Privacy Policy
Last updated: Version: 1.0
1. Who we are and how to contact us
Eventicly ("Eventicly", "we", "us") is an event-planning platform available at eventicly.com. The service is currently in a pre-launch testing phase, and this policy applies during testing as well.
For any question about your personal data or to use your privacy rights, write to us at support@eventicly.com. You can also use the contact options on our website or in your account.
2. Who this policy is for and what role we play
This policy covers three groups of people: (a) visitors to the website, (b) "Hosts", meaning people who create an account and organise events, together with their team members, and (c) "Guests", meaning people who are invited to, or register for, an event.
For visitors and Hosts we are the controller (GDPR Art 4(7)). This covers account and sign-in data, billing, support, security and the running of the website.
For Guest data we are a processor (GDPR Art 28). When a Host uploads or collects Guest data through the platform (for example guest lists, contact details, RSVPs, dietary preferences or seating), the Host is the controller of that data. The Host decides why and how it is used and is responsible for its lawfulness. We process it only on the Host's documented instructions.
If you are a Guest, please contact the Host who invited you first to exercise your rights (access, correction, deletion and so on). We will help the Host to respond. If you write to us, we will pass your request on to the Host unless we have a legal reason to deal with it ourselves. For data we hold as controller (for example security logs), this policy applies.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) | Is providing it required? |
|---|---|---|---|
| Creating and managing your account, sign-in and secure authentication | email, name, password (stored in protected form), session data | Art 6(1)(b) (performance of a contract) | Yes. Without it we cannot provide an account |
| Providing the service: creating events, invitations and RSVPs, and sending the emails or SMS a Host asks for | event data, content, media files, contact details | Art 6(1)(b) (contract with the Host) | Yes, to use the service |
| Billing, invoicing, accounting and tax duties (when you use a paid plan) | billing details, plan, payment status. Payment card details are handled by the payment provider | Art 6(1)(b) (contract) and Art 6(1)(c) (legal obligation) | Yes, for paid plans |
| Support and service communications (email verification, account notices, replies to your requests) | email, message content | Art 6(1)(b) or Art 6(1)(f) | No, but we cannot reply without it |
| Security, preventing abuse and fraud, technical logs | IP address, device and browser data, access time | Art 6(1)(f) (legitimate interest in protecting the service and its users) | Yes, collected automatically when you visit |
| Statistics about the website and public event pages (only if you allow it) | usage data, approximate device, browser and location | Art 6(1)(a) (consent) and Law 3471/2006 Art 4(5) | No. You can refuse at no cost |
| Third-party embeds such as music and maps (only if you allow them) | data collected by the embed provider | Art 6(1)(a) (consent) | No |
| Establishing, exercising or defending legal claims and meeting legal duties | the data necessary | Art 6(1)(f) and Art 6(1)(c) | Not applicable |
The legitimate interests we rely on are the security and smooth running of the service and the defence of legal claims. You have the right to object (see section 9).
4. Guest data and sensitive data
Hosts may enter names, contact details, RSVPs, plus-ones and dietary needs for Guests. Dietary needs and religious events (for example a baptism) can reveal health data or religious beliefs, which are special categories of data (GDPR Art 9). Hosts should record only what is strictly necessary and should avoid free-text notes about health or religion. The Host is responsible for having a legal basis for such data (for example the Guest's explicit consent under Art 9(2)(a)) and for informing their Guests. We do not use Guest data for our own purposes or for advertising.
The platform is intended for adult Hosts. If a Host enters data about children, the Host is responsible for doing so lawfully, for example with the agreement of a parent or guardian.
5. Who receives data (recipients)
We do not sell personal data. We use service providers that act on our behalf (processors) under a contract that meets the requirements of GDPR Art 28. They fall into these categories:
- hosting and delivery of the website and application (we use Vercel);
- storage of files and media;
- real-time notifications within the application;
- delivery of emails and SMS;
- payment processing for paid plans;
- usage analytics, only if you consent;
- third-party embeds such as music and maps, only if you consent;
- professional advisers such as accountants and legal advisers, where needed.
We may disclose data to public authorities when the law or a court order requires it.
6. Transfers outside the EU/EEA
Some of our providers may process data outside the European Union or the European Economic Area, in particular in the United States. Where this happens, the transfer relies on a European Commission adequacy decision (for example the EU–US Data Privacy Framework for a certified provider) or on standard contractual clauses, with supplementary measures where needed (GDPR Arts 44–46). You may ask us for information about the safeguards at support@eventicly.com.
7. How long we keep data
We keep personal data only as long as necessary for the purposes described in this policy, and then we delete or anonymise it. In general:
- account and event data is kept while your account is active and for a limited period afterwards where needed, for example to handle requests, resolve disputes or meet legal duties;
- Guest data is kept as the Host instructs, and is deleted when the Host deletes it or closes the account, subject to the time needed for backups to expire;
- billing and accounting records are kept for as long as tax and accounting law requires;
- technical and security logs are kept for a limited period;
- support requests are kept for as long as needed to handle them and to deal with any follow-up;
- your cookie choice is stored in your browser for a limited period (see our Cookie Policy).
We may keep data for longer where the law requires it or where a dispute is pending.
8. Security
We apply technical and organisational measures suited to the risk (GDPR Art 32), including encryption in transit (HTTPS) and access controls. If a personal data breach occurs, we notify the supervisory authority and the people affected where the law requires.
9. Your rights
You have the right of access (Art 15), rectification (Art 16), erasure (Art 17), restriction of processing (Art 18), data portability (Art 20), objection (Art 21), and not to be subject to a decision based solely on automated processing (Art 22). Where processing is based on your consent, you may withdraw it at any time (Art 7(3)) without affecting processing carried out before withdrawal.
To exercise your rights as a Host or visitor, write to support@eventicly.com. We will reply within one month. In complex cases this may be extended by two further months, and we will tell you if so (GDPR Art 12). We may ask for information to verify your identity. If you are a Guest, contact the Host first (see section 2).
10. Complaints to the data protection authority
If you believe your rights have been infringed, you may lodge a complaint with the Hellenic Data Protection Authority (HDPA), Kifissias 1-3, 115 23 Athens, Greece, www.dpa.gr (GDPR Art 77). You also have the right to a judicial remedy (Art 79) and to compensation (Art 82). The Authority usually asks that you first approach the controller, so we encourage you to contact us first.
11. Automated decision-making
We do not take decisions with legal or similarly significant effects on you solely by automated means.
12. Cookies and similar technologies
For information about cookies and similar technologies on your device, see our Cookie Policy. You can change your choice at any time via Cookie settings in the footer.
13. Changes to this policy
We may update this policy and will change the "Last updated" date when we do. For material changes, we will notify you in good time, for example by email or in the application.