Legal
Privacy Policy
Last updated: October 16, 2026
1. Who We Are
Company: Eventya CO SRL, incorporated in Romania, CUI RO31611012, J32/408/2013.
Eventya acts as a data processor for customer data (your destination content and end-visitor data), and as a data controller for its own business operations (your account, billing, and support communications).
Contact: privacy@eventya.net | contact@eventya.net
2. Data We Collect and Why
2.1 Data you provide directly
- Account registration: Name, email address, organisation name, country
- Sign in with Google or Apple (optional): If you choose it, Google or Apple give us your name, your email address (with Apple, possibly a private relay address that forwards to you) and an identifier of your account with them. We use them only to sign you in; we receive no password and nothing else from your Google or Apple account.
- Billing information: Email, billing address, VAT number — Stripe processes card details
- Support requests: Email address, message content
- Content you upload: Text, images, videos, documents for your destination platform
2.2 Data collected automatically
- Usage data: Pages visited, features used, session duration
- Device/browser data: Browser type, OS, screen resolution, IP address
- Bot protection: When you send a form that emails you a code (sign-in, sign-up, account deletion, a Helpdesk request), Google reCAPTCHA reads your IP address and signals from your browser and device to tell people from bots. We keep only its score, in our logs, without your email address.
- Cookies: See our Cookie Policy
2.3 End-visitor data
Data from visitors to your destination website/app is processed by Eventya as a data processor on your behalf. See our Data Processing Agreement.
3. Legal Bases for Processing
| Processing activity | Legal basis |
|---|---|
| Account creation and platform delivery | Contract (Art. 6(1)(b) GDPR) |
| Billing and invoicing | Legal obligation (Art. 6(1)(c) GDPR) |
| Product improvement and analytics | Legitimate interests (Art. 6(1)(f) GDPR) |
| Marketing emails (optional) | Consent (Art. 6(1)(a) GDPR) |
| Security and fraud prevention, including bot protection on forms | Legitimate interests (Art. 6(1)(f) GDPR) |
| Processing end-visitor data for customers | Data processing agreement (Art. 28 GDPR) |
4. Data Sharing and Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Hosting, storage | EU (Frankfurt, Germany) |
| SendGrid (Twilio) | Transactional email | USA (SCC) |
| BugSnag (SmartBear Software) | Error monitoring: technical data about the request during which an error occurred | USA (SCC) |
| Stripe Inc. | Payment processing | USA/EU (SCC) |
| Google Analytics | Platform usage analytics (optional) | EU (data residency configured) |
| Google reCAPTCHA | Bot protection on the forms that send a code by email | USA (Data Privacy Framework, SCC) |
For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) and conduct transfer impact assessments.
5. Data Retention
- Account data: Duration of contract + 90 days
- Billing records: 10 years (Romanian/EU fiscal law)
- Support communications: 3 years
- Usage logs/analytics: 13 months
- End-visitor data: Set by controller (customer), per DPA
6. Your Rights Under GDPR
You have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Request erasure (Art. 17)
- Restrict processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time
Contact: privacy@eventya.net. We respond within 30 days. Supervisory authority: ANSPDCP (dataprotection.ro).
7. Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Access controls and role-based permissions
- Regular security assessments and penetration testing
- Incident response per GDPR Art. 33
- Employee data protection training
8. Cookies
See our Cookie Policy for full details on which cookies we use and how to manage them.
9. Children’s Data
Eventya is not directed at children under 16. We do not knowingly collect personal data from children.
10. Changes to This Policy
We will notify you by email of material changes and update the “Last updated” date at the top of this page.