What's On? — Last updated: 13 August 2026
What's On? is a mobile and web app that helps UK university students discover events on campus. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and your rights under UK GDPR.
This policy is a transparency notice rather than a contract. The contract between you and us is our Terms of Service; if you publish events, the Organiser Agreement also applies.
WHATS ON EVENTS LTD (company number 17375595), trading as What's On? (“we”, “us”), is the data controller for the personal data described in this policy. We decide what data is collected and why.
What's On? is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will remove it. See Terms of Service § Eligibility and age.
.ac.uk email address.When you submit or edit an event, we collect the event title, description, poster image, date and time, cost, the location you choose (its coordinates, address, and venue name), any external links, and a record of which group member submitted it. Submitted text and images are screened as described under Content moderation.
You may use the app as a guest without creating an account. As a guest we do not collect your email address, display name, or university profile — those exist only after you register. The technical analytics signals described under Analytics and diagnostics below may still be collected for both guest and signed-in sessions (for example app instance ID and device model); while you remain a guest they are not linked to your name or email.
UK GDPR requires us to have a lawful basis for each purpose. Ours are:
Where we rely on legitimate interests, you can object at any time — see Your rights. Where we rely on consent, you can withdraw it at any time without affecting processing carried out beforehand.
Our Android and iOS apps show adverts supplied by Google AdMob. Adverts appear between event cards in the feed and are always labelled. We do not sell your personal data.
Before any advert is requested, Google's User Messaging Platform asks for your advertising choice. Your answer determines whether you see personalised adverts (which may use an advertising identifier and similar signals) or non-personalised adverts. You can change your choice at any time in the app: open the account icon, go to Preferences, and use the ad-personalisation option. That preference is held by Google's consent SDK on your device — we do not store it in our database.
The web app does not show adverts. Adverts are not shown to you based on any special category of personal data, and advert loading does not read your profile, attendance, or follows.
We use Firebase Analytics (Google LLC) to understand how students use the app so we can improve it. This is operated on a legitimate interests basis under UK GDPR Article 6(1)(f).
On our Android and iOS apps, Firebase Analytics collects the following automatically when you use the app (including as a guest), without any separate action from you:
In our configured app build, Firebase Analytics does not include your email address, display name, or precise GPS location in the measurement data described in the list above. What Google collects can depend on app configuration, optional features, SDK versions, and Google's own changes over time. For the current technical description of default analytics and related data, see Google Firebase — collected data and related pages linked from there.
We also use Firebase Crashlytics and Firebase Performance Monitoring (Google LLC) to detect crashes and measure how quickly the app responds. These collect diagnostic data such as crash stack traces, device model and operating system, app version, and timings for screens and network requests. They are used to find and fix faults, on the same legitimate-interests basis, and they are disabled in development builds.
If you use What's On? in a web browser, we use analytics cookies subject to your consent. Under UK PECR, analytics cookies are not treated as strictly necessary and require your consent before they are stored on your device. For the specific cookies we set, consent banner behaviour, and how to change your choice, see our standalone Cookie Policy.
Analytics data is retained for up to 14 months per our Google Analytics 4 property settings (where Google offers that retention option); some data categories may use shorter periods under Google's defaults. This retention period applies to user-level and event-level data used in explorations and similar features; it does not limit standard aggregated reports, which Google may retain for the life of the property. Older data is deleted on a rolling basis after the retention period. You can request deletion of your analytics data at any time by emailing privacy@whatson-events.com. We will use the Firebase Data Deletion API and, where appropriate, the Firebase console User Explorer per-user deletion tools. We aim to complete deletion within 30 days where we can reliably identify the analytics records that relate to you; we may ask for additional information (for example an app instance ID, your Firebase Auth user ID if you have an account, or approximate time and device used) so Google's deletion flows can match the correct data. If you used the app only as a guest and cannot supply identifiers Google needs, we will explain what deletion is possible and any limits.
Device settings and Firebase Analytics measurement are different. Options such as Opt out of Ads Personalisation (Android) or disabling Tracking for this app (iOS) may affect advertising-related uses of data where applicable; per Google's documentation they do not by themselves switch off Firebase Analytics events used for product measurement and reporting. You cannot rely on those toggles alone to stop Analytics collection.
On Android and iOS, we do not provide an in-app switch to disable Firebase Analytics in this version of the app. On web, you can change analytics-cookie consent in Preferences at any time — see our Cookie Policy. To request deletion or discuss processing of measurement data, contact privacy@whatson-events.com.
Because students rely on the events they see here, submitted content is screened before and after it is published. When an organiser submits or edits an event, and when an organiser group profile or an organiser application is created or changed, the text and any images are checked automatically using:
External links are also checked for safety by a Cloudflare service we operate. Content may additionally be reviewed by a human administrator, and an approved event is re-checked whenever it is edited. Outcomes include approval, rejection with a reason, hiding content, restricting a group member, or suspending a group or account. Reports you submit about an event or organiser feed into the same review process.
Moderation involves no solely automated decision that produces a legal or similarly significant effect for you: there is always a route to human review, described in Community Guidelines and Terms of Service § If you disagree with a decision.
We do not sell your personal data and we do not share it for third-party marketing. We use the following service providers, each acting for us and for the purposes listed:
We may also disclose data where we are legally required to, or where it is necessary to protect our users, our service, or our legal rights — for example to a university, the police, or a regulator in response to a valid request.
Some information is visible to other users by design: your display name and university to organiser groups you follow, your display name and email to other members of your own organiser group, and your attendance to the organiser of an event you are going to.
Your data is stored in Google Firebase, which operates data centres in the United States and Europe. Our other providers — Google AdMob, Google Maps and Places, Google Workspace, OpenAI, and Cloudflare — may also process data outside the UK.
Where personal data is transferred outside the UK, we rely on the transfer safeguards in our providers' data processing terms — principally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or a UK adequacy decision where one applies. Google's processing is governed by its Data Processing Addendum, which includes Standard Contractual Clauses. Equivalent terms apply to our use of OpenAI and Cloudflare. You can ask us for more detail about these safeguards using the contact address above.
Your profile and account data are retained while your account is open. Specific periods apply to the following:
You can delete your account from within the app. If you are the admin of an active organiser group, you must first transfer the admin role to another member or have the group dissolved — the app will tell you which groups are blocking deletion.
Deleting your account removes your profile and notification preferences, your saved device notification tokens, your in-app notifications, your “I'm going” attendance records, the organiser groups you follow, your organiser group memberships, invitations addressed to you, and any organiser applications you submitted.
A small number of records are retained after account deletion where we have a legitimate interest or legal basis to keep them:
If you ask us by email to delete data that would otherwise be retained, we will consider the request and complete any further deletion we are able to within 30 days.
Under UK GDPR you have the right to:
We do not make any solely automated decision about you that produces a legal or similarly significant effect. Automated tools are used in content moderation, always with a route to human review.
To exercise any of these rights, email privacy@whatson-events.com. We respond within one calendar month, and will tell you if a complex request needs longer. We may ask you to confirm your identity first — for example by verifying the email address on the account — so we do not disclose your data to someone else.
A copy of your data assembled in response to an access or portability request covers your profile and preferences, your attendance and follows, your organiser group memberships, invitations you sent and received, your organiser applications, events you submitted, feature requests and reports you filed, your in-app notifications, and a record of your registered devices. For security we never disclose the notification token strings themselves, and information identifying other people is removed or reduced where disclosing it would affect their privacy. Analytics data is handled through the separate route described under Analytics and diagnostics.
If you have a registered account, you can also download a copy of your data directly in the app: open the account icon, go to More Info and Support, then Policies & Documents, and choose Download my data. The file is provided as JSON, a machine-readable format, and can be requested once every 24 hours. The email route above remains available for anything outside that download, and for requests after an account has been deleted.
Our web app uses a small number of cookies and similar technologies. Analytics cookies are only set if you accept them; sign-in storage is strictly necessary and is exempt from consent. Our mobile apps do not use cookies. Full detail, including how to change your choice, is in our Cookie Policy.
We may update this policy as the app evolves. Material changes will be communicated in-app or by email. The “Last updated” date and the version at the foot of this page will always reflect the most recent revision. You can request a copy of a previous version by emailing privacy@whatson-events.com.
Read this policy with our Terms of Service, Cookie Policy, and — if you publish events — the Organiser Agreement. See also our full list of legal documents.