Who should own the attendee database when two organizers co-produce an event?

So you're putting on an event with another organizer. You've agreed the ticket split, divided the production work and picked a date. Then someone asks who gets the attendee list afterwards. You both helped bring those buyers in. Surely you both get to keep it?

You need a more specific agreement than that. Decide which business controls each use of the information, what each organizer can do with it, what attendees are told and how access ends. One business can run the ticketing account while both have responsibilities for the information. Equally, sharing the event's profit doesn't automatically give both businesses permission to send every buyer their own marketing.

My preference is to settle this before the first ticket goes on sale. Once buyers have registered under one explanation, changing the partnership agreement won't rewrite what they were told or what they agreed to.

This guide uses UK privacy rules for its legal examples. The UK General Data Protection Regulation, usually shortened to UK GDPR, governs how personal information is handled. Separate electronic marketing rules also matter. Other countries have their own requirements, so get the actual arrangement checked for the businesses, audiences and systems involved. Some Information Commissioner's Office guidance cited here remains under review following the Data Use and Access Act; check the current position when approving your documents.

We'll work through a fictional paid conference, including separate marketing choices and a partnership exit. The aim is an agreement your ticketing, marketing and support teams can actually follow.

First, agree what you mean by owning the database

An event database contains several things people often discuss as if they were one asset. There are booking records, contact details, marketing preferences, support conversations and information used to deliver the event. You might also have the event brand, website, software account and agreements with suppliers. Each needs its own answer.

Start by asking your partner what they expect to receive. Do they want access to resolve ticket queries? Evidence for the final financial settlement? The ability to invite customers to next year's joint event? Or a copy they can use to promote their unrelated programme? Those requests have different consequences even when they involve the same email address.

You can agree commercial rights over an event brand or database arrangements. Have a lawyer check any relevant intellectual property and contract rights. But a clause between organizers can't remove attendees' privacy rights or create a legal basis for a use that otherwise lacks one. Keep those questions separate when you negotiate.

Account control also needs a precise answer. Someone will pay the software bill, receive administrative messages and be able to invite staff. That person has practical power, including the ability to remove the other team's access. Don't leave the arrangement dependent on a friendly employee's personal login.

Write down the legal business holding the account, the people authorized to administer it and what happens if one becomes unavailable. Then describe the other organizer's agreed access and the process for changing it. If your software can't support the arrangement, find that out before collecting live registrations.

The same distinction applies to settlement. Your partner may need enough information to verify ticket income and refunds without needing every buyer's personal notes. Our guide to settling ticket revenue between co-promoters covers the financial agreement. Agree separately which records support that settlement and who can see them.

I would avoid approving a clause that simply says both parties own all attendee data equally. It sounds generous while leaving the difficult decisions unanswered. Equal access to what, for which activity, for how long, and with what restrictions after the partnership ends? Answer those questions in the agreement itself.

Work out who makes the decisions for each activity

In privacy law, a controller decides why personal information is used and the essential way that use works. A processor handles it on a controller's behalf under instructions. Joint controllers make the relevant decisions together. These roles describe the actual work, so assess them activity by activity.

The ICO's guide to controllers and processors explains that the arrangement determines the role, regardless of the label in a contract. Two organizations using the same information for different purposes aren't automatically joint controllers. Joint controllers remain responsible for their obligations even when they allocate particular tasks between themselves.

Imagine a venue operator and a conference producer developing a paid industry event together. They decide who the event serves, what registration information is necessary and how they'll communicate with ticket holders. That calls for a joint-controller assessment for those activities. It doesn't follow that every other use by either business has the same status.

The venue's own newsletter is a separate question. So is the producer's existing customer database. Map those activities individually rather than describing the entire relationship with a single label. Your adviser can then assess the facts and put the appropriate arrangements in place.

For each activity, ask who decides its purpose, which details are used, which people receive them and how long the information remains necessary. Ask who can approve a change. If the producer can independently start a new marketing programme, that tells you something different from the producer sending an agreed arrival update on the joint event's instructions.

Be honest about how the event works. A contract calling the venue a processor won't fit if the venue is making its own decisions about using the buyers' information. Equally, a supplier following agreed badge-printing instructions doesn't become your co-producer because its staff can open a file.

Under Article 26 of the UK GDPR, joint controllers must arrange their responsibilities, including privacy information and attendee rights. Make the essence of that arrangement available to attendees as required. Appointing a lead contact should make the process easier for people, while preserving their ability to exercise rights against the relevant joint controllers.

You don't need the marketing assistant to make that legal assessment. You do need the event lead to explain the intended work accurately. Bring a description of the registration, messaging and post-event plans to the review. A lawyer can't resolve an arrangement that the organizers themselves describe differently in every meeting.

Keep existing audiences separate from the new event list

Co-production often starts because each organizer brings a different audience. The venue has local buyers. The producer has a specialist industry following. That can make the partnership commercially attractive without requiring either side to hand over its entire customer database.

Your agreement should record what each party brings into the project and what stays within its existing business. That includes lists collected before the partnership, enquiry records, subscriber preferences and relationships with previous buyers. Make the boundary clear enough that staff don't import an old list into the joint account simply because it would be convenient.

One workable approach is for each organizer to promote the joint event through its existing permitted channels, under the rules that apply to that audience. People who decide to buy then register through the agreed event process. This gives you a way to sell together without treating every historic customer as a shared contact.

Check the actual message before assuming this works. A partner's involvement, the nature of the offer and the permission already held can matter. Have the relevant marketing use assessed. The operational advantage is that you can describe what is happening and review it before any list moves between businesses.

Agree how you'll measure contribution too. Ticket sales associated with an organizer's promotion may inform the commercial settlement. They don't settle that person's future marketing choices. A buyer who follows the venue's link might choose to hear from the producer, both businesses or neither. Keep the purchase source and the marketing preference as separate facts.

Otherwise the attribution discussion becomes a misleading argument about who owns a person. An attendee might have seen both campaigns, heard about the event from a colleague and finally bought through a reminder. You can agree a sensible commercial method without pretending it describes the whole customer relationship.

Think about contacts collected before a purchase as well. A waiting-list subscriber, an abandoned checkout and an enquiry about accessibility aren't interchangeable with a completed ticket order. Define how each enters the project and what use has been explained. Don't merge them all into a general event audience without checking the differences.

Group bookings need similar care. A purchaser buying several places may give their own email address while supplying names for colleagues later. Their marketing choice doesn't automatically express every colleague's wishes. Decide what you genuinely need to collect from each person and how they will receive the relevant information.

This is also the time to agree what won't happen. Neither organizer should discover after launch that the other expected a full historical customer export as part of the deal. Put that expectation through the commercial and privacy review while you can still change the offer.

Give every proposed use a reason and a legal basis

Make a short inventory of the uses you expect during the event's life. Selling tickets, handling refunds, delivering joining information and reviewing overall performance all have recognizable purposes. Sending the venue's unrelated promotions or the producer's next conference invitation adds further purposes to assess.

Under UK rules, a lawful basis is the legal reason that allows a particular use of personal information. The ICO's current lawful-basis guidance, updated in April 2026, says you must identify and document the appropriate basis before using the information. The correct basis depends on the purpose and relationship, and a new purpose needs its own assessment.

Don't make consent a catch-all answer for the whole event. A buyer needs their order processed even if they decline future promotional emails. Equally, don't assume everything is necessary for the ticket contract because you've added it to the terms. Have the basis for each intended use checked against what you're actually doing.

An ordinary event task can involve information needing additional care. Access requirements or dietary conversations may reveal health or other sensitive information. Get advice on the additional conditions and protections where applicable. Give the staff arranging assistance what they need, without putting private conversations into the general marketing record.

Your review should identify the fields needed for each job. The finance team might need order references, amounts and refund status. The access coordinator may need a specific arrangement and contact route. A marketer deciding which promotion to send shouldn't receive the access coordinator's notes by default.

Consider reporting separately from individual follow-up. You might want to know which sessions were popular or whether the event made money. Ask whether a report without identifiable attendees meets that need. Check the result carefully, since a small group or a detailed description can still identify someone even after names are removed.

For a partner request that arrives later, return to the same process. What are they trying to do, with which information, and why is that use permitted? A sponsor asking for buyer emails has introduced another recipient and purpose. A new business project does the same. Neither should become an automatic extension of the original co-production agreement.

Keep this inventory usable. Give each activity a named owner, a short description and a reference to the approved arrangement. The people running the event need to find the answer when a request arrives, rather than reconstruct the legal review from scattered messages.

Make the registration experience match the agreement

Now walk through the purchase as an attendee. The event page may have both logos, while checkout names a particular seller and the confirmation arrives from another address. Unless you explain those relationships, buyers have to guess which business holds their details and who will contact them.

The ICO's right-to-be-informed guidance says people must receive clear privacy information when you collect their details, including the purposes, retention periods and sharing involved. Use a short explanation where the question arises, with access to the fuller notice. Have the complete notice checked for all the information your arrangement requires.

Describe the actual businesses involved. An event name can help people recognize the offer, but it may not identify the legal organizations responsible. Match the event page, registration notice, confirmation and support route so they explain the same arrangement.

For the fictional conference, the short explanation could tell buyers that the named venue operator and producer work together to deliver the event, with the producer handling booking support. The full notice would explain their roles and uses in the detail required. Don't copy that outline as a complete privacy notice; it needs your facts and legal review.

Keep optional marketing choices separate from the purchase. If each organizer wants permission for its own future email programme, offer choices that name the relevant business and explain the emails. Someone should be able to buy admission while choosing neither. Decide separately whether you're offering a joint event-series subscription and what that would cover.

Test the words with someone outside the project. Ask which businesses they expect to hear from after buying and what they expect those messages to contain. If they think the venue's newsletter is required to receive their ticket, the explanation needs work. If they don't recognize the producer's legal name, connect it clearly to the event they know.

Record the explanation and choices presented with the registration. You need to distinguish a positive choice from a blank field, an imported assumption or a later change. Keep enough evidence to support the permission you rely on, including the wording and when and how the choice was made, through your approved process.

Then check the less obvious routes. Does the same explanation appear for a manual booking, an invitation converted to a paid order or a place purchased at the door? Can staff record an attendee's actual choice without making one on their behalf? Agree what to do when the system can't capture the intended distinction.

A revised form should have a controlled rollout. Record when the wording changes and which registrations used the previous version. You may need different treatment for those records. Editing the current form doesn't prove that earlier buyers saw it.

Agree the future marketing before you promise either side a list

This is where a vague data-ownership clause can distort the value of the deal. One organizer imagines a ready-made audience for its whole programme. The other imagines permission to invite people back to the same jointly produced event. They can agree on sharing the database while expecting very different things.

For UK unsolicited email marketing to individual subscribers, the ICO's electronic-mail guidance requires consent or a qualifying exception. The products-and-services soft opt-in is a limited existing-customer route with specific conditions; a list passed over by another business doesn't become eligible merely because you co-produced the event. Corporate subscribers have different rules, while personal-data obligations still need consideration.

My preference for two independent future programmes is to make the choices explicit and separate. It makes the intended relationship easier to explain and operate. That is a practical recommendation, rather than a claim that every lawful co-production must use the same form.

Be specific about who sends, what they promote and the channel. Permission for the producer's conference emails shouldn't silently become permission for the venue's text messages. Nor should a choice about the joint event automatically expand to every other business project a partner launches.

Build the approved distinctions into the audience settings before scheduling campaigns. Marketing staff shouldn't receive a complete export and be expected to reconstruct permissions from memory. They need an approved audience for the particular sender and message, with the relevant current choices and restrictions applied.

This is where Loopyah's attendee email tools can help with delivery. The product separates event updates from promotions, uses recorded marketing preferences and removes opt-outs from promotional sends. The organizers still need to establish whose marketing the permission covers. A sending tool can't turn an agreement between two businesses into permission from an attendee.

Keep the wording of service messages focused too. A room change or essential arrival instruction concerns the event someone bought. Adding a sales offer for another event introduces a different purpose. Have mixed messages assessed rather than assuming the operational subject line makes every paragraph an event update.

Agree a sending calendar for the partnership. Even properly permitted messages can create a poor experience if both teams send near-identical reminders or contradictory announcements. Name the person who approves joint communications, identify who sends them and give support staff the final copy.

If one side insists that unlimited independent marketing is essential to its commercial offer, address that before signing. You may need to change the economics or the proposed registration choices. Don't price the partnership around access you haven't established you can lawfully provide.

Set up working access without distributing everything

The producer may handle booking queries while the venue runs arrivals. Both need useful information to do those jobs. Start with the role, the approved fields and the actions staff need to take, then check what your systems actually support.

Give named people access where possible, with permissions suited to their responsibilities. A shared administrator login makes it difficult to tell who changed a record and harder to remove one departing employee. Include temporary staff and contractors in the access plan instead of allowing them to borrow whoever's account happens to work.

Check exports separately. Someone may need to look up a booking without needing permission to download the database. A restricted software view can lose its protection the moment someone creates a spreadsheet and forwards it. Agree who can export, which fields an approved export contains, where it can be stored and when the copy is removed.

For operational suppliers, use the separate checks in our guide to sharing attendee data with event suppliers. A co-producer's approved access doesn't settle what its badge printer, caterer or transport provider may receive. Ask each organizer to identify those onward handoffs before they happen.

Keep the current booking record in the agreed system and define how corrections reach any necessary copies. If the venue corrects a guest's name but the producer keeps using an old export, both can sincerely believe their record is right. Agree who makes the change and how the other team knows it's complete.

Include connections to other systems in the review. An automatic transfer into the venue's customer software can create a separate marketing audience without anyone exporting a file. Check what is transferred, the purpose and the treatment of preferences. Review existing automations before inviting the partner into an established account.

Offline plans need the same attention. If connectivity fails, the entrance team may need a limited backup list. Specify who holds it, the information required and how it comes back afterwards. Don't turn an operational contingency into a permanent copy for every supervisor.

You also need continuity if the partnership becomes difficult. Agree who can keep delivering the booked event, how legitimate access disputes are resolved and who can authorize urgent changes. Preventing an unauthorized marketing use should be compatible with helping a ticket holder find their booking.

A worked example with 600 individual buyers

Imagine the venue operator and producer sell one ticket each to 600 individual buyers. This is a fictional planning example with invented numbers. Every buyer receives the agreed privacy information, and the partners have had their event-delivery arrangement reviewed. Separate optional email choices cover each business's own programme, using wording approved for that purpose.

In this example, 260 buyers choose the venue's emails and 180 choose the producer's emails. Of those, 80 choose both. That means 180 choose only the venue, 100 choose only the producer and 80 choose both. The remaining 240 choose neither programme.

Across the two programmes, 360 distinct buyers have chosen at least one. You don't get 440 different people by adding 260 and 180, because that counts the 80 overlapping buyers twice. More importantly, neither partner has permission through these choices to email all 600 about its own programme.

The producer can still need booking information for all 600 to perform the approved event-delivery work. That operational access and its promotional audience are different. The venue can also need admission information for the event without acquiring a 600-person newsletter audience.

Now imagine the producer's marketer receives the full booking export for a financial report. They see 600 customer addresses and assume the next conference invitation can go to everyone. Your plan should stop that before a message is scheduled. The report should contain only the information needed, and the campaign should use its approved promotional audience.

After a buyer changes their preference, the appropriate audience changes too. The original totals are a snapshot, not permanent entitlements. Confirm that the new choice reaches the relevant programme and any connected system before the next send. Use the preference controls your sending tool provides, then check the result rather than maintaining a competing manual list. Be clear about whether a request concerns one sender or both, without making the person navigate your internal organization.

Suppose the partners had budgeted $900 for staff training, $600 for software access and preference configuration, $500 for post-event administration and $400 for an adviser review. That's a fictional $2,400 allowance in USD, not a quote or industry benchmark. If a forecast profit of $25,000 omitted those costs, adding them would reduce it to $22,600, with everything else unchanged. Assume those amounts include the relevant transaction taxes and paid staff time, with profit measured before financing and business income tax.

Price the actual work into your own agreement and get real estimates. The purpose of the allowance is to assign responsibility before the work becomes an unexpected bill. It doesn't value the attendee list, establish a legal fee or predict future ticket sales.

Decide what survives when the partnership ends

An exit plan is much easier to agree while both organizers expect to work together again. Include completion of the event, cancellation, a partner leaving before delivery and the decision to produce future editions independently. Those situations may require different access and retention arrangements.

Start with unfinished obligations. Buyers may still need refunds, booking corrections or a response to a complaint after the doors close. Decide which business handles those jobs, what records it needs and how the other business supplies relevant information. Don't choose an arbitrary shutdown date that makes valid customer support impossible.

Then decide what happens to each category of information. Operational working copies, financial records and marketing permissions can have different reasons for remaining. Set retention by the justified purpose and applicable obligations, with legal advice where needed. Our guide to attendee data retention develops that decision separately.

For independent marketing, return to what each person was told and what permission or other valid basis actually covers the proposed use. A business leaving the project doesn't automatically acquire the joint event's entire audience. Nor can the remaining business assume every past preference now applies to its newly structured event.

The brand question can complicate this. If one partner buys the event name, clarify which customer relationships and processing arrangements are proposed to continue and have that change assessed. A commercial transfer deserves its own privacy review. Don't assume the brand-sale clause settles the treatment of personal information.

Agree how people will be informed about relevant changes, what happens to existing preferences and who handles questions. Review any proposed invitation to choose future communications as marketing in its own right. It isn't automatically permissible to email people who have opted out simply to ask whether they'd like a different arrangement.

Make the actual separation a task list. Revoke unnecessary user access, close shared links, review automatic transfers and account for approved downloads. Ask each party to confirm what it deleted, what it retained, why and under whose responsibility. Include paper records and information held by suppliers in the review.

Backups need an honest explanation too. Ask the system owner how deletion, restricted retention and restoration work in the tools being used. Your agreement should fit those capabilities and the applicable requirements. Promising immediate disappearance from every backup when nobody has checked the process creates another commitment the team can't demonstrate.

Finally, give the exit work a budget and owner. It's easy to agree that both sides will cooperate. Name who prepares the record list, who checks the permitted future audiences and who signs off access removal. Close the work with evidence while keeping any necessary attendee support route available.

Give attendee requests one dependable route

A buyer shouldn't have to understand your partnership agreement to stop unwanted emails or correct their details. Publish a clear contact route and make sure both teams know how to recognize and pass on a request. The internal allocation should help you respond within applicable requirements, rather than become a reason to delay.

The ICO's guidance on respecting marketing preferences says an objection to direct marketing must be respected. It recommends retaining the minimum information on a suppression list, a record used to prevent future marketing, instead of simply deleting the contact and accidentally adding them again later.

Agree how that works for your two programmes. If someone says they don't want venue promotions, record and apply that request to the venue's marketing. If they say they want all marketing from the event partners to stop, make sure the broader request reaches both. Ask only for clarification genuinely needed to act; don't treat unclear wording as permission to continue.

Handle deletion and other rights requests through the reviewed process too. A marketing opt-out and a request to erase information aren't automatically identical. Relevant records may have another justified purpose, but the person needs an accurate response. Have the responsible team assess what can be removed, what must remain and why.

Include an incident contact and backup for both organizations. A misdirected export, exposed folder or lost device needs prompt escalation to people who can contain it and assess the applicable obligations. Don't make the first conversation an argument over which partner caused the problem.

Preserve facts, record the actions taken and obtain appropriate advice on notification and follow-up. Agree who leads the response and how the other business provides information. An internal clause allocating costs doesn't resolve what affected attendees or a regulator may need from either organization.

Try the process with a fictional request before launch. Send it to the venue inbox, then the producer's support address. Check whether each team identifies the right activity and contact. If the answer depends on one person's memory, improve the instructions while you still have time.

If tickets are already on sale, check before using the list

You may be reading this after registrations have started. Perhaps both organizers assumed the other had arranged the data agreement, or the question only arose when someone requested a marketing export. You still need to resolve it, using what actually happened rather than what you intended.

Collect the registration wording, relevant notices, terms and preference records used so far. Include earlier versions and manual booking routes. Record which businesses have received information and which messages have already gone out. Ask the people operating the systems to confirm the settings, including automatic transfers you might not see in an exported spreadsheet.

Pause a proposed new marketing use while the relevant permission and legal position are checked. Keep necessary event delivery and attendee support operating through the approved arrangements. Get advice if you're unsure which activities can continue; don't make the uncertainty worse by copying everything into both businesses' accounts.

If the evidence supports only one organizer's promotional use, don't create the missing permission by agreeing to share the list now. Have the proposed next steps reviewed. Updating the notice for future buyers may improve the next registration, but it doesn't establish that existing buyers received the explanation or gave a choice they never saw.

Avoid a blanket email asking everyone to agree to future marketing. That request can itself be marketing, and an existing objection needs to be respected. Work out whether and how any communication is permitted before sending it. Similarly, don't delete booking records in a rush just because the partners haven't settled their relationship; assess the relevant purposes and obligations.

Give the correction work an owner and a completion date, then verify the result. Record the decision about existing contacts separately from the improved process for new registrations. Your team needs to know which instructions apply to which records when the next campaign is prepared.

Use this brief to prepare the agreement

You don't need to draft legal clauses in a production meeting. You do need to arrive with decisions that an adviser can turn into the appropriate documents. Use the following as a working brief, alongside the event's commercial agreement. It isn't a complete contract or a ready-made joint-controller arrangement.

• Identify the legal organizers, the event and the businesses holding relevant accounts. Name the operational owner and a backup for each side.

• Describe each use of attendee information. Separate delivery, support, reporting, the joint event's future editions and either organizer's independent marketing.

• Record the assessed privacy roles and legal basis for each activity. Identify any additional conditions, cross-border issues or supplier arrangements needing advice.

• List the necessary fields and approved recipients for each job. Specify which sensitive conversations require restricted handling outside ordinary booking and marketing views.

• Set out the attendee explanation and optional choices. Record where each appears and how you'll retain evidence of the wording and the person's response.

• Define access, exports, system connections and corrections. Name who can approve changes and how temporary staff receive and lose access.

• Agree who sends each kind of communication, which audience it can use and how new preferences reach the relevant systems before another campaign.

• Allocate attendee requests, incident response, retention reviews and exit work. Include the responsible people, escalation route, working budget and evidence of completion.

The ICO's guidance on data-sharing agreements is useful when preparing that discussion. It covers purposes, roles, information shared and practical arrangements. A general sharing agreement is good practice; where joint control applies, the required joint-control arrangement must address the relevant obligations. An agreement doesn't by itself make an unlawful use lawful.

Add the awkward scenarios to the brief. What if a partner wants to invite buyers to an unrelated launch? What if the producer leaves before refunds finish? What if the venue changes its customer software? What if a buyer objects through a staff member's personal inbox? Decide how each request gets reviewed and acted on.

Then give the marketing and support teams the instructions relevant to their work. They need to know which audience to select, who approves an export and where to escalate a complaint. Keep the full agreement accessible to the people responsible, without expecting every temporary steward to interpret legal documents.

Rehearse the arrangement before opening sales

Run a fictional buyer through the whole process. Let them choose only the venue's marketing, then check the producer's campaign audience. Change the booking details and see which operational records update. Submit an unsubscribe request and confirm that an old import won't restore the unwanted marketing later.

Next, rehearse the exit. Ask what each business would receive if the partnership ended immediately after the event. Compare that answer with the approved purposes, attendee explanation and actual software settings. Resolve discrepancies before live registrations make the decision harder.

If the organizers still disagree about future use, keep the disputed use out of the launch until it's resolved. You can reconsider the commercial deal, change the proposed offer or postpone sales while the arrangement is reviewed. Collecting a list first will leave you with more people affected by an unanswered question.

Before you publish the ticket page, both businesses should be able to explain who handles a booking, who may send each kind of promotion and what remains after the collaboration ends. Have the documents reviewed, test the settings and give the teams clear instructions. Then you can sell the event knowing what you've actually agreed to deliver.