Privacy settings
Registration collects personal data. Two settings put consent and legal wording on the form, and several practices around them keep the handling defensible.
The settings
Settings → POM Events → Single event:
| Setting | Purpose |
|---|---|
| Single form privacy link URL | The privacy policy the consent text links to |
| Single form clause | Your own wording under the consent checkbox |
Configure the URL before going live
The consent checkbox exists only when this URL is set. Without it, the form collects names, email addresses and whatever optional fields you enabled, with no consent step and no link to your policy.
This is the first thing to configure on a site that will take registrations.
What the clause should cover
Written in your own words, and reviewed by whoever advises the organization on data protection:
- who the data controller is;
- what is collected — name, email, and each optional field you enabled;
- why — managing registration and contacting attendees about this event;
- how long it is kept;
- who else sees it;
- how to exercise data rights.
Keep it short. It is printed in small text under a checkbox in a modal.
Say that an account is created
Worth including, because it surprises people: registering with an email address that is not already a user of the site creates a WordPress user account for it.
If your privacy notice describes what happens to registration data, it should mention that.
Collect less
The most effective privacy setting is not on this screen. It is on each event: Registration form → Form fields.
Turn off the optional fields you will not use. A field you never collect is data you never have to protect, export carefully or delete later.
For most events, name and email are enough.
What the plugin does not do
- It does not record consent as a separate auditable value.
- It does not send anything to attendees, so it does not process their data for messaging.
- It does not delete data after a period.
- It does not anonymise anything.
- It does not log who viewed or exported an attendee list.
Retention and access control are manual responsibilities. See Attendee data and privacy.
Exports are the real exposure
Every CSV or XLS export is a copy of personal data outside WordPress: names, emails, telephones and free-text comments that often include health or dietary information.
- Store them in one known place.
- Do not email them casually.
- Delete them when the event's retention period ends.
- Never attach one to a support request.
Multilingual sites
The privacy URL and the go-back settings are translatable. If your site publishes in several languages, point each language at its own privacy policy and write the clause in each language.
Checklist
- [ ] The privacy policy URL is set, so consent is collected.
- [ ] The clause names what is collected, why and for how long.
- [ ] The clause mentions that an account is created.
- [ ] Only the fields you actually use are enabled on each event.
- [ ] A retention period is defined and someone runs it.
- [ ] Exports are stored deliberately and deleted on schedule.
- [ ] Event editing access is limited to the people who need it.