# Privacy and consent for organizers: what you must do on Medvento

> A plain-language checklist of the privacy and consent duties of an organization running events on Medvento: policy, contacts, pages and campaigns.

Source: https://medvento.com/docs/guides/privacy-and-consent-for-organizers · Last updated: 2026-10-21

When your organization runs an event on Medvento, delegates, faculty and contacts trust you with personal data. Your organization decides why that data is collected, so your organization carries the duty to handle it properly. Medvento provides the tools and enforces some checks, but it cannot give consent on your behalf. This guide lists what you must do, where Medvento helps, and where the responsibility stays with you.

**This guide is practical guidance, not legal advice.** The Digital Personal Data Protection (DPDP) Act applies to organizations in India that handle personal data. If you are unsure how it applies to your society, ask a lawyer.

## The short checklist
| When                     | What you must do                                              | Where in Medvento                     |
| ------------------------ | ------------------------------------------------------------- | ------------------------------------- |
| Before your first event  | Publish your Privacy Policy and name a grievance officer      | Settings, Compliance                  |
| Designing registration   | Ask only for the data you need                                | Event, Design, Registration form      |
| Importing contacts       | Confirm you have consent to contact every person in the file  | Audience or Attendees, Import         |
| Showing people on a page | Get each person's agreement to publish their details or photo | Contact persons, Gallery, People grid |
| Sending a campaign       | Send only to people who agreed, and honour unsubscribes       | Campaigns                             |
| When a person asks       | Let them see, correct or delete their data                    | Privacy requests                      |
| Team changes             | Give access only to people who need it                        | Team                                  |

## 1. Publish your Privacy Policy and name a grievance officer
Delegates must be told what you collect, why, and who to contact with a complaint. In Settings, Compliance, you enter your details and a **Grievance Officer** (name and email). Medvento generates your Privacy Policy and five other public pages from them, and publishes them when you save. You cannot open registration until the Privacy Policy is published.

Use a mailbox that someone actually reads. A grievance officer who never replies defeats the purpose.

Step by step: [how to set up compliance details and publish your privacy policy](https://medvento.com/docs/organization/compliance-details).

## 2. Collect only what you need at registration
Every question on the registration form is personal data you must protect, and show or delete if the person asks. The form always asks for name and email. Phone, country, state and city are built in but can be made optional. Add your own questions only when you will use the answers.

Medvento stores each delegate's answers with their registration and shows them on the Check-in roster. File uploads are not collected.

See [tickets, payment and the registration form](https://medvento.com/docs/registration-payments/set-up-registration-and-payments).

## 3. Contacts and campaigns: consent before you message
When you import a file of contacts, Medvento asks you to confirm:

> I attest that this organization has consent to contact everyone in this file.

This is recorded once for that list. **Medvento cannot check it.** Your own record of consent is what matters if anyone asks. Before you tick it, make sure you could show where each person agreed to hear from you, for example a membership form, an event registration or a signed attendance sheet.

For campaigns (email and WhatsApp):

* Only send to lists whose consent you have confirmed.
* Every email carries an unsubscribe link. When someone unsubscribes, Medvento stops sending that address your campaigns. A **STOP** reply on WhatsApp stops all of your organization's WhatsApp messages to that number, both campaigns and event messages.
* Medvento keeps these opt-outs as a protected record: it stores only a scrambled code of the address, not the address itself. The Unsubscribed page shows counts, not names.
* Medvento may pause your messaging or suspend your organization if sending causes problems. You will be emailed when that happens.

## 4. People you show on your pages
Anything you publish on an event page or your website is visible to everyone. Medvento enforces two consent ticks and expects you to apply the same care elsewhere.

| Block                    | What Medvento enforces                                                                                                   | What you should also do                                |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------ |
| Contact persons          | You must tick that these people agreed to have their contact details published on the page, or Medvento will not publish | Keep a record of each person's agreement               |
| Gallery                  | You must tick that the photos are yours to publish and attendees were informed                                           | Display notices at the event that photos will be taken |
| People grid              | Nothing is enforced                                                                                                      | Get agreement before listing a name, role or photo     |
| Welcome message, Faculty | Nothing is enforced                                                                                                      | Use names and photos only with agreement               |

Details of each block are in the [event page blocks reference](https://medvento.com/docs/event-pages/page-blocks-reference).

## 5. When someone asks about their data
Under the DPDP Act, people can ask to see, correct or erase their personal data. Medvento gives you a built-in process, so you do not have to handle requests by email.

* Your public pages include a **data request form**. A person enters their email and types of request, and confirms their email with a code before the request is accepted. The code stops anyone from filing a request in someone else's name.
* The request is reviewed and carried out by Medvento's team. Your organization's owners are **notified**, but you do not approve or run the request.
* The person gets a status link, and is emailed when review starts and when the request is closed.
* For an access request, the person can download a copy of their data for seven days after it is closed.
* For a deletion request, the person gets a cancel link that works for 48 hours before anything is deleted.
* Medvento's team works to close requests quickly, well inside the legal maximum.

Some records are kept on purpose, even after a deletion request:

* Records needed for **CME credit** (for example who attended and received a certificate) are kept as a minimal record after the event.
* Financial records, such as payments and invoices, are anonymised, not deleted.

Owners can also file a request on someone's behalf, or for their own account, from **Settings, Privacy requests**. You need to have signed in within the last 10 minutes to file one.

## 6. Your team and your access
Only **owners** can see sensitive organization details such as PAN and GSTIN, manage billing and change compliance details. **Staff** can run events but not those areas. Review who has access from time to time, and remove people who have left. Read [roles and permissions](https://medvento.com/docs/organization/roles-and-permissions).

## 7. If you close your organization
An owner can ask Medvento to close the organization. Nothing is deleted when an organization is closed, and it can be reopened. Medvento does not delete a closed organization's data automatically. If you want data removed, ask Medvento's support team.

## What Medvento does and does not do
| Medvento does                                                 | Medvento does not                                                       |
| ------------------------------------------------------------- | ----------------------------------------------------------------------- |
| Publish the policy pages you generate                         | Write your legal policy for you or check it is right for your situation |
| Block publishing contact details and photos without your tick | Verify that people really agreed                                        |
| Stop sending to people who unsubscribe                        | Decide whether you had a right to message them                          |
| Run the data-request process                                  | Decide what your organization must keep for its own legal reasons       |

## Frequently asked questions
### Who is responsible for delegates' personal data?
Your organization decides why the data is collected, so the duty to protect it and explain its use is yours. Medvento provides the tools and holds the data securely on your behalf.

### Do I need consent to email my own members?
You need a lawful reason to contact each person, and a record of it. When you import contacts, Medvento asks you to attest that you have consent. Keep the evidence yourself.

### What happens when someone unsubscribes?
Medvento stops sending your campaigns to that address. A WhatsApp STOP blocks all your organization's WhatsApp messages to that number.

### Can I delete a delegate's data myself?
Data requests are handled through the request process, so that every deletion is reviewed and recorded. Owners can file a request from Settings, Privacy requests.

### How long does Medvento keep data?
Data is kept until it is removed through the request process or by your organization, and some records are kept for legal reasons, such as CME records. Ask support before you rely on a specific retention period.

### Is this legal advice?
No. It is practical guidance. Ask your own lawyer if you need advice on the DPDP Act for your society.

## Next step
[Set up compliance details](https://medvento.com/docs/organization/compliance-details) if you have not yet, then [create your first event](https://medvento.com/docs/events/create-event).