Privacy policy
Version date: [[FILL IN: version date]]
1. Who we are
Events are organised by two private individuals: [[FILL IN: organiser 1 name]] and [[FILL IN: organiser 2 name]], [[FILL IN: legal address]] (together "we", "the organiser"). We jointly decide why and how your data is processed. We are based in Poland and apply the GDPR (RODO).
Contact for data matters: [[FILL IN: email for data requests]].
2. What data we collect
- Name.
- Email.
- Contact details: phone number, WhatsApp, Telegram name, preferred channel. You give at least one.
- Number of seats, booking code, payment status (pending, paid, expired, cancelled).
- Answers to questions before or after an event (surveys), if you choose to answer.
- Technical data to protect the site: IP address and time of the request in security logs.
We do not receive or store payment data (card numbers, bank passwords). You pay by transfer in your own bank. We only see what appears on our bank account and match the transfer by the booking code.
Data of organisers and operators who work in the closed part of the system (accounts): name, email, role, action log.
3. Why and on what legal basis
| Purpose | What we do | Basis (GDPR) |
|---|---|---|
| Booking | accept the request, hold the seat, confirm | contract or steps before it (Art. 6(1)(b)) |
| Booking communication | send payment instructions, reminders, notice that a seat was released, answer questions | contract (Art. 6(1)(b)) |
| Payment matching | match a transfer to a booking, confirm payment | contract and our legal accounting duties (Art. 6(1)(b), (c)) |
| Running the event | attendee list, organisation, contact on the day | contract (Art. 6(1)(b)) |
| Surveys | learn expectations and feedback | your consent, optional (Art. 6(1)(a)); can be withdrawn |
| Legal duties | accounting and tax records where required | law (Art. 6(1)(c)) |
| Security | protection against spam and attacks, logs | our legitimate interest (Art. 6(1)(f)) |
We do not use your data for advertising and do not sell it. If we want to send news about other events, we will ask separately, with a separate checkbox.
Notifications. We write to you only about your booking and the event you signed up for: confirmation, payment details, reminder, changes, cancellation. We send no promotional mailings about other events without your separate consent.
4. Who we share data with (processors)
We use services that process data on our behalf:
| Service | Purpose | Company and country |
|---|---|---|
| Cloudflare | site hosting, bot protection | [[FILL IN: Cloudflare company and country]] |
| Supabase | database, sign-in | [[FILL IN: Supabase company and country]] |
| Resend (or equivalent) | sending emails | [[FILL IN: email service company and country]] |
| Telegram | bot messages, if you linked a chat | [[FILL IN: Telegram company and country]] |
| WhatsApp (Meta) | only when an organiser writes to you in WhatsApp by hand; this is your personal contact in that messenger | [[FILL IN: WhatsApp company and country]] |
Organisers and operators who need the data for their work can also see it. We may disclose data to public authorities where the law requires it.
5. Transfers outside the EEA
Some of the services above may process data outside the European Economic Area (for example in the USA). In such cases we rely on: [[FILL IN: transfer mechanism outside the EEA]] (EU Standard Contractual Clauses (SCC) or an adequacy decision). You can request a copy of the safeguards at [[FILL IN: email for data requests]].
6. How long we keep data
- Guest data: no longer than 12 months after the event, then deleted or anonymised.
- Contacts of unpaid and expired requests: deleted 30 days after the request expires. Only an anonymous record remains (event, date, number of seats) for statistics. To notice repeated non-payment we may keep an irreversible hash of the email for no more than 12 months.
- Accounting documents, if any: the period required by law. [[FILL IN: accounting retention period]]
- Survey answers: [[FILL IN: survey answers retention period]].
- Security logs and action log: [[FILL IN: logs retention period]].
- Deletion on your request: within 30 days, unless there is a legal reason to keep the data longer.
7. Your rights
You can:
- get a copy of your data (access);
- correct inaccurate data;
- ask us to delete data;
- restrict processing;
- receive your data in a convenient format (portability);
- object to processing based on our legitimate interest;
- withdraw consent at any time (this does not affect past processing).
Write to [[FILL IN: email for data requests]]; we will answer within 30 days. You can also complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
Providing data for a booking is necessary: without a name, email and contact we cannot accept a request.
8. Cookies and local data
There is no advertising, analytics or marketing tracking on the site. Below is the full list of what the site stores in your browser. "Necessary" data is needed for the site to work and for security and does not require consent. Optional categories (analytics, marketing) are off and are not loaded until you allow them; you can change your choice at any time with the "Cookie settings" link at the bottom of the page. Your choice is stored in your browser (key consent, with version and date).
For all visitors
| Name | Purpose | Lifetime | Category |
|---|---|---|---|
__Host-ev_draft (ev_draft in development), cookie | random booking draft number so that what you typed is not lost after an error; contains no name, email or phone | 5 minutes | necessary |
__Host-ev_rcv (ev_rcv in development), cookie | show the "request received" page only to you after submitting a booking | until the browser is closed | necessary |
theme, localStorage | chosen theme (light or dark) | until you clear site data | necessary (setting made by your action) |
consent, localStorage | your cookie choice, version and date | until you clear site data or the policy version changes | necessary |
vs_mic_consent, sessionStorage | remember that you allowed voice recording in a survey | until the tab is closed | necessary (made by your action) |
| Cloudflare Turnstile (script from challenges.cloudflare.com) | bot protection for forms; the service may use technical browser data only for the check | during the check | security (always on) |
| analytics, marketing | no service is connected yet; the banner lists placeholder items that load nothing | not applicable | optional, off |
Categories in the banner: necessary (always on); security (bot protection, Cloudflare Turnstile; always on, shown as a locked switch, because the forms do not work without it); analytics and marketing (off by default, you can switch each on). For analytics and marketing the banner currently shows only temporary placeholder items: no real service is connected, nothing is loaded and no data is collected. They will be replaced by real services after the domain is chosen; this section and the consent version will then be updated and you will be asked again.
Booking cookies are HttpOnly, Secure and SameSite=Lax. The language is set by the page address (/ru/, /ua/, /en/); there is no separate cookie for it. Fonts are hosted on our site; no external font services are used.
Organisers and operators only (closed part, the banner is not shown there)
| Name | Purpose | Lifetime | Category |
|---|---|---|---|
__Host-ev_at, __Host-ev_rt, cookies | sign-in (access and refresh tokens) | 1 hour and 7 days | necessary |
__Host-ev_sid, __Host-ev_la, cookies | server session number and last-activity mark (automatic sign-out when idle) | up to 7 days, removed on sign-out | necessary |
crm_lang, cookie | interface language of the closed part | 1 year | necessary |
ev_crm_last, theme, localStorage | shared activity between tabs; theme | until cleared | necessary |
new-event-draft, rq-t:*, sessionStorage; rq-w:*, localStorage | do not lose typed draft text | until the tab is closed; rq-w:* until cleared | necessary |
On the server (not in your browser): the operator session record (session number and last-activity time, in Cloudflare KV storage) and request counters for spam protection (tied to the IP address, for a short period). This is needed for security (legitimate interest, Art. 6(1)(f)).
9. How we protect data
In plain words:
- the connection to the site is encrypted (HTTPS);
- guest contacts are not visible publicly; only organisers with a personal sign-in can access them;
- organiser sign-in is protected by a password (two-factor protection is planned);
- payment details are not published on the site;
- contacts in lists are partly hidden until an operator needs them;
- data is stored with role-based access limits, and operator actions are logged;
- unneeded data is deleted on a schedule.
If a breach occurs that creates a risk for you, we will inform you and the supervisory authority within the time limits set by law.
10. Photos and filming at events
We take photos at our events. On the site (past event page) we publish general shots and shots with hosts; shots where guests are recognisable only with those guests' consent. A notice about photography is shown in the booking form.
We publish a post-event review only after a staff member checks it, with a name and text (no surname, email or contacts).
To remove your photo or review, write to us in chat or at the contact email: we will remove it from the site and from storage within 7 days.
11. Changes
We may change this text. The current version is always on this page, with the version date.
12. Contacts
[[FILL IN: organiser name]] [[FILL IN: legal address]] Email: [[FILL IN: email for data requests]]