Page 1 of 9

Privacy Impact Assessment 

for

Whova Virtual Event Solution

5/12/2021

System/Business Owner

Office of Data Technology

Reviewing Official

Charles Cutshall

Chief Privacy Officer

Commodity Futures Trading Commission 
Page 2 of 9

 SYSTEM OVERVIEW

1) Describe the purpose of the system/collection: 

The Commodity Futures Trading Commission (“CFTC” or “Commission”) frequently hosts

public training and events that require advanced registration. When these events are not held 

in person, CFTC staff may use Whova, a third-party event management solution, to host and 

manage virtual event registration, attendance, and participation. 

Whova enables and promotes attendee engagement with features such as live webstreaming, event reminders, anonymous polling and surveys in real-time, and custom 

branding. It also documents participant registration, allows participants to provide feedback, 

facilitates question and answers for presenters, shares event documentation such as agendas 

and speaker biographies, and facilitates attendee networking. 

Information collected by Whova may be extracted and saved in the CFTC environment by 

CFTC staff using Whova to manage virtual events. 

Whova is not a CFTC-owned or operated platform. Whova’s Terms of Use and Privacy Policy

govern Whova’s collection, use, maintenance, and disclosure of personal information. CFTC 

will provide links or references to the Whova Privacy Policy in its communications relating to 

virtual events. 

2) Provide a data map or model illustrating how information is structured or is processed by the 

system throughout its life cycle. Include a brief description of the data flows. 
Page 3 of 9

a. Attendees create a Whova account and register for CFTC-sponsored virtual events from 

their personal devices. Attendees log on to Whova to watch the event, communicate with 

other attendees, answer polling and survey questions, and use other functionalities 

offered by the Whova platform. 

b. CFTC staff responsible for organizing the event extract registration information and other 

event metrics from the Whova platform to the relevant network drive or SharePoint site 

in the CFTC network. 

c. Guest speakers use a video conferencing tool, such as Zoom or WebEx, to deliver their 

presentations. 

d. The A/V stream is captured by the Division of Administration’s webcast vendor and from 

there routed to YouTube. Attendees watch the presentations in Whova through a 

YouTube feed embedded in the Whova platform. Recordings of the presentations are 

stored in a shared drive managed by the Division of Administration and are posted to the 

CFTC’s official YouTube page. 

e. Materials from the event may be posted to CFTC.gov.

 AUTHORITY AND PURPOSE

1) What is the legal authority to collect, use, maintain, and share information in the system?

7 U.S.C. 22(a)(2)-(3).

INFORMATION TYPES

1) What information will be collected, maintained, used, and/or disseminated? 

Identifying Numbers

☐ Social Security Number ☐ Truncated or Partial Social Security Number

☐ Driver’s License Number ☐ License Plate Number

☐ Patient ID Number ☐ File/Case ID Number

☐ Student ID Number ☐ Health Plan Beneficiary Number

☐ Passport Number ☐ Federal Student Aid Number

☐ Employee Identification Number ☐ Taxpayer Identification Number

☐ Professional License Number ☐ Legal Entity Identifier

☐ Credit/Debit Card Number ☐ National Futures Association ID

☐ Personal Bank Account Number ☐ Other ID if it can be traced back to an 

individual

☐ Personal Device Identifiers or Serial Numbers

Contact Information

☐ Personal Mobile Number ☐ Business Phone Number

☒ Personal E-mail Address ☒ Business E-mail Address

☐ Home Phone Number ☐ Personal or Business Fax Number

☐ Home Mailing Address ☐ Business Mailing Address

Sole Proprietors
Page 4 of 9

☐ Business Taxpayer Identification Number ☐ Business Mailing Address

☐ Business Credit Card Number ☐ Business Phone or Fax Number

☐ Business Bank Account Number ☐ Business Mobile Numbers

☐ Business Device identifiers or Serial Numbers ☐ Business Email

Biographical Information

☒ Name ☐ Gender

☐ Date of Birth ☐ City or County of Birth

☐ Country of Birth ☐ Zip Code

☐ Citizenship ☐ Military Service Information

☐ Spouse Information ☐ Academic Transcript

☒ Group/Org. Membership ☐ Resume or Curriculum Vitae

☐ Location Data (e.g., GPS) ☐ Nationality

☒ Employment Information ☐ Marital Status

☐ Mother’s Maiden Name ☐ Children Information

Biometrics/Distinguishing Features/Characteristics

☐ Fingerprints ☐ Height

☐ Retina/Iris Scans ☒ Voice/Audio Recording

☐ Hair Color ☐ Eye Color

☒ Video Recording ☐ Photos

☐ Weight ☐ Signatures

2) What information relating to users of the Whova platform will be collected, maintained, used, 

and/or disseminated? 

Active Directory/Device Information

☒ IP Address ☐ MAC Address

☐ CFTC Asset Number ☒ Device Identifiers or Serial Numbers

☒ User Name / Password ☒ Log data

 COLLECTING INFORMATION

1) How is the information in this system collected?

The CFTC publicizes upcoming events on CFTC websites, social media, and by email. 

Individuals responding to event announcements are directed to register through Whova. 

Attendees will need to create a Whova account (or use their existing account) to register for 

CFTC events. To create a Whova account, users provide their email address, create a 

password, and provide additional information, as required by Whova. Whova does not 

provide this account information to the CFTC. 

Whova requires users to download its mobile application to use all the Whova platform’s

features, and may collect additional information that can be linked to a user or user’s 

device(s) including Internet Protocol addresses, Internet browser type, other characteristics 
Page 5 of 9

of users’ device and software, domain names of users’ Internet Service Provider, approximate 

geographic location, a record of users’ actions in the Whova platform, the time of usage and 

other aggregated information that may help Whova improve its products and services. This 

information is also not shared with the CFTC, except as described below. 

Speakers at CFTC events use a separate video conferencing tool, such as Zoom or WebEx, to 

present. Speakers will initially join a conference “green room” before their session starts; 

conversations in these “green rooms” are not broadcast or recorded. Once the session 

begins, the A/V stream is captured by the Division of Administration’s webcast vendor and 

from there routed to YouTube. Attendees watch the presentations in Whova through a 

YouTube feed embedded in the Whova platform. Recordings of the presentations are stored 

in a shared drive managed by the Division of Administration; recordings will not be saved by 

or shared with Whova or the video conferencing vendor. Speakers may also upload 

presentation materials to the Whova platform, which are then available to all attendees. 

CFTC will receive information generated during each event, including:

a. Which attendees viewed each session and the duration of the viewing; 

b. Which attendees submitted questions using the Whova platform and the content of 

the questions and answers; 

c. Which attendees responded to surveys or live polling and the content of their 

answers; and, 

d. Which attendees posted comments in public forums on the Whova platform and 

content of their comments.

CFTC will not have access to participants’ Whova account profile settings, user device 

information, location, or other technical information generated by their use of the Whova

platform, aside from that mentioned above. CFTC will also not receive information regarding 

which attendees downloaded presentation materials available in the Whova platform. CFTC 

will be provided with an aggregate count of how many private messages were exchanged 

during an event, but will not have access to the parties to these conversations or their 

content. 

2) If any forms are used to collect information that resides in the system, please include the 

name of such form(s) and any applicable control number (i.e. issued by CFTC, OMB, etc.).

No forms are used to collect information that resides in the system. 

INFORMATION USE 

1) Will information in the system be retrieved using one or more of the data elements listed in

Section III? 

Information in Whova can be retrieved by attendee name and email address. 
Page 6 of 9

2) If the information in the system is retrieved using one or more of the identifiers, what CFTC 

System of Records Notice (SORN) covers the information?

Privacy Act records in this system are covered by CFTC-50, LabCFTC and CFTC-53, Mailing, 

Event, and General Contact Lists.

ACCESS AND SHARING

1) With which internal CFTC Offices or Divisions is the information shared? For each Office or 

Division, what information is shared and for what purpose?

Staff from the Division of Administration and the Logistics Office (LO) providing technical 

support (i.e., setting up web-streaming, audio and video recordings) and logistical event 

support, respectively, will have account administrator access to all information across all CFTC 

events hosted using the Whova platform. 

CFTC staff organizing an event will be granted temporary administrator access to the Whova 

platform, and only for the specific event for which they are responsible. Other staff that assist 

in organizing a particular event and have a need to know will have access to the information 

that is extracted from the Whova platform and saved to a CFTC environment, such as a 

SharePoint site. Temporary administrator access will be revoked after necessary post-event 

tasks or analyses are complete and any relevant information in the Whova platform has been 

exported to the CFTC environment. 

To the extent Whova is used in conjunction with in-person CFTC events, information may be 

shared with additional LO staff responsible for event logistics and CFTC security staff. 

Information collected by Whova and shared with the CFTC is intended to help CFTC staff 

understand the number of individuals who registered for and attended the event, how 

engaged attendees were during the event, as well as feedback provided by attendees on the 

quality of the event. 

2) Approximately how many users have access to the system? 

CFTC staff managing event organization, registration, and providing technical support will 

have access to Whova. That number of individuals who register and attend an event will vary 

depending on the specifics of the event. 

3) How is the information shared internally?

Information extracted from Whova will be shared internally through SharePoint sites and 

email. 
Page 7 of 9

4) With which external organization(s) is the information shared?

Attendees can see limited information about each other (e.g., name, title, organization, 

posted comments) in the Whova platform, unless they opt out of this option in their Whova 

profile settings. Recordings of CFTC events and event materials may be made publicly 

available.

5) How is the information shared externally? 

Presentation materials can be downloaded from the Whova platform by attendees, and may 

also be published to CFTC.gov at the close of the event. Audio and video recordings of 

conferences may be posted to the CFTC’s official YouTube account. 

TRANSPARENCY

1) How are individuals notified as to how their information will be collected, used, and/or 

shared within this system? 

Attendees are provided with a Privacy Act statement when registering for a CFTC event. 

Whova also provides its own Privacy Policy, available here. This assessment serves as 

additional notice to the public of the Commission’s use of Whova. 

2) Is a SORN required? If so, explain how the use of the information in this system is 

limited to the use specified in the SORN?

Yes, a SORN is required to maintain information collected and used by Whova. Information 

pertaining to event participants is only used consistent with CFTC-50, LabCFTC and CFTC-53, 

Mailing, Event, and General Contact Lists.

INDIVIDUAL PARTICIPATION

3) Is the information collected directly from the individual?

Yes, information is collected directly from individuals who register for and attend CFTC events 

hosted using the Whova platform. 

4) Is the collection mandatory or voluntary? If voluntary, what opportunities do the 

individuals have to decline to provide information?

Participation in a CFTC event is voluntary. Individuals who choose not to create a Whova 

account may not be able to register for and attend certain CFTC-hosted events. 

5) Do individuals have an opportunity to consent to a particular use of the information? If 

so, how do they provide consent for a particular use?
Page 8 of 9

Attendees may modify their profiles on the Whova platform and opt out of making their 

information visible to other event attendees. 

 DATA MINIMIZATION 

1) What steps were taken to minimize the collection of PII in the system?

The system collects the minimum amount of registration and technical information necessary 

to host and manage virtual CFTC events. 

DATA QUALITY AND INTEGRITY

1) How is data quality ensured throughout the information lifecycle and business processes

associated with the use of the information?

☐ Cross referencing data entries with other systems

☐ Third party data verification

☒ Data taken directly from individuals

☐ Character limits on text submissions

☐ Numerical restrictions in text boxes

☐ Other:

RETENTION

1) What are the retention periods for the information?

Information extracted from Whova by CFTC business units hosting virtual events will be

maintained for seven (7) years after the end of the calendar year in which the event takes

place, in accordance with CFTC records disposition schedules.

SECURITY

1) What types of administrative safeguards protect the information?

☐ Contingency Plan

☒ User manuals for the system

☐ Rules of Behavior

☐ Non-Disclosure or other contractual agreement

☐ Other:
Page 9 of 9

2) What types of physical safeguards protect the information?

☐ Guards

☐ Identification Badges 

☐ Biometric

☐ Cameras

☐ Physically secured space with need to know access

☐ Other: 

3) What types of technical safeguards protect the information?

☒ User Identification

☐ Firewall 

☐ Virtual Private Network (VPN)

☐ Multi-factor Authentication (MFA) 

☒ Passwords

☐ Encryption

☐ De-Identification

☒ Anonymization

☐ Other: 

4) What monitoring, recording, and auditing safeguards are in place to prevent or detect 

unauthorized access or inappropriate use of the information?

Internal CFTC systems such as email servers, SharePoint and network drives are continuously 

monitored to detect unauthorized access as part of CFTC’s security program. Access is limited 

to those with a need to know who understand their responsibilities in handling this 

information to prevent inappropriate use of the information.

Information about Whova’s policies to prevent or detect unauthorized access can be found 

here. 

5) Is this system hosted by a Cloud Service Provider (CSP)? Yes

a. If yes, which one? Whova

b. If yes, has the system obtained a FedRAMP Authorization? No. The Division of 

Administration has determined that use of the Whova platform does not require 

FedRAMP authorization. 

TRAINING

1) What privacy training is provided to users of the system?

All CFTC personnel are subject to CFTC agency-wide procedures for safeguarding personally 

identifiable information and receive annual privacy and security training.