Privacy Policy

[ORGANIZATION NAME]Last Updated: [DATE]

Introduction

Welcome to [Organization Name] ("we," "us," or "our"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you register for and attend our events.

This policy applies to all event attendees who visit our event landing pages at [events.DOMAIN.com] and register to attend events, whether online via [live.DOMAIN.com] or in person.

Data Controller: [Organization Name], [Address], [Country] Contact Email: [[email protected]] Data Protection Officer (if applicable): [DPO Name and Email]

1. Information We Collect

We collect several types of information from and about you:

1.1 Information You Provide Directly

When you register for an event, you provide:

Email address (required)
Full name (required)

After registration, you may optionally provide:

Phone number — collected via the WhatsApp/SMS consent form in the event lobby (waiting room) if the organizer has enabled phone-based notifications, via the public registration form where the organizer has enabled a phone field, or via the notification preferences screen in the mobile app after registering for an event. Providing a phone number is optional and is only necessary if you want to receive SMS reminders. Messages are delivered by SendSMS.ro (Romania). On the public registration form, entering a phone number is itself treated as consent to SMS notifications; see Section 9.1.

1.2 Behavioral and Interaction Data

During a live event we record the following interactions:

Chat messages you send during live events
Poll votes and responses
Offer clicks (when you click on promotional offers during events)
Reactions (emoji reactions you send during live events)
Attendance data including:
- When you joined and left the event
- Whether you attended live or watched the replay
- Total viewing duration
- Session count (if you rejoin)
Q&A questions you submit
Cancellation data (if you cancel your registration): timestamp, where you canceled from (lobby or email), and optionally the reason you provide
Referral sharing activity (if you use share buttons): which channel you shared via (WhatsApp or email), where you shared from (lobby, email, etc.), how many people clicked your share link, and how many registered through it

Where an attendee has not granted behavioural-tracking consent, their chat messages, poll votes, reactions, offer clicks and feedback are still written to the live-session database and remain visible to staff on the live dashboard, and their attendance is still recorded against their registration. Only the granular behavioural event rows in the analytics database are suppressed. Behavioural-tracking consent therefore governs the analytics copy of this data, and its use for engagement scoring and segmentation; it does not prevent the interaction itself from being recorded.

A behavioural-tracking grant is recorded against the organizer's account as a whole, not against a single event. One grant covers every future event run by that organizer until you withdraw it.

GAP-CONSENT-09 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this policy stated that chat messages, poll votes, reactions and offer clicks are collected only where behavioural tracking is consented to, and that the consent is given for a single event at registration. These interactions are in fact always written to the live-session database and are visible to the organizer's staff irrespective of consent, only the analytics copy is gated, and a grant applies across the organizer's whole account until it is withdrawn. This divergence is recorded on the compliance remediation register and is under review.

Automated chat moderation. Every chat message is automatically screened against a word list configured by the organizer for that session. Where a listed word is found, the message is either altered in place — the matching characters are replaced with a fixed-length mask — or, where an obfuscated spelling survives masking, removed from the public chat without notice to you. The original, unmasked text of a removed message is retained together with your display name and the reason for removal, and remains readable by the organizer's staff; it is not deleted automatically. The screening runs when a message is posted; there is no facility to re-screen messages already sent, but the organizer's staff can remove any message manually after the fact, in which case its original text is retained in the same way.

GAP-PROD-02 · PRODUCT — KNOWN GAP, REMEDIATION PENDING

This policy previously described moderation only as a general legitimate-interest purpose and did not disclose that chat messages are screened automatically. Messages may be silently altered or removed without notice to their author, and the original text of a removed message is retained for staff review with no automated deletion. This divergence is recorded on the compliance remediation register and is under review.

1.3 Technical and Attribution Data

We automatically collect the following at registration time. For what we collect from every landing-page visitor before, and independently of, any registration, see Section 1.5.

Anonymous session identifier (web only) — a random identifier (Firebase Anonymous Auth UID) assigned to your browser session for real-time features (chat, polls, reactions). It is stored on our servers: it is written to your registration record in our marketing database, it is stored in the live-session database alongside the display name shown in chat, and the live-session database holds an identity cache mapping it to the hash of your email address, the organizer's account, the event and your registration. The identifier is therefore pseudonymous rather than unlinked. Where you join from more than one device, or rejoin a session, more than one such identifier may exist; only the most recent one is retained on your registration record, which matters for erasure (see Section 8.2).
Firebase Auth UID (mobile app only) — if you authenticate via our mobile app using an email magic link, Firebase Auth assigns a persistent UID to your account. This UID is stored on your contact record in our database and is used to map your mobile app session to your registration. Unlike the anonymous web session identifier above, this UID is linked to your email address via your contact record.
Registration country and city — derived from your IP address using MaxMind GeoLite2, a local database file. Your raw IP address is not stored on your registration record after the lookup; it is retained in security audit logs, it is transmitted to advertising platforms as described in Section 2.4B, and a non-reversible hash derived from it is stored for landing-page visits as described in Section 1.5.
Device type — whether you registered on mobile, tablet, desktop, or a bot, detected from your browser's User-Agent string.
Operating system — iOS, Android, Windows, macOS, or Linux, detected from your browser's User-Agent string.
Browser — Chrome, Firefox, Safari, Edge, Opera, Samsung Internet, or other, detected from your browser's User-Agent string.

Note on raw IP and User-Agent: For geo/device classification (country, city, device type, OS, browser), your raw IP and User-Agent are processed at registration time and only the derived classifications are stored on your registration record. Your raw IP address is not stored there (it is retained in security audit logs, transmitted to advertising platforms as described in Section 2.4B, and hashed for landing-page measurement as described in Section 1.5). Your raw User-Agent string is stored in your attribution metadata, to help measure campaign effectiveness and ad-to-registration matching.

Timezone — your browser's IANA timezone (e.g., "Europe/Bucharest"), sent automatically by your browser at registration time.
Push notification token (FCM token) — if you use our mobile app and grant push notification permission, your device's Firebase Cloud Messaging (FCM) token is stored. This is a pseudonymous device identifier (not your name or email) used solely to deliver push notifications to your device. One account may have tokens for multiple devices. Tokens are deleted when you uninstall the app (Firebase Cloud Messaging reports the token as UNREGISTERED), when you revoke consent, or on a GDPR erasure request. Deletion by age is a retention policy the organizer must configure; as explained in Section 6, no retention policy can currently be saved through the product, so tokens are not deleted by age.
Mobile app authentication token — after authenticating via email magic link, the mobile app stores your Firebase Auth JWT in your device's encrypted secure storage: iOS Keychain on Apple devices, or Android EncryptedSharedPreferences on Android devices. The token expires after 1 hour and is automatically refreshed while you use the app. Uninstalling the app deletes this token from your device; it is not stored on our servers after issuance.

Mobile app authentication: If you use our mobile app, you sign in via email magic link rather than a password. When you enter your email, we send a one-time link to your inbox. The link is single-use and expires after 1 hour. To prevent abuse, magic link requests are rate-limited per originating IP address — or, once you are signed in, per account — and not per email address: ten requests per minute, with a burst allowance of three. The single-use code carried in the link is stored on our servers, as the identifier of a record in our configuration database that holds your plaintext email address; that record is deleted the first time the link is used, but a link that is never used leaves the record in place until a member of staff runs a manual clean-up, for which no schedule exists. As an alternative to the link we can send a 4-digit numeric code. That code is stored in our configuration database together with your plaintext email address until it is used, until it expires after 10 minutes, or until three incorrect attempts invalidate it. We do not share your email with any party solely for the purpose of sending magic links; it is sent via Firebase Auth (Google's infrastructure, EU-region where possible).

Landing page URL (the first page you visited)
Referrer URL (where you came from)
Referral attribution — if you arrived via a share link from another attendee, we record which share link referred you (linking your registration to the sharer's share token). This is used to measure referral effectiveness.
Marketing attribution data:
- UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term)
- Advertising click IDs (fbclid for Meta, gclid for Google, ttclid for TikTok, li_fat_id for LinkedIn). All four are recorded where present in the address you arrive on; only the Meta and TikTok identifiers are transmitted onward to an advertising platform (see Section 2.4B)
- Platform auto-detection based on click IDs
Ad platform conversion data (stored in attribution metadata for server-side conversion tracking):
- Your IP address and User-Agent string at registration time — transmitted in raw, unhashed form to advertising platforms as part of server-side conversion events, to improve match quality (see Section 2.4B). Your raw User-Agent string is also stored in your attribution metadata, as noted above; your raw IP address is not retained on the registration record after the geolocation lookup. Click IDs and cookie values are stored in attribution metadata.
Cookies and tracking identifiers (only written to your device once you consent via the cookie banner):
- Meta Pixel cookies: _fbp, _fbc (browser fingerprint, click ID)
- Google Analytics cookies: _ga, _ga_*, _gid, _gac_* (user ID, session data, ad attribution) — set by Google's client-side scripts in your browser, not collected by our servers
- Microsoft Clarity cookies: _clck, _clsk (first-party pseudonymous user ID and session ID), CLID, MUID, ANONCHK, MR, SM (Microsoft third-party cookies) — set by Clarity's client-side scripts for session recording and heatmap analytics; see Section 4.2 for what data is sent to Microsoft
- TikTok Pixel cookies: _ttp, _ttclid (browser fingerprint, click ID)
- LinkedIn cookie: li_fat_id (member identifier for conversion tracking) — read from your browser into your attribution metadata where present; the platform does not itself deploy a LinkedIn Insight Tag (see Section 4.2A)

Cookie consent is required for these cookies — the identifying advertising and analytics cookies listed above are only written to your device if you click "Acceptă toate" (Accept all) or enable the relevant category in our cookie banner. That is not the same as saying that no tracking script runs before you choose: the Meta Pixel and the TikTok Pixel are classified as strictly necessary and load on every page view in a consent-withheld, cookie-less state, as explained in Section 2.4A.

Tracking is not managed exclusively through Google Tag Manager (GTM). Where the organizer has configured a GTM container, that container is loaded as a necessary technology (the container itself does not set cookies or collect personal data) and applies Google Consent Mode v2, under which all Google consent signals default to "denied" and are updated to "granted" only when you opt in. The Meta Pixel, the TikTok Pixel and Microsoft Clarity are injected directly by our own cookie-consent script and are outside GTM, and an organizer that has configured no GTM container emits no Consent Mode signals at all. See our Cookie Policy for full details.

GAP-CONSENT-11 · CODE — KNOWN GAP, REMEDIATION PENDING

Earlier versions of this policy stated that all tracking scripts are managed through Google Tag Manager under Google Consent Mode v2, and that this ensures no tracking fires before consent is granted. The Meta Pixel, the TikTok Pixel and Microsoft Clarity are injected directly by our cookie-consent script rather than through Google Tag Manager, and Consent Mode signals are emitted only where the organizer has configured a Google Tag Manager container. This divergence is recorded on the compliance remediation register and is under review.

1.4 Information We Do NOT Collect

We do not collect:

Credit card details, bank account details or any other payment instrument data
Government-issued ID numbers
Sensitive categories of data (health, religion, political opinions, etc.)

One qualification applies to the first item. As described in Section 1.6, where the organizer connects its online store to the platform we may receive the identifier, total amount, currency and payment status of an order you placed with that store. No card or other payment instrument data is received.

1.5 Information We Collect Before You Register

Some data is collected from every visitor to an event landing page, whether or not that visitor goes on to register:

Persistent visitor identifier. Each landing page contains a 1×1 transparent image beacon that our server uses to count unique visitors. When your browser loads it, our server derives a non-reversible identifier by hashing your IP address together with your User-Agent string, and stores that identifier against the page and the date. The hash is stable over time — the same browser on the same connection produces the same value on every visit — so it is a persistent pseudonymous identifier and not merely an anonymous count. Traffic identified as automated is filtered out by User-Agent. This measurement is not gated on a cookie-banner choice and is relied on as a legitimate interest (Art 6(1)(f)). These records carry no link to a contact record, are not reached by an erasure request, and are subject to no automated retention period; they are removed only when the organizer deletes the funnel or the page in question. The same identifier is recorded when you follow one of our tracked links.
Server-side page-view event to Meta. Independently of the browser pixels, a server-side Meta Conversions API PageView is sent for every human visitor to a funnel landing page where the organisation has enabled the Meta integration. It carries the visitor's raw IP address, raw user agent, the page URL, the fbclid click identifier and the _fbp / _fbc cookie values where these are present; where the cookie is absent — which is the case for a visitor who has not accepted advertising cookies — the click identifier alone is used to reconstruct an fbc value. There is no consent check on this path; the only condition is that the organisation has enabled the Meta integration.
Onward disclosure through tracked links. Where you follow a tracked link on one of our pages, the campaign parameters and advertising click identifiers associated with your visit — utm_source, utm_medium, utm_campaign, utm_content, utm_term, fbclid, gclid, ttclid, li_fat_id, and the referral source — are appended to the destination address. Where the organizer has configured a destination on a third-party site, that site's operator receives those parameters. Where a core campaign parameter is missing, it is filled with a value derived from the funnel's name.

GAP-TRACK-01 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously described technical data as collected "at registration time" and disclosed no measurement of visitors who do not register. A persistent pseudonymous identifier derived from the IP address and User-Agent is in fact recorded for every landing-page visitor, a server-side page-view event is transmitted to Meta for every such visitor where that integration is enabled, and neither is subject to a consent gate, to an automated retention period or to the erasure pipeline. This divergence is recorded on the compliance remediation register; the classification is under review.

1.6 Information We Receive from Other Sources

Where the organizer has connected another system to the platform, we may receive personal data about you from that system rather than from you directly:

Order and payment status from the organizer's online store. Where the organizer connects an e-commerce platform — for example MerchantPro or WooCommerce — we receive order notifications containing the customer's email address, the order identifier, the total amount, the currency and the payment status. Your email address is hashed and used to match the order to your existing contact record, and the order identifier, amount, currency and payment status are then stored against that record as campaign-attribution metadata. This is purchase and transaction data about you, sourced from the organizer's store rather than collected from you here.
Form submissions from third-party form providers. Where the organizer connects a third-party form tool or a generic webhook sender, the entire submitted payload is stored as attribution metadata against your entry. That payload may contain arbitrary free-text answers you gave on the third-party form.
Delivery and engagement outcomes from our email provider — see Section 2.1.
Contact records imported in bulk by the organizer — see Section 9.1.

GAP-DATA-01 · DOCS — KNOWN GAP, REMEDIATION PENDING

This policy previously described only data you provide to us or that is collected from your browser, and stated without qualification that we do not collect payment information. Order identifiers, totals, currencies and payment statuses received from the organizer's online store, and complete payloads received from third-party form providers, are matched to your contact record and retained as attribution metadata. This divergence is recorded on the compliance remediation register and is under review.

2. How We Use Your Information

We use your personal data for the following purposes:

Provide access to the event room
Display your name in the attendee list and chat
Send registration confirmation emails
Send event reminder emails (1 hour before start, "starting now")
Send replay availability notifications
Provide technical support
Track email delivery status — we record whether each email we send to you was delivered, bounced, opened, or clicked. This is standard email delivery infrastructure (provided by our email service NewsmanApp SRL) used to ensure emails reach you and to detect delivery problems. We store: send timestamp, delivery status (delivered/bounced/spam/rejected), and engagement events (opened, clicked, unsubscribed). In our marketing database this data is linked to your hashed email address, not your plaintext email; the email provider necessarily holds your plaintext address. Where the provider reports a bounce or a spam complaint, that outcome is written to your contact record as a permanent suppression flag, with the reason recorded, so that we stop sending to you; the flag is subject to no automated retention period.
Synchronise your contact details with our email provider — where you have granted marketing-email consent, a scheduled job transmits your plaintext email address, first name and last name to NewsmanApp SRL in bulk, and adds you to and removes you from the segments held there. Marketing-email consent gates exactly this synchronisation and nothing else; see Section 2.3.
Re-issue an email at a staff member's request — a member of the organizer's staff can, at any time after you register, re-send your registration confirmation or re-send an individual message previously sent to you. Each re-issued message contains freshly generated personalised links for joining the event, cancelling your registration and managing your notification preferences. These actions are recorded in our audit log.

This processing is necessary to deliver the event service you registered for.

If you consent to behavioral tracking:

Analyze your engagement level (chat activity, poll participation, offer interest)
Create engagement scores for sales qualification
Segment attendees based on behavior (e.g., "highly engaged," "showed interest in Product X")
Generate analytics reports for our marketing team

This consent is recorded once, against the organizer's account, and applies to every event that organizer runs until you withdraw it; it is not collected afresh for each event. As explained in Section 1.2, it governs the analytics copy of your event interactions and their use for scoring and segmentation. The interactions themselves are recorded in the live-session database either way.

You can withdraw this consent at any time.

If you consent to marketing emails:

Send information about future events
Send educational content related to event topics
Send promotional offers and product updates

Scope of this consent. Marketing-email consent gates exactly one thing: whether your contact details are synchronised into the marketing lists and segments held by our email provider. Every other email path — registration confirmation, reminders, "starting now", replay availability, automation emails, staff re-sends and one-off segment broadcasts — runs on a transactional gate alone, which checks only that you are not subject to a restriction of processing under Art 18 and that your address has not been suppressed for a bounce, a spam complaint or a global opt-out. In particular, the organizer can compose a one-off message and send it to the members of a saved segment without any marketing-consent check, and the platform provides a segment condition that selects precisely those contacts who hold no active grant for a given purpose. Unsubscribing from marketing email withdraws the consent but does not set the suppression flag, so an unsubscribed contact remains within the audience of such a broadcast.

GAP-CONSENT-07 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously presented marketing consent as the gate on all non-transactional email. The one-off segment broadcast path deliberately does not check marketing consent, and the segmentation tool can be used to build an audience of contacts who have not granted it; the only enforced limits are the Article 18 restriction and the bounce, complaint and global opt-out suppression flags. The lawful basis for messages sent on that path is determined by the organizer as controller. This divergence is recorded on the compliance remediation register; the classification is under review.

You can unsubscribe at any time via the link in every email.

If you use our mobile app and grant push notification permission at the OS level:

Transactional push (legal basis: consent, Art 6(1)(a), in combination with the operating-system permission): We send push notifications for events directly related to the service you registered for — registration confirmation, event reminders (approximately 15 minutes before start), "event is starting now", and replay availability. These are the push equivalents of transactional emails. They are not sent on the strength of your data processing acceptance alone: every transactional push is gated on a separate push_notifications consent held against your contact record, in addition to the operating-system permission. Where that consent is absent or has been withdrawn, no push notification is sent.
Marketing push (legal basis: consent, Art 6(1)(a)): The push_marketing opt-in is offered on the notification preferences screen in the app after registering for an event, and is recorded against your contact record. No marketing push notification is currently sent — the platform records this consent but implements no marketing push path.

The operating-system push permission (granted via your device's system prompt) and the consent records held against your contact are independent:

Granting the OS permission and holding a push_notifications consent enables transactional push
Adding a push_marketing consent would additionally enable marketing push, once that path exists
Denying the OS permission disables all push notifications (platform-enforced)

GAP-CONSENT-06 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that transactional push requires no consent beyond the initial data processing acceptance and the operating-system permission, and named legitimate interest as its legal basis. Transactional push is in fact gated on a distinct push_notifications consent purpose, which this policy did not name, while push_marketing is recorded and displayed but gates nothing because no marketing push path is implemented. This divergence is recorded on the compliance remediation register; the classification is under review.

You can withdraw push_notifications and push_marketing consent at any time via the app's notification preferences settings (see Section 9.2). Withdrawing push_notifications stops transactional push as well as marketing push.

Silent consent sync: When you revoke data processing or push-related consent, our system may send a silent (non-visible) push notification to your device to instruct the mobile app to refresh your consent state. This is a system-level technical message — it does not appear in your notification center, makes no sound, and does not require additional consent. Its sole purpose is to ensure the app reflects your latest consent preferences without waiting for your next app launch.

If you provide your phone number and consent to SMS communications:

Notifications: Send event reminders, "starting now" and "replay available" messages, and SMS steps forming part of an automated follow-up sequence
Marketing: The sms_marketing opt-in is recorded but currently gates nothing; no separate SMS marketing path is implemented

An SMS is dispatched only where the contact holds a granted, unrevoked sms_notifications consent and is not subject to an Art 18 processing restriction. Messages are delivered by SendSMS.ro. The message body contains the event title, the time remaining until start or the replay deadline, and a link that is unique to you and records when it is followed.

whatsapp_notifications and whatsapp_marketing are offered as consent options in the event lobby and on the preferences screen and are recorded against your contact record, but no WhatsApp message is sent: the platform implements no WhatsApp delivery channel. Where a "WhatsApp" option appears in a share menu, it opens WhatsApp on your own device so that you can forward a link; it is not a message sent by us.

The separate-consent statement in earlier versions of this policy does not hold on every route. In the event lobby the WhatsApp and SMS checkboxes are presented separately, but they are pre-selected according to the channels the organizer has enabled. On the public registration form there are no channel checkboxes at all: entering a phone number is itself recorded as consent to SMS notifications, and ticking the marketing-email checkbox additionally records consent to SMS marketing. You can withdraw consent for any combination at any time.

GAP-CONSENT-04 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that each channel and each purpose requires a separate consent, and described WhatsApp as an available channel. Consent to SMS notifications is in fact inferred from the presence of a telephone number on the public registration form, the marketing-email checkbox extends to SMS marketing, the lobby checkboxes are pre-selected rather than presented unticked, and no WhatsApp message can be sent because no WhatsApp delivery channel exists. This divergence is recorded on the compliance remediation register; the classification is under review.

Note for mobile app users: If you interact with our mobile app, the above consent purposes may be collected and stored during the app's onboarding flow or post-registration preferences screens in addition to (or instead of) the web registration flow. The same GDPR rights and withdrawal mechanisms apply regardless of how consent was collected.

2.4 Advertising Attribution and Conversion Tracking

A) Client-side tracking (Legal Basis: Consent — GDPR Art 6(1)(a), subject to the qualification below)

Where the organizer has configured them, Google Analytics and Microsoft Clarity load in your browser only after you accept the corresponding cookie category. The Meta Pixel and the TikTok Pixel do not.

The Meta Pixel and the TikTok Pixel are classified as strictly necessary scripts and are therefore loaded on every page view, before and irrespective of the visitor's cookie-banner decision. Each sends a single page view to Meta and to TikTok respectively at that point, so both platforms receive the visitor's IP address, user agent and page URL before any consent is given. Both are loaded in a consent-withheld state — fbq('consent','revoke') for Meta and ttq.holdConsent() for TikTok — which is intended to prevent the identifying advertising cookies (_fbp, _fbc, _ttp, _ttclid) from being written until the visitor accepts the advertising category, at which point the consent state is flipped to granted. The absence of a cookie is the basis on which these scripts are currently classified as necessary; it is not a determination that the pre-consent load is permitted under Article 5(3) of the ePrivacy Directive, and the classification is under review.

GAP-CONSENT-01 · CODE — KNOWN GAP, REMEDIATION PENDING

This document previously stated that the Meta and TikTok pixels load only where the attendee accepts advertising cookies. Both pixels are in fact classified as necessary and fire a page view before any consent decision, in a configuration intended to be cookie-less until advertising consent is granted. This divergence is recorded on the compliance remediation register; the classification is under review.

Accepting the advertising category upgrades both pixels to full cookie-based tracking, enabling cross-site retargeting and attribution. The platform does not deploy a LinkedIn Insight Tag of its own; where an organizer pastes one into its own tracking-script configuration, it is loaded under the advertising category like any other advertising script.

B) Server-side conversion measurement (Legal Basis: Legitimate Interest — GDPR Art 6(1)(f))

Two distinct server-to-server transfers take place. Neither places or reads cookies on your device.

On registration. When you register for an event, our server sends a registration conversion event to Meta and to TikTok, where the organizer has enabled those integrations, to measure ad campaign effectiveness. We send:

SHA-256 hashes of your email address, your first name and your last name — never plaintext. No telephone number is transmitted on this path: the field is left empty when the event is assembled, whatever number is on file
Your registration identifier, used as the external_id matching key. TikTok receives it hashed; Meta receives it unhashed
The click identifier (fbclid or ttclid) if you arrived via an ad click, and the _fbp, _fbc or _ttp cookie values where these are present
Your IP address and user agent, transmitted in raw, unhashed form, together with the page URL and the referrer

The TikTok integration has been live since 8 May 2026. No equivalent transfer is made to Google Ads or to LinkedIn: neither integration is implemented and no data reaches either recipient.

On every landing-page visit. Independently of the browser pixels, a server-side Meta Conversions API PageView is sent for every human visitor to a funnel landing page where the organisation has enabled the Meta integration. It carries the visitor's raw IP address, raw user agent, the page URL, the fbclid click identifier and the _fbp / _fbc cookie values where these are present; where the cookie is absent — which is the case for a visitor who has not accepted advertising cookies — the click identifier alone is used to reconstruct an fbc value. There is no consent check on this path; the only condition is that the organisation has enabled the Meta integration.

Why we do this: To measure which ad campaigns lead to registrations, optimize marketing spend, and reduce wasted advertising budget. A person who clicks an ad and registers reasonably expects the advertiser to measure whether the ad was effective. That expectation is materially weaker for a visitor who merely opens a landing page and does not register, and the balancing test for the page-view transfer described above is under review.

Your rights: You can object to this processing at any time under GDPR Art 21 by contacting us (see Section 8.5, Right to Object, and Section 14, Contact Us). If you exercise your right to restriction of processing (Art 18), server-side conversion events are suppressed for your account.

GAP-CONSENT-05 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously described server-side conversion measurement as occurring only when you register, as sending hashed email and name to four advertising platforms, and as processing your IP address and user agent transiently. A server-side page-view event is in fact transmitted to Meta for every landing-page visitor, irrespective of registration and of consent; the registration event carries a further hashed identifier and transmits your IP address, your user agent and — to Meta — your registration identifier unhashed; and no data reaches Google Ads or LinkedIn, whose integrations do not exist. This divergence is recorded on the compliance remediation register; the classification is under review.

Prevent spam and abuse in event chat
Detect and prevent fraudulent registrations (e.g. bot registrations via device type detection)
Protect our systems from security threats
Investigate moderation incidents
Understand where our audience comes from geographically (country and city), on which devices and browsers they register, and in which timezones they are located — to improve the event platform, schedule events at optimal times, and measure audience reach

Our legitimate interest in platform security and product analytics outweighs the minimal privacy impact of storing country-level location and broad device/browser/timezone categories.

Note: We do not store your raw IP address on your registration record — it is retained in security audit logs, and it is transmitted to advertising platforms as described in Section 2.4B. Your raw User-Agent string is stored in your attribution metadata, as noted above. Beyond that we store derived classifications: country (ISO code), city name, device type (mobile/tablet/desktop), OS family (iOS/Android/Windows/macOS/Linux), browser family (Chrome/Firefox/Safari/Edge), and IANA timezone (e.g. Europe/Bucharest). Taken individually these classifications are broad, but they are stored against your contact record and are therefore personal data relating to you, not anonymous statistics. Separately, as described in Section 1.5, a persistent identifier derived from your IP address and User-Agent is stored for every landing-page visit.

3. Legal Basis Summary

Purpose	Legal Basis	Can You Opt Out?
Data processing for event delivery	Contract performance (Art 6(1)(b))	No (required for service delivery)
Terms of Service acceptance	Contract performance (Art 6(1)(b))	No (required for service delivery)
Event access and delivery	Contract performance (Art 6(1)(b))	No (required for service)
Registration confirmation emails	Contract performance	No (required for service)
Event reminder emails	Contract performance	No (required for service)
Behavioral tracking and analytics	Consent (Art 6(1)(a)) — gates the analytics copy only; the live-session record is not gated (Section 1.2)	Yes (checkbox on registration). The grant applies to the organizer's whole account until withdrawn, not to one event
Marketing emails about future events	Consent (Art 6(1)(a)) — gates synchronisation into our email provider's marketing lists only	Yes (checkbox on registration). One-off segment broadcasts are not gated on this consent — see Section 2.3
SMS event notifications (`sms_notifications`)	Consent (Art 6(1)(a))	Yes — pre-selected checkbox in the lobby, requires a phone number; on the public registration form the consent is inferred from the phone number itself (Section 2.3.2). No WhatsApp message is sent
SMS marketing messages (`sms_marketing`)	Consent (Art 6(1)(a))	Yes — recorded but currently gates nothing; no SMS or WhatsApp marketing path is implemented
Push notifications — transactional (mobile app)	Consent (Art 6(1)(a)) via the `push_notifications` purpose, in combination with the OS push permission	Yes — withdrawing `push_notifications` stops all transactional push (Section 2.3.1)
Push notifications — marketing (mobile app)	Consent (Art 6(1)(a))	Yes (`push_marketing` opt-in in mobile app notification preferences). Recorded but currently gates nothing; no marketing push path is implemented
Ad conversion tracking — client-side (pixels)	Consent (Art 6(1)(a)) for the advertising cookies. The Meta and TikTok pixel loads are classified as strictly necessary and occur before any consent decision — the ePrivacy Art 5(3) position on that load is under review (Section 2.4A)	Yes for the cookies (advertising category). No, for the pre-consent pixel load
Ad conversion tracking — server-side (Meta and TikTok)	Legitimate interest (Art 6(1)(f))	No (server-to-server; hashed identifiers plus raw IP address and user agent; opt-out via Art 21 objection). A server-side page view is additionally sent to Meta for every landing-page visitor — see Section 2.4B
Security and fraud prevention	Legitimate interest (Art 6(1)(f))	No (essential security)
Unique-visitor measurement on landing pages, before registration	Legitimate interest (Art 6(1)(f))	No — see Section 1.5
Registration geo/device enrichment (country, city, device type, OS, browser, timezone)	Legitimate interest (Art 6(1)(f))	No. These are broad classifications, but they are stored against your contact record and are personal data relating to you

We do not sell your personal data to third parties. We share your data only with the following recipients:

4.1 Service Providers (Data Processors)

We use trusted third-party service providers to operate our platform:

Provider	Purpose	Location	Safeguards
[PLATFORM PROVIDER] (fill in: e.g., "[PLATFORM PROVIDER]" or "our event platform provider")	Event platform hosting, database storage, push notification infrastructure, GDPR tools	EU	Data Processing Agreement, ISO 27001 (pending)
Google Cloud / Firebase ([Platform Provider]'s infrastructure)	Real-time database, attendee authentication, cloud functions, file storage	EU — cloud functions in europe-west3, the live-session database in europe-west1 and the configuration database in the EU multi-region	Google Cloud DPA, Standard Contractual Clauses
Google Firebase (our mobile app's Firebase project)	Push notification delivery to mobile app users (Firebase Cloud Messaging). We use our own Firebase project to send push notifications to your device.	Global (Google FCM infrastructure, USA-based)	Google Cloud DPA (between [Organization Name] and Google), Standard Contractual Clauses, EU-US Data Privacy Framework
Railway (via [Platform Provider])	Database hosting, API hosting	EU region	SOC 2 Type II. ⚠️ Railway's data processing terms have been requested and have not been obtained, so no data processing agreement is on file
NewsmanApp SRL (via [Platform Provider])	Transactional and marketing email delivery; bulk synchronisation of contact details (plaintext email address, first and last name) and segment membership; return of open, click, bounce, spam-complaint and unsubscribe outcomes. On an erasure request your email address is retained here on a permanent suppression list — see Section 8.2	EU (Romania)	Newsman DPA, GDPR-compliant
Cloudflare, Inc.	Mandatory reverse proxy and TLS termination in front of all attendee traffic in production, CDN caching for event landing pages, and — where the organizer enables it — the Turnstile bot-protection challenge on registration forms. Cloudflare therefore sees every attendee request, including the contents of registration submissions (email address, name and telephone number), and for traffic passing through Cloudflare the client IP address we record or forward is the one Cloudflare supplies in a request header. Turnstile verification transmits your IP address to Cloudflare.	Global (Anycast network)	Cloudflare DPA, Standard Contractual Clauses
SendSMS.ro (via [Platform Provider])	SMS delivery of event reminders, "starting now" and replay messages, and of SMS steps in automated sequences. Receives your telephone number in plaintext together with the full message body	EU (Romania); onward delivery via your mobile network operator	TLS in transit; per-organizer credentials. ⚠️ Data Processing Agreement not on file. ⚠️ Credentials and message parameters are transmitted as URL query-string parameters, so the telephone number and the message body should be assumed to appear in the provider's request logs
Anthropic PBC (via [Platform Provider])	AI generation of landing-page copy, landing-page markup and poll questions, initiated by the organizer's staff. Where you have submitted a testimonial that staff have approved, the name recorded on it, your quote, your company and your rating are included in the text sent to the model provider (up to ten such testimonials per generation). Apart from any reference page addresses or screenshots the organizer's staff supply, no other attendee data is sent; no cookies are set, and your device never contacts this provider	USA	⚠️ Transfer mechanism and Data Processing Agreement to be confirmed. There is no consent gate on this path, and the stored prompts are not reached by an erasure request — see Section 8.2
Google LLC (YouTube)	Video playback where the organizer hosts the event stream on YouTube, embedded on the watch page without a consent gate	USA / global	Google Cloud DPA, Standard Contractual Clauses, EU-US Data Privacy Framework. ⚠️ This load occurs before and irrespective of any consent decision — see Section 10.4

GAP-DOC-02 · DOCS — KNOWN GAP, REMEDIATION PENDING

This table previously named six recipients and described Cloudflare as an optional content-delivery cache. It omitted the SMS messaging provider, which receives attendees' telephone numbers in plaintext, the AI model provider, which receives approved attendee testimonials, and Google's video service, which receives visitors' IP addresses and user agents. Cloudflare is not optional: in production it terminates TLS for all attendee traffic and sees the contents of every registration submission. This divergence is recorded on the compliance remediation register and is under review.

4.2 Advertising and Analytics Platforms (Data Recipients)

We use third-party advertising and analytics tools that process your data. Most of them act only where you consent; the exceptions are identified below. There are two types of data sharing:

A) Client-Side Tracking (Cookies/Pixels) — Cookie Consent Required for the Cookies

Where the organizer has configured them, the following platforms' scripts collect data directly from your browser. Google Analytics and Microsoft Clarity load only if you accept the corresponding cookie category. The Meta Pixel and the TikTok Pixel load on every page view irrespective of your choice, in the consent-withheld state described in Section 2.4A; accepting the advertising category upgrades them to full cookie-based tracking.

Platform	Purpose	Data Collected	Location	Privacy Policy
Meta Pixel (Facebook/Instagram)	Conversion tracking, retargeting. Loads on every page view before any consent decision — see Section 2.4A	Before consent: page view, IP address, user agent, page URL, with no cookie written. After you accept the advertising category: additionally the browser fingerprint cookies (`_fbp`, `_fbc`) and button clicks	USA	Meta Privacy Policy, Standard Contractual Clauses
Google Analytics / Google Ads	Website analytics, conversion tracking — not deployed by the platform. No Google Analytics tag is emitted by us; Analytics reaches your browser only through a Google Tag Manager container the organizer configures, or a script the organizer pastes into its tracking-script settings. No conversion event is sent to Google Ads	Where the organizer deploys it: user ID (`_ga`, `_ga_*`, `_gid` cookies), page views, session data, IP address, user agent. Whether the IP address is truncated, and every other Analytics setting, is determined by the organizer's own tag configuration and not by us	USA	Google Privacy Policy, Standard Contractual Clauses
Microsoft Clarity	Session recordings, heatmaps, behavioral analytics (rage clicks, scroll depth)	Pseudonymous user/session ID (`_clck`, `_clsk`, `CLID`, `MUID`, `ANONCHK`, `MR`, `SM` cookies), interaction events (mouse/clicks/scrolls — form inputs always masked, text masked per masking mode), page URL, IP address, user agent	EU (Microsoft Ireland) with onward transfer to USA (Microsoft Corporation) under SCCs	Microsoft Privacy Statement, Standard Contractual Clauses, EU-US Data Privacy Framework
TikTok Pixel	Conversion tracking, retargeting. Loads on every page view before any consent decision — see Section 2.4A	Before consent: page view, IP address, user agent, page URL, with no cookie written. After you accept the advertising category: additionally the browser fingerprint cookies (`_ttp`, `_ttclid`)	USA	TikTok Privacy Policy, Standard Contractual Clauses
LinkedIn Insight Tag	Conversion tracking, retargeting — not deployed by the platform. We emit no Insight Tag; the tag runs only where the organizer has pasted one into its own tracking-script configuration, in which case it loads under the advertising category	Member identifier (`li_fat_id` cookie), page views, IP address, user agent — only where the organizer has added the tag. The `li_fat_id` cookie value is read into your attribution metadata where advertising consent has been granted	USA	LinkedIn Privacy Policy, Standard Contractual Clauses

How to control: Accept or decline categories via our cookie banner. You can change your choice at any time via the cookie settings button (floating button or footer link), which is available on our landing, registration and lobby pages but is removed from the live watch page — see Section 8.7. Where the organizer has configured a Google Tag Manager (GTM) container, the Google tags in that container are governed by Google Consent Mode v2 on a deny-by-default footing. The Meta Pixel, the TikTok Pixel and Microsoft Clarity are loaded directly by our own cookie-consent script rather than through GTM, and the two pixels load before any consent decision as described in Section 2.4A.

Note on Microsoft Clarity (independent data controller): Microsoft acts as an independent data controller for the data Clarity collects (not as a processor acting on our behalf). This means Microsoft determines the means and purposes of its processing of Clarity data under its own privacy terms. EU users' data is collected under a contract with Microsoft Ireland Operations Limited (MIOL); onward transfer to Microsoft Corporation (USA) is covered by Standard Contractual Clauses between Microsoft affiliates. We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve our events and services. Website usage data is captured using first and third-party cookies and other tracking technologies. Additionally, Microsoft may use this information for site optimization, fraud/security purposes, and its own advertising. For more information, see the Microsoft Privacy Statement.

B) Server-Side Conversion Tracking — Legitimate Interest (No Cookie Consent Required)

Our server sends events to the following platforms. This is a server-to-server transfer (no cookies placed or read on your device) and is based on legitimate interest (GDPR Art 6(1)(f)) — see Section 2.4B above, which distinguishes the registration event from the landing-page event.

Platform	Purpose	Data Sent	Location	Safeguards
Meta Conversions API	Match ad clicks to registrations, and count landing-page views	On registration: hashed (SHA-256) email address, first name and last name; the registration identifier unhashed, as the `external_id` matching key; our internal event, session and funnel identifiers with a zero value and currency code; click ID (`fbclid`); cookie values (`_fbp`, `_fbc` if set); raw IP address and raw user agent. No telephone number is sent. On every landing-page visit (no consent check, no registration required): raw IP address, raw user agent, page URL, `fbclid`, and `_fbp` / `_fbc` where set	USA	Meta Business Tools Terms, Standard Contractual Clauses
Google Ads API	Match ad clicks to registrations — not implemented. No server-side conversion is sent to Google Ads	None. No data reaches this recipient	—	Not applicable while the integration is absent
TikTok Events API	Match ad clicks to registrations — active since 8 May 2026	Hashed (SHA-256) email address, first name, last name and registration identifier — no telephone number is sent; our internal event, session and funnel identifiers with a zero value and currency code; raw IP address, raw user agent, raw `ttclid` click identifier and raw `_ttp` cookie value; page URL and referrer	USA / Singapore	TikTok Business Products Terms. ⚠️ Standard Contractual Clauses requested but not executed
LinkedIn Conversions API	Match ad clicks to registrations — not implemented. No server-side conversion is sent to LinkedIn	None. No data reaches this recipient	—	Not applicable while the integration is absent

Why both? Client-side tracking (A) enables cross-site retargeting and attribution, which depends on the advertising cookies and therefore on your consent. Server-side tracking (B) is not affected by ad blockers or browser restrictions and gives more complete conversion measurement; it is operated under legitimate interest rather than consent, and that basis is subject to your right to object under Art 21.

Note: We use SHA-256 hashing to protect your email address and name before sending them to advertising platforms; no telephone number is sent to them at all. Your IP address and user agent are transmitted unhashed, as is the registration identifier sent to Meta. These platforms may match the hashed data to their user databases for attribution purposes. You can object to this processing at any time (see Section 8.5, Right to Object, and Section 14, Contact Us).

C) Ad Platform Exclusion Lists — Not Implemented

We do not upload hashed email addresses to any advertising platform as a negative audience or exclusion list, and no such audience is maintained.

The controls that do exist are narrower. Withdrawing marketing consent, and a restriction of processing under Art 18, suppress future server-side conversion events for your contact record; an erasure request removes your contact record from our systems. None of these reaches an advertising platform's own systems, and none of them prevents an advertisement from being shown to you. To stop seeing an organizer's advertisements you must use the controls provided by the advertising platform itself.

Platform	Purpose	Data Sent	Legal Basis
Meta Custom Audiences	Exclusion from ad targeting — not implemented; no audience is created or uploaded	None	Not applicable while the processing does not occur

GAP-CONSENT-08 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that hashed email addresses are uploaded to Meta Custom Audiences as negative audiences, so that people who have registered, withdrawn marketing consent or requested erasure are excluded from advertising. No such upload exists anywhere in the platform, and no advertising platform is contacted on withdrawal or on erasure. This divergence is recorded on the compliance remediation register and is under review.

4.3 Internal Teams

Your data may be accessed by:

Marketing team (to analyze event performance and follow up with leads)
Sales team (to contact highly engaged attendees, if you consented to marketing)
Technical support (to assist with access issues)

The organizer's staff can also export a segment's members from the platform as a file containing plaintext email addresses and names. The export is recorded in our audit log, but once the file has left the platform the retention and deletion controls described in this policy no longer apply to it. The export is not gated on marketing consent. Contacts subject to a restriction of processing under Art 18 are always excluded; suppressed contacts (bounce, spam complaint or global opt-out) are included only where the staff member explicitly asks for them.

4.4 Legal Obligations

We may disclose your data if required by law:

Court orders or legal process
Regulatory investigations
Protection of our legal rights

5. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States:

Google Cloud / Firebase: US-based company, but we use EU region data centers. Google is certified under the EU-US Data Privacy Framework and provides Standard Contractual Clauses (SCCs).
Meta and TikTok: US-based advertising platforms that receive the server-side events described in Section 2.4B and the browser-pixel events described in Section 2.4A. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for the Meta transfers. ⚠️ For TikTok, Standard Contractual Clauses have been requested but are not executed, although the server-side integration has been transmitting data since 8 May 2026. No transfer is made to Google Ads or LinkedIn: neither integration is implemented.
Anthropic PBC: US-based provider of the AI generation features described in Section 4.1. ⚠️ The transfer mechanism for this recipient has not been established and is under review.
YouTube (Google LLC): where the organizer hosts the event stream on YouTube, your browser contacts Google directly. Google is certified under the EU-US Data Privacy Framework and provides Standard Contractual Clauses. These requests are made before and irrespective of any consent decision — see Section 10.4.
SendSMS.ro: message submission is to an endpoint in Romania (EU); no transfer outside the EEA arises on this path.
Microsoft Clarity: EU users contract with Microsoft Ireland Operations Limited (MIOL, EU-based). Onward transfer to Microsoft Corporation (USA) is covered by Standard Contractual Clauses between Microsoft affiliates. Microsoft is certified under the EU-US Data Privacy Framework.

Safeguards: Non-EU transfers are intended to be protected by legally binding agreements (Standard Contractual Clauses) together with additional security measures (encryption, hashing). ⚠️ As noted above, the instruments covering the TikTok and Anthropic transfers are not on file.

GAP-CONTRACT-02 · CONTRACT — KNOWN GAP, REMEDIATION PENDING

This section previously stated that all non-EU transfers are protected by Standard Contractual Clauses, and named Google Ads and LinkedIn among the recipients. Data has been transmitted to TikTok since 8 May 2026 without executed Standard Contractual Clauses on file; transfers to the AI model provider have no established transfer mechanism; and no data reaches Google Ads or LinkedIn at all. This divergence is recorded on the compliance remediation register and is under review.

Your Rights: You have the right to obtain a copy of the SCCs we use. Contact us at [[email protected]].

6. How Long We Keep Your Data

We retain your personal data only as long as necessary for the purposes outlined above:

Data Type	Retention Period	Reason
Contact information (email, name)	As long as you are an active participant on the platform (e.g., you have registered for an event). You may request deletion at any time (Section 8.2).	Legitimate interest in ongoing service delivery and follow-up
Behavioral events (chat, polls, offers) — analytics database	Per the organizer's retention policy, which may be set between 30 days and 10 years. In practice no such policy can currently be configured (see the note below the table), so these records are retained for the duration of your active participation on the platform.	Consent-based processing (short-term analytics)
Live-session data (chat message text, your display name, presence, attendance, poll votes, reactions, offer clicks, feedback, and the original text of any message removed by automated moderation) — real-time database	No automated deletion. This data is removed only when the organizer deletes the session or the parent event; moving a session to replay or archived status does not remove it.	Operation of the live event and post-event moderation review
Events you registered for	Retained alongside your contact information for the duration of your active participation on the platform	Replay access and your registration history
Campaign-attribution records (UTM parameters, click identifiers, landing page and referrer URLs, country, city, device, OS, browser, timezone, and order data received from the organizer's store)	No automated deletion. Removed on an erasure request, or when the organizer deletes the funnel.	Measuring campaign effectiveness
Landing-page visit records (the persistent visitor identifier described in Section 1.5)	No automated deletion. Removed only when the organizer deletes the funnel or the page. Not reached by an erasure request — these records carry no link to a contact.	Unique-visitor measurement
Your privacy choices (what you consented to at registration)	Deleted together with your contact record (on GDPR Art 17 erasure request or if we close our platform). Your consent change history is retained with the link to your contact record removed.	Legal obligation (proof of lawful processing — GDPR Art 7(1))
Push notification token (FCM token)	Deleted when the app is uninstalled (FCM reports the token as `UNREGISTERED`), when you revoke push permission in app settings, or on a data deletion or erasure request. There is no automated deletion by age: age-based deletion is a retention policy the organizer must configure, and no such policy can currently be saved.	FCM tokens expire if the app isn't used. We keep tokens only while they're active.
Notifications sent to you	For the duration of your active participation on the platform (deleted on GDPR erasure request or if we close our platform)	Confirming notifications reached you and monitoring delivery errors
Marketing email history	For the duration of your active participation on the platform (deleted on GDPR erasure request or if we close our platform). Your email address is separately retained on our email provider's permanent suppression list after erasure — see Section 8.2.	Legitimate interest in delivery tracking and suppression compliance
SMS delivery records, and segment-broadcast records	No automated deletion, and not removed by an erasure request — see Section 8.2	Delivery tracking and prevention of duplicate sends
Automated follow-up records (the outcome of each step of an automated sequence; for email and SMS steps these contain your plaintext email address or telephone number)	No automated deletion. Removed by cascade when your contact record is deleted.	Evidencing what was sent to you and when
AI generation records (the stored prompt and model output, which may contain the name and text of a testimonial you submitted)	No automated deletion, and not reached by an erasure request — see Section 8.2	Cost tracking, versioning and reproducibility of generated marketing content
Audit logs (staff actions on your data)	No automated deletion. Audit entries are retained indefinitely and are not anonymised: your hashed email address remains in the metadata of entries created by the data-subject rights workflow, alongside the acting staff member's IP address and user agent.	Security, accountability, and regulatory compliance (Art 5(2); Art 17(3)(b) and (e))
Event video recording (if you appear on camera during the live)	Until event is archived or you request deletion	Allowing participants to access the replay after the event

Early Deletion: You can request deletion of your data at any time, regardless of retention periods (see Section 8.2).

Retention policies cannot currently be configured. Retention periods are configured per organisation, and no default policy is seeded. The retention enforcement job acts only on policies that exist, so an organisation that has configured none has no data deleted by age. The retention settings screen currently submits eight data types while the API accepts five, and the API validates the whole submission before writing any of it, so every save attempt is rejected and no retention policy can be configured through the product. Where an enabled policy would delete more than ten thousand rows in a single run, the job records a warning and deletes nothing, so a table whose backlog has crossed that threshold is not brought back within its retention period by subsequent runs.

After Retention Period: Where a retention period does apply and is enforced, the affected records are deleted from our live databases. We do not remove individual records from historical backups or archives; those copies are retained for their own backup cycle and are overwritten in the ordinary course.

GAP-RET-01 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that behavioural events and push tokens are deleted according to a configurable retention policy, that audit logs are kept for a minimum of two years and anonymised when an account is deleted, and that data is permanently deleted from all systems including backups and archives at the end of a retention period. No retention policy can currently be saved through the product, so nothing is deleted by age; live-session data, campaign-attribution records, landing-page visit records, SMS delivery records, automated follow-up records, AI generation records and audit logs are subject to no automated retention period at all; and no process removes individual records from backups or archives. This divergence is recorded on the compliance remediation register and is under review.

7. How We Protect Your Data

We implement industry-standard security measures to protect your personal data:

7.1 Technical Measures

Encryption in transit: All data transmitted over the internet uses TLS 1.2+ encryption
Encryption at rest: Database backups and file storage are encrypted
Pseudonymization: No PostgreSQL table holds a plaintext email address, telephone number or personal name. Contacts are keyed by an SHA-256 hash of the lowercased, trimmed email address, and plaintext contact details are held only in Firestore. The following qualifications apply:
- Two exceptions apply. First, the automations engine records the outcome of each executed step as a JSON document in PostgreSQL, and for email and SMS steps that document includes the recipient's plaintext email address or telephone number; those records are removed when the contact is deleted, by cascade, but they are not otherwise pseudonymised. Second, the ai_jobs table stores the full prompt text of each AI generation, which may contain an approved attendee testimonial together with the name and company recorded on it; those rows carry no contact link and are not removed on erasure.
- The API holds an in-process cache of plaintext contact details (email address, name and telephone number), keyed by organisation and email hash, to avoid repeated Firestore reads. The cache has no expiry, and entries are invalidated only within the process that performs the write. Where more than one API instance is running, a correction or a deletion applied on one instance does not evict the copy held by another.
- Plaintext email addresses are written to our application logs on some authentication and bulk-import paths, and those logs are retained by our hosting provider.
Access controls: Permissions are role-based. The platform defines four staff roles — admin, moderator, marketer and staff — mapped to three permission groups (marketing, live, settings). staff holds no permission group and is effectively read-only; marketer holds the marketing group; moderator holds the live group; admin holds all three. Administrator privileges are required for exactly one endpoint, the audit-log listing. Every other destructive action — deleting webinars, sessions, funnels, segments, pages, offers, polls, uploads and testimonials — is authorised by the marketing or live permission group, which the non-administrator marketer and moderator roles satisfy.
Data isolation: Isolation between organizers is enforced in our marketing database (PostgreSQL) by Row Level Security, which confines every query to the rows belonging to the organisation identifier set on the connection. It is not enforced to the same standard in the other two data stores, nor in file storage:
- Access to live-session data in the Realtime Database is authorised by the role claim in the caller's authentication token alone. The security rules contain no organisation identifier and make no comparison between the caller's organisation and the organisation that owns the session, so an authenticated dashboard user holding any of the admin, moderator, marketer or staff roles — in any organisation on the platform — can read any live session's data given only its session identifier. This includes the chat stream, the moderated-message stream, presence, attendance, presence timelines, per-actor message counts, offer clicks, feedback responses and the identity cache that maps an attendee's anonymous actor identifier to the hash of their email address. Separately, the chat stream, the actor directory (which holds attendee display names), the banned and muted actor lists, the feedback definition and the tracked-link table are readable by any authenticated user, which includes every anonymous attendee of every session. All organisations share a single Firebase project per environment, so a single rule set governs the whole platform.
- In Firestore, the document at orgs/{orgId}/contacts/{emailHash}/pii/private, which holds the contact's plaintext email address, name and telephone number, may be fetched by any authenticated Firebase user — including any anonymous web attendee and any email-verified mobile user, from any organisation — provided they know the organisation identifier and the email hash. The email hash is an unsalted SHA-256 of the lowercased, trimmed email address, so the document path can be computed directly by anyone who knows the target's address. Registration documents are readable without authentication, exposing the registration status, the email hash, the registration timestamp and the registration metadata.
- The Cloud Storage security rules grant unconditional public read access to all seven organisation-scoped paths — webinars/, pages/, offers/, media/, page_templates/, branding/ and staff/ — so any object stored under an organisation's prefix is readable by anyone who knows or can guess its path, without authentication. Write access on those same paths requires only that the caller be authenticated; the organisation identifier in the path is never compared against the caller's token, so an authenticated user of one organisation can overwrite another organisation's branding, media, page templates and landing-page files. A final catch-all rule grants read and write access to every remaining object in the bucket to any authenticated user, which includes every anonymous attendee.

GAP-ISO-01 · CONFIG — KNOWN GAP, REMEDIATION PENDING

This policy previously stated without qualification that your data is strictly separated from other users at the database level, and that your email address is pseudonymised in our analytics database. Row Level Security does enforce that separation in PostgreSQL, but the Realtime Database, Firestore and Cloud Storage security rules perform no organisation check on the access paths described above, and plaintext contact details are additionally held in automation execution records, in an in-process cache and in application logs. This divergence is recorded on the compliance remediation register and is under review.

7.2 Organizational Measures

Staff training: All employees receive GDPR and data protection training
Confidentiality agreements: Staff sign NDAs
Breach response plan: We have procedures to detect and respond to data breaches within 72 hours
Regular audits: Annual security reviews and penetration testing

7.3 Your Responsibilities

Keep your confirmation email links private — the manage and cancel links contain a token that allows cancelling your registration or changing your notification preferences
Use a secure internet connection when attending events
Do not share sensitive information in public chat

8. Your Privacy Rights

Under GDPR, you have the following rights regarding your personal data:

8.1 Right of Access

GDPR Article 15

You can request a copy of the personal data we hold about you.

The file our export tool generates contains:

Contact information (email, name, phone if provided)
Events you registered for and attended
Behavioral events (chat messages, poll votes, offer clicks)
Your privacy choices and consent change history
Segment memberships
Lead scores computed from your engagement
Push notification token (FCM token) — registered mobile devices (mobile app users only)
Notifications sent to you (push notification delivery history, including open tracking — mobile app users only)
Marketing email history (which emails we sent and delivery status)
Your live-session records from the real-time database

The generated file does not currently include the following categories, which we nonetheless hold and which you are entitled to receive. Ask us and we will supply them separately:

Your campaign-attribution record — UTM parameters, advertising click identifiers, landing page and referrer URLs, and the derived country, city, device type, operating system, browser and timezone described in Section 1.3
SMS delivery history
Records of one-off segment broadcasts sent to you
Order and payment-status data received from the organizer's store (Section 1.6)

GAP-RET-04 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously described the export as a copy of all personal data held about you, and Section 8.4 described the portability file as the same complete dataset. The generated file omits the campaign-attribution, geolocation and device record, the SMS delivery log, the segment-broadcast log, and the order data received from the organizer's store. This divergence is recorded on the compliance remediation register and is under review.

How to request: Email [[email protected]] with subject "Data Access Request" Response time: Within 1 month. Requests are free of charge; a reasonable fee may apply only for requests that are manifestly unfounded or excessive (GDPR Art 12(5)).

8.2 Right to Erasure / "Right to be Forgotten"

GDPR Article 17

You can request deletion of your personal data.

What gets deleted:

Your email, name, and phone number
All behavioral events (chat messages, poll votes, offer clicks) held in our analytics database
Events you registered for (including registration country, city, device type, OS, browser, timezone)
Your campaign-attribution records
Your privacy choices (consent records)
Push notification token (FCM token) — all registered devices
Notifications sent to you (push notification delivery records)
Marketing email history
Removal from all marketing segments
Your live-session records — chat messages, presence, poll votes, reactions and attendance — for each anonymous session identifier recorded against your registrations

Exceptions. The following are not deleted, or are not deleted in full:

Audit logs. Entries recording staff actions on your data are retained and are not anonymised: your hashed email address remains in the metadata of entries created by the data-subject rights workflow, together with the acting staff member's IP address and user agent. The application holds only select and insert privileges on the audit log, so entries cannot be deleted or overwritten through it, and they are retained indefinitely for accountability under Art 5(2), on the basis of Art 17(3)(b) and (e).
Your email address at our email provider. Erasure at the email provider is a suppression, not a deletion. On completing an erasure the platform submits the contact's email address to the email provider with a permanently-rejected status, so that no future message can be delivered to it. By design this keeps the plaintext email address on file at the provider indefinitely.
SMS delivery records, and segment-broadcast records. Two tables holding personal data keyed by email hash are not reached by the erasure routine and have no foreign key to the contact record, so they are not removed by cascade either: the SMS delivery log and the segment-broadcast recipient log. A per-person record of SMS messages sent — email hash, webinar and session, template type, tracking code, provider message identifier, delivery status and delivery and click timestamps — therefore persists after an Article 17 erasure, and neither table is included in the Article 15 data export.
Landing-page visit records. The persistent visitor identifier described in Section 1.5 carries no link to a contact record and is not reached by erasure.
AI generation records. Where you submitted a testimonial that staff approved and then used in AI-assisted content generation, the stored prompt and model output retain your name and the text of your quote. These records are keyed to the generated content and to the staff member who started the generation, not to your contact record, so they are not reached by erasure.
Live-session data recorded under an earlier session identifier. Only the most recent anonymous session identifier is retained on each registration record. Where you joined from more than one device, or rejoined a session, chat text and your display name may remain in the live-session database under the earlier identifiers.
Consent change history. Records of consent events are retained with the link to your contact record removed, as a pseudonymised record of when consents were granted and withdrawn (Art 7(1)).
We may also retain anonymized statistical data (e.g., "100 attendees voted in poll X") or data required by law.

GAP-RET-05 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that audit logs are anonymised when your account is deleted, and that your marketing email history and the notifications sent to you are deleted, without qualification. No anonymisation step exists: audit entries retain your hashed email address and are never purged; your plaintext email address is deliberately retained on the email provider's permanent suppression list; and the SMS delivery log, the segment-broadcast log, landing-page visit records and stored AI generation prompts are not reached by the erasure routine at all. This divergence is recorded on the compliance remediation register and is under review.

How to request: Email [[email protected]] with subject "Delete My Data" Response time: Within 1 month Confirmation: You'll receive email confirmation once deletion is complete

8.3 Right to Rectification

GDPR Article 16

You can correct inaccurate personal data.

Examples:

Update your name or email address
Correct phone number

How to request: Email [[email protected]] with the correct information Response time: Within 1 month

8.4 Right to Data Portability

GDPR Article 20

You can receive your data in a structured, machine-readable format (JSON).

What's included: the dataset the export tool generates, as listed under Section 8.1 (Right of Access) — contact information, events, behavioral events, consent records, segment memberships, lead scores, device tokens, push and email delivery history, and your live-session records. The categories that Section 8.1 identifies as absent from the generated file are supplied separately on request.

How to request: Email [[email protected]] with subject "Data Portability Request" Response time: Within 1 month Format: JSON file download

8.5 Right to Object

GDPR Article 21

You can object to processing based on legitimate interest or for direct marketing.

Examples:

Object to behavioral analytics → We'll revoke the consent, so that no further behavioural event rows are written to our analytics database and those events stop feeding your engagement score. Your chat messages, poll votes, reactions and offer clicks continue to be recorded in the live-session database and remain visible to the organizer's staff, as explained in Section 1.2. To delete existing behavioral data, submit a separate erasure request (Section 8.2)
Object to marketing emails → We'll immediately unsubscribe you, which revokes your marketing-email consent. That alone does not stop the one-off segment broadcasts described in Section 2.3; if you want no further email of any kind, say so and we will suppress your address entirely
Object to server-side ad conversion tracking → We'll suppress future conversion events sent to advertising platforms for your account (see Section 2.4B). Note that the server-side page-view event described in Section 2.4B is sent for landing-page visitors before any contact record exists and cannot be suppressed on that basis

How to request: Email [[email protected]] or click "Unsubscribe" in any marketing email Response time: Immediate for marketing, within 1 month for other objections

8.6 Right to Restrict Processing

GDPR Article 18

You can request temporary suspension of processing while we resolve a dispute. Restriction is reversible — you can ask us to lift it at any time.

Examples:

You contest data accuracy (we pause processing while verifying)
You prefer restriction over deletion

How to request: Email [[email protected]] Response time: Within 1 month

GDPR Article 7(3)

You can withdraw consent at any time.

How:

Cookie consent (tracking scripts): Open the cookie settings (floating button or footer link) on one of our landing, registration or lobby pages, turn "Analiză & Performanță" (Analytics & Performance) and "Publicitate & Marketing" (Advertising & Marketing) off, and save. Microsoft Clarity and any Google tags then stop loading, and the Meta and TikTok pixels return to their consent-withheld state; as explained in Section 2.4A, those two pixels continue to load and to send a page view in that state.
On the live watch page the cookie banner and the floating cookie-settings button are suppressed, on the basis that attendees have already been presented with the consent choices at registration. A visitor who opens a watch page directly is therefore not shown a cookie prompt on that page and cannot change or withdraw cookie preferences from it; the scripts classified as strictly necessary, including the Meta and TikTok pixels, still load.
Marketing emails: Click "Unsubscribe" in any email footer. This revokes email marketing consent only, and — as explained in Section 2.3 — does not by itself stop one-off segment broadcasts; ask us if you want your address suppressed entirely
Behavioral tracking: Use the manage link from your confirmation email (Preferences page) and toggle "Personalised experience" off, or email [[email protected]]
All consents at once: Open the Preferences page (via manage link in your confirmation email) and click "Full Unsubscribe" — this revokes all optional consents and cancels your registration (see Section 9.2)

Effect: We'll stop processing immediately (but cannot reverse past processing that was lawful with consent).

Withdrawing consent stops further use of the advertising and analytics services but does not delete cookies that were already placed on your device. When you withdraw consent we opt Microsoft Clarity out, return the Meta and TikTok pixels to their consent-withheld state and reload the page; cookies such as _fbp, _fbc, _ttp, _ga and _clck remain in your browser until they expire naturally or you delete them through your browser settings.

GAP-CONSENT-03 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that the cookie settings control is available on any page and that withdrawing consent deletes the cookies already set. The control is removed from the live watch page, where attendees spend most of their time and which a visitor may open directly without ever seeing a consent prompt, and withdrawal deletes no cookie other than our own consent cookie. This divergence is recorded on the compliance remediation register and is under review.

8.8 Right to Lodge a Complaint

You can complain to your national data protection authority.

Supervisory Authority (Romania): National Authority for the Supervision of Personal Data Processing (ANSPDCP) Website: www.dataprotection.ro Email: [email protected]

For other EU countries: Find your authority at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

We collect consent at registration for the following categories:

Required — Terms & Data Processing Acceptance of our Terms and Conditions, this Privacy Policy, and the processing of your personal data for event delivery. This is required to register — the legal basis is contract performance (GDPR Art 6(1)(b)), not consent. We record your acceptance as a legal record of your agreement at registration time, but it is not a "consent" that can be withdrawn — rather, it is a prerequisite for delivering the service you signed up for.

Optional — Marketing Emails Consent to receive marketing emails about future events and related content from the organizer. You can withdraw at any time.

Optional — Behavioral Tracking Consent to tracking your event interactions (chat, polls, offers, attendance) for lead qualification and analytics. You can withdraw at any time.

Consent options on the registration form are presented unchecked, and you can register and attend any event without granting any additional consent — only your email, name, and acceptance of the Terms & Data Processing are needed. This does not hold on every route: the WhatsApp and SMS checkboxes shown in the event lobby are pre-selected according to the channels the organizer has enabled.

On the public funnel form a single checkbox records acceptance of both the terms of service and the processing of personal data, and a telephone number entered in the form grants consent to SMS notifications without a separate checkbox; where the marketing checkbox is also ticked, that marketing consent is extended to SMS marketing. The attendee application applies the same bundling for the terms and processing consents.

Consent is recorded only as a grant. Leaving the marketing checkbox unticked records nothing — no refusal is stored and no consent event is written — and registering again with the box ticked re-grants a marketing consent that was previously withdrawn.

Consent recorded on your behalf by the organizer. Contacts loaded through the bulk importer are written with granted consents for data processing and acceptance of the terms, recorded with the current policy version and a method of "import", and with marketing consent where the imported row carries that flag. Where your details reached us in this way rather than through a registration, the consent record we hold reflects the moment of import, not the moment at which you originally gave your agreement in the organizer's other system. If you did not intend to be registered in this way, contact us using the details in Section 14 and we will remove your record.

Consent policy version. Every consent record we write is stamped with policy version "1.0".

Depending on the features the organizer has enabled, you may also be asked to consent to:

Event reminders and notifications via WhatsApp or SMS — note that no WhatsApp message is sent (Section 2.3.2)
Marketing messages via WhatsApp or SMS — neither channel is currently used to send marketing messages
Marketing push notifications via the mobile app — no marketing push notification is currently sent (Section 2.3.1)

GAP-CONSENT-04 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that all consent options are presented unchecked and described consent as collected only at registration. The lobby's channel checkboxes are pre-selected, consent to SMS notifications is inferred from the presence of a telephone number on the public form, a refusal is never recorded, and contacts imported in bulk by the organizer are written with granted consents timestamped to the import and stamped with the current policy version. This divergence is recorded on the compliance remediation register; the classification is under review.

Cookie consent (tracking scripts):

Open cookie settings (floating button or footer link) on one of our landing, registration or lobby pages, turn "Analiză & Performanță" (Analytics & Performance) and "Publicitate & Marketing" (Advertising & Marketing) off, and save. The control is not available on the live watch page — see Section 8.7
Effect: Microsoft Clarity and any Google tags stop loading. The Meta and TikTok pixels return to their consent-withheld state but continue to load and to send a page view, as explained in Section 2.4A. Cookies that were set while consent was valid will expire naturally — if you want to remove them sooner, you can clear them directly from your browser settings.

Marketing emails (single-channel unsubscribe):

Click "Unsubscribe" in the footer of any marketing email, or email [[email protected]] with subject "Unsubscribe"
Effect: Revokes only your email marketing consent, which stops your details being synchronised into our email provider's marketing lists and segments. It does not set a suppression flag on your contact record, so you may still be included in a one-off segment broadcast sent by the organizer — see Section 2.3. If you want no further email of any kind, say so in your message and we will suppress your address. Other consents (behavioral tracking, SMS, push) remain unchanged.

Behavioral tracking:

Use the preferences link in your registration confirmation email, or open the preferences panel in the event lobby
Or email [[email protected]] with subject "Withdraw Behavioral Tracking Consent"
Effect: We'll stop recording your event activity (chat, polls, offers) to our analytics database. Your interactions during a live event continue to be written to the live-session database and remain visible to the organizer's staff — see Section 1.2. Withdrawal applies across the organizer's whole account, not only to the event you are attending

Full unsubscribe (all channels at once):

Open the preferences page via the manage link in your confirmation email and click "Full Unsubscribe" ("Dezabonare completă")
Effect: Revokes all withdrawable consents at once (email marketing, behavioral tracking, push notifications and push marketing, WhatsApp/SMS notifications and marketing) and cancels your registration for that event. The consent revocations apply across the organizer's whole account, so no consent-gated message — marketing email, SMS or push — is sent to you again. It does not set the suppression flag on your contact record, so it does not by itself stop the one-off segment broadcasts described in Section 2.3; if you want no further email of any kind, email us and we will suppress your address. The acceptances recorded for the terms of service and for data processing are not withdrawable here (Section 9.1). You can re-register for future events, but you will need to grant consents again.

GAP-CONSENT-08 · CODE — KNOWN GAP, REMEDIATION PENDING

This policy previously stated that a full unsubscribe means you will receive no further communications from us across any channel. The action revokes every withdrawable consent and cancels the registration, but it does not set the suppression flag that the one-off segment broadcast path checks, so a contact who has fully unsubscribed remains within the audience of such a broadcast. This divergence is recorded on the compliance remediation register and is under review.

General effect of withdrawal:

We stop future processing immediately
You can request deletion of past behavioral data
You can still attend events (only email/name required)

10. Cookies and Tracking Technologies

For detailed information about all cookies and storage technologies we use, please see our Cookie Policy.

We use browser storage technologies that are strictly necessary for the event service:

Technology	Purpose	Type	Duration
sessionStorage (attribution params)	Store UTM parameters and click IDs as you navigate from landing page to registration	Essential	Session only (deleted when you close the tab)
localStorage (registrationId)	Remember your registration so you can access the event room	Essential	Until you clear browser data
localStorage (display name, email)	Pre-fill your name and email on return visits	Essential	Until you clear browser data
cookie (cookie consent)	Remember your cookie consent choice	Essential	12 months
Google Tag Manager (GTM container, where the organizer has configured one)	Tag management for the Google tags in that container, under Google Consent Mode v2 (deny-by-default). GTM itself does not set cookies or collect personal data. It does not manage the Meta Pixel, the TikTok Pixel or Microsoft Clarity, which our own consent script loads directly.	Essential	N/A (no persistent storage)
Cloudflare Turnstile (where the organizer has enabled it)	Bot protection on registration forms. Loaded in the page head, outside our cookie-consent script; server-side verification transmits your IP address to Cloudflare.	Essential	Set by Cloudflare; see the Cookie Policy
Firebase Authentication token	Keep you logged into the event session	Essential	1 hour (auto-refreshed)

In addition to the storage technologies above, every landing page contains a 1×1 image beacon. It stores nothing on your device; it causes your browser to make one request, from which our server derives and stores the persistent visitor identifier described in Section 1.5.

If you consent via our cookie banner, we may load third-party tracking scripts that set cookies:

"Analiză & Performanță" (Analytics & Performance): Google Analytics (_ga, _gid, _gac_* cookies), Microsoft Clarity (_clck, _clsk, CLID, MUID, ANONCHK, MR, SM cookies)
"Publicitate & Marketing" (Advertising & Marketing): Meta Pixel (_fbp, _fbc cookies), TikTok Pixel (_ttp, _ttclid cookies), and the LinkedIn Insight Tag (li_fat_id cookie) where the organizer has added one of its own

These cookies are only set if you click "Acceptă toate" (Accept all) or enable the relevant category in our cookie banner. The scripts that set the two advertising-platform cookies behave differently from the cookies themselves: as explained in Section 2.4A, the Meta and TikTok pixels load on every page view irrespective of your choice, in a state configured not to write those cookies, and switch to cookie-writing behaviour only once you accept the advertising category. You can change your preferences at any time via the cookie settings button (floating button or footer link) on our landing, registration and lobby pages; the button is not present on the live watch page — see Section 8.7.

We display a cookie consent banner on your first visit with three options, presented in Romanian: "Acceptă toate" (Accept all), "Setează preferințe" (Set preferences — choose categories individually) and "Doar necesare" (Only necessary). Choosing "Doar necesare" declines the analytics and advertising categories; it does not stop the strictly necessary group, which includes the Meta and TikTok pixels, from loading. There are three categories: necessary ("Strict necesare", always on and not toggleable), analytics ("Analiză & Performanță") and advertising ("Publicitate & Marketing"). The banner has no language switch.

The cookie banner's outcome is stored only in a first-party cookie on the visitor's device (rx_cookie_consent, a JSON value recording the necessary, analytics and advertising choices, a timestamp and a version, retained for twelve months). It is never written to the consent ledger, so the platform holds no server-side record of who accepted or rejected cookies, and cannot evidence a cookie-consent decision after the fact.

The banner is not displayed on the live watch page — see Section 8.7.

Web fonts on AI-generated landing pages are served from the landing page's own domain, so your browser does not contact Google for them. One category of third-party content is loaded by your browser outside our cookie-consent script, irrespective of any choice you make in the banner:

Video playback on the watch page. Where the organizer hosts the event stream on YouTube, the watch page embeds it in a www.youtube.com frame — not the youtube-nocookie.com variant — with no consent gate and no click-to-load placeholder. Google therefore receives your IP address, your User-Agent and your viewing behaviour, and sets its own cookies, for the duration of the session. The playback address is supplied by the organizer, so another third-party video host may be embedded in the same way.

GAP-TRACK-04 · CODE — KNOWN GAP, REMEDIATION PENDING

This section previously enumerated the storage technologies in use without disclosing this load, and Section 4.1 named no video provider. The video embed transmits your IP address and User-Agent to a third party before and irrespective of any consent decision, and additionally sets third-party cookies. This divergence is recorded on the compliance remediation register; the classification is under review.

11. Automated Decision-Making and Profiling

Segmentation and Lead Scoring

We use rule-based segmentation to organize attendees into groups based on behavior:

Examples:

"Attended live" vs "Watched replay"
"Voted in poll about Product X"
"Clicked on pricing offer"
"High engagement score" (based on chat messages + poll votes + offer clicks)

This does not constitute automated decision-making (GDPR Art 22):

No legal or similarly significant effects: Being in a segment does not automatically trigger decisions with legal consequences (e.g., credit denial, employment rejection)
Human oversight: Our sales team reviews segments before deciding on follow-up strategies

Segments are not built on behaviour alone. A segment rule can also select contacts by their communication-preference and consent status — including those who hold a given consent, those who hold no active grant for a given consent purpose, those whose address has been suppressed after a bounce or a spam complaint, and those subject to a restriction of processing under Art 18.

Your rights:

You can withdraw behavioral tracking consent, which stops further behavioural event rows being written to the analytics database and stops those events feeding your engagement score. It does not remove you from a segment whose rule is based on your consent status or on your registration history
You can request details about which segments you're in (data access request)
Note that the organizer's staff can export a segment's members out of the platform as a file of plaintext email addresses and names — see Section 4.3

Displayed Audience Numbers

The attendee count shown during a live event is not necessarily the number of people present. Where the organizer enables the audience simulation feature for a session, the figure displayed to attendees is derived from the real count by applying a base and a multiplier configured by the organizer, with a small random variation applied each minute. The organizer's own dashboard shows the true count alongside the displayed one. This does not affect any decision taken about you, but it does affect information presented to you.

GAP-PROD-01 · PRODUCT — KNOWN GAP, REMEDIATION PENDING

This policy previously described segmentation as rule-based on behaviour and stated that withdrawing behavioural tracking consent is sufficient to opt out; it made no disclosure of the audience simulation feature. Segments may be built on consent and suppression status, which withdrawal does not affect, and the live attendee count shown to attendees may be an organizer-configured estimate rather than the true figure. This divergence is recorded on the compliance remediation register; the classification is under review.

12. Children's Privacy

Our events are intended for adults and business professionals. We do not knowingly collect data from children under 16. By registering for an event, you represent that you are at least 16 years old (see our Terms of Service, Section 3).

Note: Age is self-declared at registration — we do not implement technical age verification. This is a contractual requirement, not an automated enforcement mechanism.

If you are a parent/guardian and believe your child registered for an event, contact us at [[email protected]] and we'll delete the data immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

Changes in legal requirements
New features or services
Feedback from data protection authorities

The current policy is always visible at the point of registration — all registrants accept the version in effect at the time. We update the "Last Updated" date at the top of this template whenever changes are made. ⚠️ The policy page served to attendees on the organizer's public website does not display a version identifier, an effective date or a last-updated date, so the version in force at any moment cannot at present be matched by a reader to a dated text. The same limitation is recorded in Section 1 of the Terms of Service. Note the limitation recorded in Section 9.1: every consent record we hold is stamped with policy version "1.0", so the stored record does not by itself distinguish between successive revisions of this policy.

If a change requires re-consent from existing contacts (e.g., we expand the scope of processing beyond what you originally agreed to), we will contact affected individuals directly before that change takes effect.

Archive: Previous versions are available upon request at [[email protected]].

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights:

Email: [[email protected]] Mail: [Organization Name], [Address], [City, Postal Code, Country] Data Protection Officer (if applicable): [DPO Email]

Response time: We aim to respond to all inquiries within 5 business days.

15. Definitions

Personal Data: Any information relating to an identified or identifiable natural person (e.g., email, name, IP address)
Processing: Any operation performed on personal data (collection, storage, analysis, deletion)
Data Controller: The organization that determines the purposes and means of processing (i.e., [Organization Name] running the event)
Data Processor: A third party that processes data on behalf of the controller (e.g., [Platform Provider], Firebase, NewsmanApp SRL, SendSMS.ro)
Data Subject: You (the event attendee)
GDPR: General Data Protection Regulation (EU Regulation 2016/679)
Consent: A freely given, specific, informed, and unambiguous indication of your agreement to the processing of your personal data (GDPR Art 4(11)). You may withdraw consent at any time.
Behavioral Tracking: The recording of your interactions during an event (chat messages, poll votes, offer clicks, attendance duration) in our analytics database, to analyze engagement and qualify prospects. This copy is made only if you opt in; the interactions themselves are recorded in the live-session database either way (Section 1.2). A grant applies across the organizer's whole account until withdrawn.

End of Privacy Policy

Acceptance: By registering for an event, you acknowledge that you have read and understood this Privacy Policy.

Document Version: 1.0 (DRAFT) Prepared by: [Legal Team] Review Status: ⚠️ REQUIRES LEGAL REVIEW — This is a draft for lawyer consultation

Privacy Policy ​

Introduction ​

1. Information We Collect ​

1.1 Information You Provide Directly ​

1.2 Behavioral and Interaction Data ​

1.3 Technical and Attribution Data ​

1.4 Information We Do NOT Collect ​

1.5 Information We Collect Before You Register ​

1.6 Information We Receive from Other Sources ​

2. How We Use Your Information ​

2.1 Event Access and Delivery (Legal Basis: Contract Performance - GDPR Art 6(1)(b)) ​

2.2 Lead Qualification and Marketing Analytics (Legal Basis: Consent - GDPR Art 6(1)(a)) ​

2.3 Marketing Communications (Legal Basis: Consent - GDPR Art 6(1)(a)) ​

2.3.1 Push Notifications — Mobile App (Legal Basis: Consent - GDPR Art 6(1)(a)) ​

2.3.2 WhatsApp and SMS Communications (Legal Basis: Consent - GDPR Art 6(1)(a)) ​

2.4 Advertising Attribution and Conversion Tracking ​

2.5 Security, Fraud Prevention, and Product Analytics (Legal Basis: Legitimate Interest - GDPR Art 6(1)(f)) ​

3. Legal Basis Summary ​

4. Who We Share Your Data With ​

4.1 Service Providers (Data Processors) ​

4.2 Advertising and Analytics Platforms (Data Recipients) ​

4.3 Internal Teams ​

4.4 Legal Obligations ​

5. International Data Transfers ​

6. How Long We Keep Your Data ​

7. How We Protect Your Data ​

7.1 Technical Measures ​

7.2 Organizational Measures ​

7.3 Your Responsibilities ​

8. Your Privacy Rights ​

8.1 Right of Access ​

8.2 Right to Erasure / "Right to be Forgotten" ​

8.3 Right to Rectification ​

8.4 Right to Data Portability ​

8.5 Right to Object ​

8.6 Right to Restrict Processing ​

8.7 Right to Withdraw Consent ​

8.8 Right to Lodge a Complaint ​

9. Consent and How to Withdraw ​

9.1 How We Obtain Consent ​

9.2 How to Withdraw Consent ​

10. Cookies and Tracking Technologies ​

10.1 Essential Storage (No Consent Required) ​

10.2 Non-Essential Cookies (Requires Consent) ​

10.3 Cookie Consent ​

10.4 Third-Party Content Loaded Without a Consent Gate ​

11. Automated Decision-Making and Profiling ​

Segmentation and Lead Scoring ​

Displayed Audience Numbers ​

12. Children's Privacy ​

13. Changes to This Privacy Policy ​

14. Contact Us ​

15. Definitions ​

Privacy Policy

Introduction

1. Information We Collect

1.1 Information You Provide Directly

1.2 Behavioral and Interaction Data

1.3 Technical and Attribution Data

1.4 Information We Do NOT Collect

1.5 Information We Collect Before You Register

1.6 Information We Receive from Other Sources

2. How We Use Your Information

2.1 Event Access and Delivery (Legal Basis: Contract Performance - GDPR Art 6(1)(b))

2.2 Lead Qualification and Marketing Analytics (Legal Basis: Consent - GDPR Art 6(1)(a))

2.3 Marketing Communications (Legal Basis: Consent - GDPR Art 6(1)(a))

2.3.1 Push Notifications — Mobile App (Legal Basis: Consent - GDPR Art 6(1)(a))

2.3.2 WhatsApp and SMS Communications (Legal Basis: Consent - GDPR Art 6(1)(a))

2.4 Advertising Attribution and Conversion Tracking

2.5 Security, Fraud Prevention, and Product Analytics (Legal Basis: Legitimate Interest - GDPR Art 6(1)(f))

3. Legal Basis Summary

4. Who We Share Your Data With

4.1 Service Providers (Data Processors)

4.2 Advertising and Analytics Platforms (Data Recipients)

4.3 Internal Teams

4.4 Legal Obligations

5. International Data Transfers

6. How Long We Keep Your Data

7. How We Protect Your Data

7.1 Technical Measures

7.2 Organizational Measures

7.3 Your Responsibilities

8. Your Privacy Rights

8.1 Right of Access

8.2 Right to Erasure / "Right to be Forgotten"

8.3 Right to Rectification

8.4 Right to Data Portability

8.5 Right to Object

8.6 Right to Restrict Processing

8.7 Right to Withdraw Consent

8.8 Right to Lodge a Complaint

9. Consent and How to Withdraw

9.1 How We Obtain Consent

9.2 How to Withdraw Consent

10. Cookies and Tracking Technologies

10.1 Essential Storage (No Consent Required)

10.2 Non-Essential Cookies (Requires Consent)

10.3 Cookie Consent

10.4 Third-Party Content Loaded Without a Consent Gate

11. Automated Decision-Making and Profiling

Segmentation and Lead Scoring

Displayed Audience Numbers

12. Children's Privacy

13. Changes to This Privacy Policy

14. Contact Us

15. Definitions