Privacy Policy

1. Who we are and how to reach us

Bazm is provided by Bazm Ltd, a company registered in England and Wales (“Bazm”, “we”, “us”). Our company details are on the legal page.

Write to contact@bazm.io about anything in this policy, including a request to use the rights in section 12. We have not appointed a data protection officer because we are not required to.

2. When we decide, and when the organiser decides

Data protection law separates a “controller”, who decides why and how personal data is used, from a “processor”, who handles it on the controller’s instructions. Bazm is each of these, for different things.

This matters for your rights. For the first five rows, ask us. For a conference’s own data the organiser is responsible: they should have their own privacy notice, and requests about that data are theirs to decide. If you send such a request to us, we pass it to the organiser and help them answer it.

3. The information we handle

If you have a Bazm account

• Your name, your email address and a password. The password is stored only in hashed form by our sign-in service; nobody at Bazm can read it.
• Optional profile details: a display name, a photo, a short biography, your language and your time zone.
• A record of which version of our Terms and of this policy you accepted, and when.
• A history of sign-ins and other account events, such as a password reset, with the time and the IP address used.
• Your notification and email preferences.

If you organise conferences

• Your organisation’s name and logo, and the people on your team with their roles.
• Billing details for your Bazm plan. If you take payments, Stripe collects the identity and bank details it needs directly from you. We receive the status of your Stripe account and the record of it that Stripe sends us, which can include your business details and the last four digits of your bank account.
• An audit log of actions taken in your account: who did what and when, with the IP address and browser used.
• Contacts and companies you add or import, for which you are responsible.

If you register for or attend a conference

• Your name and email address, the ticket you chose and what you paid. Your card number and security code are entered directly with Stripe and never reach our servers. Stripe sends us a record of each payment, which can include the card type, its last four digits and its expiry date.
• Your answers to the questions the organiser asks. An organiser may ask about dietary or access needs; an answer can reveal something about your health or beliefs, so give it only if you are happy for the organiser to have it.
• Your badge and its QR code, your check-in times and any waitlist place.
• Bookings for excursions and workshops, including the names of any guests you add.
• Certificates issued to you.
• For a group booking: the buyer’s company name, billing email address, country, address and VAT number, and the email address of each person invited to take a seat.

You do not need a Bazm account to register for a conference. We keep a record under your email address so the organiser can manage your registration; if you later sign up with the same address, your registrations appear in your account.

If you speak, submit a paper, review or sit on a committee

• A speaker profile: name, photo, biography, company, job title and links. Organisers publish speaker profiles on the conference website.
• The email address of a guest speaker, which is never published.
• Papers and proposals: title, abstract, keywords, files, your answers to the submission form, and the names and email addresses of co-authors. We email each co-author to confirm they agree to be listed.
• Reviews: scores, comments and recommendations, and for reviewers their areas of expertise.
• Committee members: name, role, affiliation, email address, biography and photo. These are public when the organiser lists the committee on the conference website.

If you sponsor, exhibit or book a room

• Company and contact details, billing details and VAT number, booking notes and the files you upload. A sponsor’s contact email address is published with its public listing.
• For a contract signed through Bazm: the signer’s name, email address, job title and signature, and the IP address and browser used to open, review and sign it. These are kept with the signed document as evidence that it was signed.

Community features

An organiser can switch on a directory of attendees, messages, meeting requests, a community feed, suggestions of people to meet and shared travel. If you use them we handle:

• Your event profile: display name, headline, company, photo, city and country, interests, what you are looking for at the event, and any phone number or links you add.
• The people you bookmark or block, the messages and meeting requests you send, your posts, comments and reactions, and your shared-travel posts and messages.
• Reports you make about other people’s posts or messages, and any mute or ban a moderator applies to you, with the reason given.
• Suggestions of people to meet, worked out from your interests, what you say you are looking for, your headline and company, and your biography.

Live and virtual sessions

• The questions you ask, your poll votes, chat messages and reactions. A random identifier kept in your browser or app stops one device voting twice.
• In a virtual session: your display name, when you joined and left, and your audio and video if you speak. An organiser may record a session; a notice is shown before you join and a banner is shown while recording is on.

Surveys

Your answers. When a survey is not anonymous, the organiser sees who gave each answer. When an organiser marks a survey anonymous, your answers are shown to them without your name. For an anonymous survey limited to registered attendees we still store which account gave each answer, hidden from the organiser, so that one person cannot answer twice. While an anonymous survey is open, and once it has answers, the organiser cannot make it non-anonymous.

If you contact us

• The contact form: your name, email address and message, and your account if you are signed in. It reaches us as an email.
• Live chat, provided by tawk.to: the conversation, your name, email address and account identifier if you are signed in, and technical details such as your IP address and browser.

If we contact you about Bazm

We write to people who organise conferences to introduce Bazm. For this we use your name, role, organisation and work email address, and public information about your conference. We take these from your conference’s or organisation’s public website, or from someone who knows you. We keep a record of what we sent, whether it was opened and whether a link in it was clicked (see section 7), your reply, and whether you asked us not to write again.

If an organiser emails you through Bazm

Whether each email was delivered, bounced or was reported as spam; your unsubscribe choices; and, when the organiser has measurement switched on, whether you opened the email or clicked a link in it (see section 7).

Technical information

• Server logs: your IP address, the page or action requested, the time and the result.
• Cloudflare. Traffic to bazm.io passes through Cloudflare, which delivers it and protects it from attacks and automated abuse, so Cloudflare handles your IP address, browser details and the address requested, and the content of the request while it passes through. When you sign in, sign up or ask for a password reset, a Cloudflare Turnstile check runs in your browser (in the mobile app, in the browser the app opens for it) to tell people from automated programs: it uses signals from your browser and device, and we receive only whether it passed. Cloudflare may also run a script on our pages that looks for automated traffic. Cloudflare Web Analytics counts page loads and how quickly they load, without cookies and without tracking you across other sites; it is not run for visitors in the European Union.
• Cookies and similar storage, listed in our Cookie Policy.
• Private links. When you open a link we sent only to you, such as a link to upload speaker materials, to join a session as a guest speaker or to review a contract, we record the IP address and browser used and keep them with that link’s record, for as long as the organiser keeps the conference on Bazm.
• Error reports. When something breaks, a report describing the failure goes to our error-monitoring provider. Reports are built to leave out passwords, sign-in links and what was typed into a form. A report can still contain some of the data being handled at the moment of the failure, such as a name or an email address.
• Performance measurements. For a sample of requests we send the same provider which page or action was requested and how long it took, so that we can see when Bazm is slow.
• In the mobile app: your device’s push-notification token, crash reports, and statistics about which screens are opened. Section 15 has the details.

Files you upload

Photos, logos, slides, papers and other documents. We remove location and camera details from photos of people when they are uploaded.

Other people’s details

Some forms let you give us someone else’s details: a co-author, a colleague you are registering, a guest. Only do this if they know. We email co-authors and group invitees at the address you give.

Sensitive information

Bazm does not ask for information about your health, religion, politics, ethnicity, sexual life or trade union membership. An organiser may ask a question whose answer reveals such information, for example dietary requirements; the organiser is responsible for having a lawful reason to ask. Please do not put sensitive information in free-text fields unless it is needed.

4. Where the information comes from

• You, when you create an account, fill in a form, upload something or use the product.
• Organisers, when they add you as a speaker, committee member, reviewer, sponsor contact or team member, register you by hand, or import their contacts.
• Other people, when they list you as a co-author, buy you a place in a group booking or send you a meeting request.
• Our payment and email providers, which tell us whether a payment succeeded and whether an email was delivered.
• Public sources, for the outreach described in section 3.

5. What we use it for, and our legal basis

The law requires a reason, called a legal basis, for each use of personal data. This table gives ours. Where the organiser is the controller (section 2), the organiser chooses the legal basis and we act on their instructions.

Where we rely on legitimate interests, we have weighed them against your rights. You can object (section 12) and we will stop unless we have a compelling reason to continue.

6. Artificial intelligence features

A few features use a language model run by an outside provider. They are off unless Bazm has enabled them for an organiser, and each can be switched off again.

Decisions made automatically. Paper screening is normally advice to the organiser, who makes the decision. An organiser can choose an automatic mode in which a paper is accepted or rejected, within limits the organiser sets, without a person looking at it first. If that happens to your paper you can ask the organiser to have a person review the decision, and you can write to us if you get no answer. Nothing else on Bazm makes a decision with a legal or similarly significant effect on you without a person. Two smaller things do happen automatically: a word filter hides abusive posts and messages until a moderator has looked at them, and we stop sending email to an address that bounces or reports an email as spam, and pause an organiser’s campaigns if they draw too many complaints.

Your biography is used for suggestions only when the organiser has matchmaking on and you have said what you are looking for at the event. If you would rather it was not used, leave that field empty or hide yourself from the directory.

We choose AI providers and settings under which your content is not used to train their models.

7. How we measure emails

Some emails carry a tiny invisible image and links that pass through our servers. They tell the sender whether the email was opened and whether a link was clicked.

• Emails an organiser sends as a campaign. The organiser chooses whether to measure. When it is on, the email says so in its footer, and we record for each recipient whether and when it was opened or a link clicked. We do not record your IP address or device for this.
• Emails from us to organisers about Bazm. Our email provider records for each recipient whether the email was opened and whether a link was clicked. On our own website we count visits from these emails only as totals that do not identify anyone.
• Service emails, such as confirmations, receipts and password resets, are not measured in this way.

Most email programs can block remote images, which stops open measurement. You can also object: reply to the email or write to us and we will stop measuring emails to you, or stop writing altogether.

8. Who sees your information

The organiser

When you register for, submit to, speak at or otherwise take part in a conference, the organiser and the members of their team can see what you gave them.

Other attendees

• When the organiser has the attendee directory on, other confirmed attendees of that event can see your event profile: display name, headline, company, photo, interests, biography, and your city and country. It also shows your role at the event, such as speaker or organiser, and the sessions you speak in. You can hide yourself from the directory, or hide your location, at any time. A phone number or link is shown only if you switch that channel on.
• A message is seen by you and the person you send it to. Moderators can read a message if it is reported or caught by the word filter.
• When a meeting is confirmed, the calendar invitation sent to both people includes both email addresses.
• Posts, comments, shared-travel posts and chat messages appear with your name to the other attendees of that event.
• A question you ask in a live Q&A is visible, with your name, to anyone who can open that session, unless the organiser allows anonymous questions and you choose to ask anonymously.
• In a virtual session, the other participants can see your display name in the list of participants when the organiser shows it.

The public

Speaker profiles, committee listings, and sponsor and exhibitor listings are shown on a conference’s public website when the organiser publishes them. Ask the organiser if you want yours changed or removed.

The photo you add to your Bazm account is stored at a web address that anyone who has the address can open without signing in.

Sponsors and exhibitors

We do not give sponsors or exhibitors lists of attendees or attendees’ contact details.

Companies that help us run Bazm

Hosting, content delivery and security, file storage, email delivery, payments, video, error monitoring, push notifications, mobile app statistics, live chat and AI providers handle personal data for us under contract. The full list, with what each one does and where, is on the sub-processors page.

Payments

When you buy a ticket, the organiser is the seller and Stripe processes the payment. Stripe also uses payment data for its own purposes, such as preventing fraud, under its own privacy policy.

Embedded content on conference websites

An organiser can add a venue map (Google Maps or OpenStreetMap), a font from Google Fonts, and videos or posts from YouTube and LinkedIn to their conference website. When a page includes one, your browser fetches it from that company, which sees your IP address. An organiser can also show images that are hosted elsewhere, for example a speaker’s photo or a picture in a custom section of the page; your browser fetches those from the host the organiser chose.

Bazm staff

A small number of Bazm staff can open an organiser’s account to give support. Each time, they must record a reason, the access ends by itself after an hour, and the changes they make are written to the organiser’s audit log. Staff can also look up an account by its email address and, when asked, reset its password. A reset made in our admin console is logged with its reason. The engineers who run Bazm can reach its servers and database when that is needed to keep the service working, to fix a fault or to help someone who is locked out.

When the law requires it

We disclose personal data to courts, regulators or the police when the law requires us to, to our professional advisers when we need advice, and to a buyer if our business or part of it is sold, on terms that keep this policy’s protections.

We do not sell personal data, and we do not share it for advertising.

9. Where your information is kept

Our servers and database are in the United Kingdom. Web traffic passes through Cloudflare’s network, which serves each visit from a data centre near the visitor, so your IP address and the request can be processed outside the United Kingdom. Uploaded files, recordings and encrypted backups are held by Cloudflare, with European storage selected, and our error reports are kept in Germany. The mobile app’s crash reports on Android also go to Google (section 15).

Some of our providers are in the United States or operate worldwide: for example our email, payment, video, push-notification, live-chat and AI providers, and Cloudflare. When personal data goes to a country that the UK has not recognised as giving an adequate level of protection, we rely on one of the safeguards the law allows: the UK’s adequacy regulations, including the UK extension to the EU–US Data Privacy Framework where the provider is certified, or the International Data Transfer Agreement or Addendum approved by the UK Information Commissioner. Write to us if you would like a copy of the safeguard that applies to a particular provider.

10. How long we keep it

Cookie lifetimes are in the Cookie Policy. When a period ends we delete the information or make it anonymous so that it can no longer be linked to you.

11. How we protect it

• All traffic to Bazm is encrypted in transit.
• Each organiser’s data is kept apart from every other organiser’s by rules enforced in the database itself, not only in the application.
• Team roles limit what each member of an organiser’s team can do.
• Passwords are stored hashed. Card numbers and security codes are handled only by Stripe.
• The database is backed up every night. Backups are encrypted before they leave our server, and the key that opens them is kept offline.
• Sign-in links and access tokens are removed from our application logs and error reports.
• Location and camera details are removed from uploaded photos of people.
• A staff support session in a customer’s account needs a recorded reason, ends after an hour and is logged.

No system is perfectly secure. If a breach of security is likely to put you at risk, we will tell you and the regulator as the law requires. For a conference’s own data we tell the organiser without undue delay.

12. Your rights

You have the right to:

• be told how your personal data is used, which is what this policy is for;
• get a copy of your personal data;
• have inaccurate data corrected;
• have your data erased;
• have its use restricted while a question is settled;
• receive data you gave us in a form you can take elsewhere;
• object to a use based on legitimate interests, and to any direct marketing, which we will always stop;
• withdraw a consent you gave;
• ask for a person to review a decision made automatically (section 6).

Doing it yourself

• Correct your name, photo, biography and event profile in your profile.
• Download or delete your account data under “Privacy & data” in the account menu on the web. In the mobile app you can delete your account under Profile → Account & security.
• Unsubscribe with the link in any campaign or announcement email an organiser sends you, and set notification preferences in your account.
• Switch off usage statistics in the mobile app’s Profile screen.

Asking us

For anything else, write to contact@bazm.io. We answer within one month. It is free. We may ask for something to confirm who you are, and if the request is about a conference’s own data we will pass it to the organiser (section 2).

If you registered for a conference without creating an account, sign up with the same email address to manage your data yourself, or write to us.

13. Deleting your account

You can delete your account under “Privacy & data” in the account menu on the web, or under Profile → Account & security in the mobile app. Deletion takes effect after 30 days. Until then you can sign in and cancel it.

After the 30 days:

• Erased: your name, email address, photo, biography and sign-in; your event profiles and their photos; your bookmarks, blocks, saved sessions, notification settings and your devices’ push-notification tokens; and any speaker profile linked to your account, with its biography, photo and links.
• Emptied: messages you sent, your posts and comments, questions you asked and your chat messages are replaced with “[deleted]” and no longer show your name. Other people’s replies stay.
• Kept by the organiser: the records of your part in a conference (registration, tickets and payments, check-in, the answers you gave, papers and reviews, survey responses, bookings and certificates) stay with the organiser but are no longer linked to your account. Details you typed into the organiser’s forms, such as an email address or a phone number, stay in those answers. The organiser may also hold its own copies, for example in its contact list, in certificates already issued, in signed contracts or in a paper’s list of authors. Ask the organiser to remove any of these, or ask us and we will pass your request on.
• Kept by law: payment records, for the 6 years in section 10.
• Kept for a limited time: log and audit entries about actions you took, with the IP address and browser used, for the periods in section 10.

Erased information can remain in our encrypted backups for up to 30 more days before the backups themselves are deleted.

If you are the only owner of an organisation on Bazm, transfer ownership or close the organisation first, or write to us and we will help.

14. Getting a copy of your data

Under “Privacy & data” in the account menu on the web you can ask for an export. We prepare a ZIP file and email you when it is ready. It contains the information linked to your account: your profile and preferences, the documents you accepted, your registrations, orders and payments, the answers you gave, your bookings, papers and survey responses, your event profiles, the messages, posts and comments you wrote, and the log of your own actions.

The download link works for 7 days, after which the file is deleted. You can ask for a new one at any time.

15. The mobile app

Permissions

• Camera: to take a profile photo, and for event staff to scan attendee badges. Scanning happens on the device; we receive only the code that was read.
• Photos: to choose a profile photo.
• Notifications: to tell you about messages, schedule changes and announcements. You choose which in the app.
• Bluetooth: on a check-in kiosk, to connect to a badge printer.

The app does not use your location, your contacts or your microphone. On Android 11 and earlier, Android asks for the location permission before a check-in kiosk can find a Bluetooth printer; the app does not read your location.

Copies kept on your phone

So that it works without a connection, the app keeps a copy of your account details and of what you need at your conferences: for example your registrations and badge, the programme, your bookings and saved sessions, your papers and applications, and your recent conversations and the community feed. When the attendee directory is on, it also keeps the directory entries of other attendees. Event staff’s devices keep the attendee list for check-in. These copies are removed when you sign out, 24 hours after you lose access to an event, or after 30 days without contact with our servers. A conference’s public programme, which contains nothing about you, can stay on the phone after you sign out. Photos already downloaded can stay in the app’s image cache for up to 30 days.

Notifications

To deliver a notification we send your device’s push token, the notification’s text and the place in the app it should open to Google’s Firebase Cloud Messaging. A notification about a message says only that you have a new message, not what it says.

Crash reports

When the app crashes or a request fails, a report goes to our error-monitoring providers (Sentry and, on Android, Firebase Crashlytics). It carries technical details and your account’s identifier, not your name or email address.

Usage statistics

The app sends Google’s Firebase Analytics the names of the screens that are opened, together with your account’s identifier and details of your device and app version. It sends the kind of screen, not which conference, message or person you were looking at. We use this to see which parts of the app are used. It is on by default; you can switch it off at any time under Profile → Usage analytics. We do not use advertising identifiers.

Fonts

The app downloads its fonts from Google Fonts the first time they are needed, which shows Google your device’s IP address.

16. Cookies

We use a small number of cookies, almost all of them needed to make the product work. None is for advertising. The Cookie Policy lists every one.

17. Children

Bazm is for people aged 16 and over, and you must be 18 or over to organise a conference or pay for anything. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us their details, write to us and we will delete them.

18. Changes to this policy

When we change this policy we update the date and version at the top and record the change on the legal page. If a change is significant we email Bazm account holders before it takes effect.

19. Complaints

If you are unhappy with how we have handled your personal data, please write to us first at contact@bazm.io so that we can put it right.

You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Economic Area you can complain to the data protection authority of your own country.