data where the law requires it, at the request of a competent authority.

8. Transfers outside the EU

Some of the providers above are established in the United States. These transfers are covered by the EU–US Data Privacy Framework when the provider is certified under it, and otherwise by the standard contractual clauses adopted by the European Commission. You can ask us for a copy of these safeguards.

9. Your rights

Under the GDPR and the French Data Protection Act, you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. You can also give instructions on what happens to your data after your death.

Write to support@whyattend.com. We answer within one month. Since visitors give us neither name nor e-mail address, a visitor who wants a briefing erased should send us its link. For a list of pre-registered visitors, contact the show’s organiser first; we will help them answer.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or with the supervisory authority of your country.

10. Security

Data is encrypted in transit and at rest, access is limited to the people who need it, and the service is protected by a web application firewall, bot checks and usage limits. Files containing names and e-mail addresses are deleted automatically after use.

11. Changes

We may update this policy, for instance when we add a provider. The version and its date appear at the top of this page; organisers are told by e-mail of any significant change.