Legal

Privacy Policy

Last updated: March 1, 2026

Eventya is a data processor acting on behalf of DMO customers (data controllers). We collect minimal data, store everything in the EU (Google Cloud Frankfurt), never sell personal data, and comply fully with GDPR. Read the full policy below for details.

1. Who We Are

Company: Eventya CO SRL, incorporated in Romania, CUI RO31611012, J32/408/2013.

Eventya acts as a data processor for customer data (your destination content and end-visitor data), and as a data controller for its own business operations (your account, billing, and support communications).

Contact: privacy@eventya.net | hello@eventya.net

2. Data We Collect and Why

2.1 Data you provide directly

  • Account registration: Name, email address, organisation name, country
  • Billing information: Email, billing address, VAT number — Stripe processes card details
  • Support requests: Email address, message content
  • Content you upload: Text, images, videos, documents for your destination platform

2.2 Data collected automatically

  • Usage data: Pages visited, features used, session duration
  • Device/browser data: Browser type, OS, screen resolution, IP address
  • Cookies: See our Cookie Policy

2.3 End-visitor data

Data from visitors to your destination website/app is processed by Eventya as a data processor on your behalf. See our Data Processing Agreement.

3. Legal Bases for Processing

Processing activityLegal basis
Account creation and platform deliveryContract (Art. 6(1)(b) GDPR)
Billing and invoicingLegal obligation (Art. 6(1)(c) GDPR)
Product improvement and analyticsLegitimate interests (Art. 6(1)(f) GDPR)
Marketing emails (optional)Consent (Art. 6(1)(a) GDPR)
Security and fraud preventionLegitimate interests (Art. 6(1)(f) GDPR)
Processing end-visitor data for customersData processing agreement (Art. 28 GDPR)

4. Data Sharing and Sub-processors

Sub-processorPurposeLocation
Google Cloud PlatformHosting, storage, CDNEU (Frankfurt, Germany)
Twilio Inc.WhatsApp Business API, SMSUSA (SCC)
SendGrid (Twilio)Transactional emailUSA (SCC)
Stripe Inc.Payment processingUSA/EU (SCC)
Google AnalyticsPlatform usage analytics (optional)EU (data residency configured)

For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) and conduct transfer impact assessments.

5. Data Retention

  • Account data: Duration of contract + 90 days
  • Billing records: 10 years (Romanian/EU fiscal law)
  • Support communications: 3 years
  • Usage logs/analytics: 13 months
  • End-visitor data: Set by controller (customer), per DPA

6. Your Rights Under GDPR

You have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Request erasure (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability (Art. 20)
  • Object to processing (Art. 21)
  • Withdraw consent at any time

Contact: privacy@eventya.net. We respond within 30 days. Supervisory authority: ANSPDCP (dataprotection.ro).

7. Security

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Access controls and role-based permissions
  • Regular security assessments and penetration testing
  • Incident response per GDPR Art. 33
  • Employee data protection training

8. Cookies

See our Cookie Policy for full details on which cookies we use and how to manage them.

9. Children’s Data

Eventya is not directed at children under 16. We do not knowingly collect personal data from children.

10. Changes to This Policy

We will notify you by email of material changes and update the “Last updated” date at the top of this page.