Privacy and consent copy

The registration form collects personal data. Two site-wide settings put the consent checkbox and the legal wording on it.

The two settings

Settings → POM Events → Single event:

The consent checkbox only appears with a URL

This is the important behavior: the consent checkbox and the clause text are rendered only when the privacy policy URL is set.

With the URL configured, the form shows a required checkbox reading:

By filling out the form you accept our Privacy Policy.

with the linked words pointing at the URL, and the clause text printed below it.

With the URL empty, neither the checkbox nor the clause is shown, and registrations are accepted without any consent step.

Configure the URL before taking any real registration.

What to put in the clause

The clause is where you say, in your own words, what happens to the data. It should cover:

• who the data controller is;
• what is collected — name, email, and whichever optional fields the event uses;
• why — managing the registration and contacting attendees about this event;
• how long it is kept;
• who else sees it, if anyone;
• how to exercise data rights.

Keep it short and readable. It is printed in small text under a checkbox on a modal; a wall of text will not be read and does not help you.

Have it reviewed by whoever advises the organization on data protection. This documentation cannot tell you what your clause must say.

Tell people about the fields you actually collect

The clause is the only place on the form where you can explain a field. Use it:

We use your telephone number only to contact you if the event changes. The comments box is read by the organizing team.

That is both good practice and the single most effective way to reduce abandonment on a form with optional fields.

What the plugin does not do

• It does not record when or whether a specific person ticked the checkbox as a separate audit value.
• It does not send a copy of the clause to the attendee.
• It does not delete attendee data after a period.
• It does not send confirmation emails, so do not promise one in the clause.

Retention is a manual process you own — see Attendee data and privacy.

Registration creates user accounts

Worth stating in the clause, because it surprises people: registering with an email address that is not already a user of the site creates a WordPress user account for it.

If your privacy notice describes what happens to registration data, it should say that an account is created.

Site-wide, not per event

Both settings apply to every event. There is no per-event clause.

If different events need materially different wording, the practical options are to write a clause covering all of them, or to add the event-specific part to that event's introduction.

Verify

1. Set the privacy URL and the clause, and save.
2. Open a registration form signed out.
3. Confirm the checkbox appears and the link opens the privacy policy in a new tab.
4. Confirm the clause text reads correctly under it.
5. Try to submit without ticking the box and confirm it is required.
6. Check the wording on a phone, where small text is hardest to read.