Privacy policy

1. Who is responsible for your data

Eventico is run by PriceX Ltd., UIC 206487271, 1 Petyofi St, 4000 Plovdiv, Bulgaria. Write to [email protected] about anything related to your personal data.

We are the controller of your account data: name, email, sign-in, public profile, payments and invoices.

When you take part in an event or in the community of a Space, the organization running it is the controller of that data and we are its processor. It decides what the data is used for: questions, polls, networking, booth visits, activity reports, community members and the event team chat, including whom it invites into it.

The organization is also the controller of: the contact list across all of its Spaces (CRM), which its owner and admins can view and download as a CSV file; the name, logo, colours and links to its own policies that it shows in the Space; the emails to attendees it sends through us in its own name; its own domain on which the Space or event runs.

We store and process this data so the platform works, and we do not use it for our own purposes. For questions about a specific event or Space you can also contact the organization. The terms under which we process data on behalf of organizations are available on request at [email protected].

2. What data we process

• Account: name, email, password (we store only a hash of it), interface language and whether you have verified your email.
• Guest account: if you join an event with a QR code without registering, we create an account with a name you type in, or a generated one.
• Team chat invitation: if an organizer invites you, they enter your email and, optionally, your name. If you have no account, we create one and send you an email with a sign-in link.
• Event landing pages: if you register for an event on its page, the organizer receives your name, your email and the language of the page. If you also ask for news from the Space, we keep your email (and name, if you gave it) as a subscriber of that Space. Neither counts until you confirm with the link we email you. We also count visits, registrations and subscriptions per day for the page, without IP addresses or other data about you, and the clicks on a sponsor's logo.
• Email after an event: when an event ends, we send attendees with a confirmed email one message with a link to their page with the connections, sessions and materials from the event. The email is part of the service and contains no advertising. The organizer can turn it off for the event, and you can stop it with the link in the email itself. Organizers get a short summary with only the overall figures of the event.
• Sign-in with Google, LinkedIn, Facebook or GitHub: your ID at the provider, and the name, email and profile picture it sends us. Your password at the provider never reaches us.
• Passkeys: the public key and the name of the key. Your fingerprint or face stays on your device.
• Sign-in by email link: the email and a one-time link. A link you request on the sign-in page is valid for 30 minutes. A link in an invitation from an organizer is valid for 3 days.
• Public profile, if you fill it in: headline, company, job title, short bio, what you are working on, a social media link, a website, a booking link, photo, contacts, interests, whether you are open to networking and who can see the profile.
• Event participation: role (attendee, speaker or organizer), how you joined, check-in, when you were active and presence in the room (by QR code, manually or by beacon).
• Connected calendar (optional): the Google or Microsoft account email and encrypted access keys. We read only when you are busy, no titles or attendees, and add accepted meetings. When someone asks you for a meeting, your busy times show as crossed out. Deleted when you disconnect or delete your account.
• Event team chat (for organizers, presenters, volunteers and exhibitors the organizer added): the messages, mentions and files up to 10 MB that members write and upload, which message was read last, when the room was open and whether it is muted.
• Content you create: questions to speakers (you may ask them anonymously towards other attendees), poll votes, community posts, comments and reactions, connection requests and their messages, materials and photos.
• Activity in the event: sessions and materials viewed, downloads, questions asked and upvoted, votes, connections, shared contacts and interest in exhibitors and sponsors. The organizer sees this activity in their reports.
• Exhibitors and sponsors: when you show interest in a booth or a sponsor, the organizer passes your name and email to the exhibitor or sponsor so they can get in touch. Interest in a sponsor shown before 25 September 2026 stays anonymous: the sponsor only sees how many people were interested.
• Billing details (organizers): company name, UIC, VAT number, address, representative and email. We also keep the invoices issued. You enter card details at Stripe and they never reach us.
• Organizer demo: if you try it from an invite page, we create a temporary organizer account with a sample organization and events. We also keep a record that the demo was started from that invite and whether you signed in with a real account afterwards.
• Push notifications: if you allow them, we store the delivery address your browser creates.
• Technical data: IP address and the browser details every browser sends. We use them to prevent abuse and to find errors.

3. Why we process data

• To provide the service (Art. 6(1)(b) GDPR): account, sign-in, event participation, running events and payments.
• To meet a legal obligation (Art. 6(1)(c)): invoices and accounting records.
• Legitimate interest (Art. 6(1)(f)): platform security, abuse prevention, error tracking and emails to public business contacts (see below).
• Event emails: registration confirmation, a reminder before the event and a thank-you after it. The organizer decides whether to turn them on and sends them through us in its own name because you take part in the event. The legal basis is the organizer's legitimate interest in informing you about an event you take part in (Art. 6(1)(f)). Every such email contains an unsubscribe link.
• Landing page registration and news: we email you to confirm your registration, to confirm your registration again if you ask for it twice, and to remind you once, within 24 hours before the event starts. The organizer is the controller, and the legal basis is its legitimate interest in informing you about an event you registered for (Art. 6(1)(f)). News about the Space's new events is based on your consent (Art. 6(1)(a)), which you give by confirming the link. Every such email contains a link to cancel the registration or to unsubscribe.
• Consent (Art. 6(1)(a)): community news from a Space and push notifications. News is separate from event emails and you only get it if you signed up for it yourself. You can withdraw consent at any time: news with the link in the email or under "My data", push notifications in your browser.

4. Emails to business contacts

We sometimes write to event organizers whose work contacts are published, for example on the organization's or the event's website. We keep the organization name, the contact's name and email, where we found the contact, which event it concerns and the text of our emails. We also record whether and when the invite link in the email was opened.

The legal basis is legitimate interest: we offer a service related to the organization's work. Every email contains an opt-out link. After you opt out we add the email to a block list and do not write to you again.

5. Who we share data with

• Hetzner Online GmbH, Germany: the servers that run the application and the database.
• Amazon Web Services EMEA SARL, Luxembourg, with data in the Frankfurt region (Germany): storage of uploaded files such as photos and materials (Amazon S3), sending organizers' emails to attendees (Amazon SES) and the notices about bounced emails and complaints (Amazon SNS). Amazon receives the recipient's email address and the text of the email.
• Cloudflare, Inc., USA: delivery and protection of the website and its HTTPS connection, including the *.eventico.live addresses of Spaces and organizations' own domains. Cloudflare sees the IP address and the requests to the site. Transfers to the USA rely on the EU-US Data Privacy Framework and standard contractual clauses.
• Stripe Payments Europe, Ltd., Ireland: card payments and subscriptions.
• FleetQ Office (accounting.fleetq.net), servers in Germany: the accounting system we issue invoices in. It receives the organization's billing details.
• Google, LinkedIn, Facebook and GitHub: only if you choose to sign in with them.
• Your browser's push service (for example Google, Mozilla or Apple): it delivers the notifications you allowed.
• YouTube (Google) and Vimeo: the organizer can embed videos from them. Nothing loads until you press Play — only then does your browser connect to Google's (youtube-nocookie.com) or Vimeo's (with do-not-track) servers, which receive your IP address.
• The event organizer: sees the data from their event and can download it.

We send sign-in emails and invoices through our own mail server. We collect application errors in our own Sentry installation.

When a provider is outside the European Union, the transfer relies on the Chapter V GDPR mechanism the provider offers: a European Commission adequacy decision or standard contractual clauses.

We do not sell personal data. We show no ads. If you accept analytics cookies, Google Analytics 4 (Google Ireland Ltd) collects visit statistics on our public pages, including event and Space pages that organizers show under their own brand. Until you accept, your browser does not connect to Google Analytics.

6. Cookies

We use cookies the site cannot work without: the session cookie that keeps you signed in, the "Remember me" cookie only if you choose it when signing in, and XSRF-TOKEN, which protects forms against forged requests.

The address of each Space (for example name.eventico.live) and each organization's own domain gets its own session cookie, valid only for that address. We do not use "Remember me" there.

If you try the organizer demo, we also set the eventico_demo cookie for 30 days. It holds only the number of the demo you started, so we can tell whether you later signed in with a real account from the same browser. We delete it at the first such sign-in.

Google Analytics 4 sets the cookies _ga and _ga_<ID> only after you click Accept in the cookie banner. Until then your browser does not load Google Analytics or contact Google for it. The cookies hold a random browser number, not your name or email. Purpose: visit statistics. Legal basis: your consent. Provider: Google Ireland Ltd. Google LLC in the USA may also process the data under the EU-U.S. Data Privacy Framework. Retention: the cookies last up to 13 months; Google Analytics keeps the data for 14 months. You can withdraw your consent at any time with "Cookie settings" in the footer; we then delete these cookies. We have no advertising cookies.

The app also uses a service worker: it keeps static files (styles, scripts, icons and an offline page) in your browser so the site loads faster and shows a message when you are offline. If you allow notifications, the browser also stores the push subscription.

7. How long we keep data

• Account: while you use it. You can delete it yourself under "My data" in the account menu. We delete it immediately, together with your event participation, connections, questions, posts, comments, uploaded photos and materials, and the details shared with sponsors and exhibitors. Poll votes stay in the results without a link to you. If you own an organization, first delete it or transfer it to a team member from the organization settings. When you delete an organization, we immediately delete all of its events and files. Issued invoices are kept for as long as the law requires.
• Events: an organizer can move an event to the trash, from where it can be restored. Deleting it permanently removes the event, the attendances, questions, polls and other data belonging to it, and the files uploaded for it. Connections between attendees remain, because they are between you and the other person.
• Team chat: messages and files are deleted when the event is permanently deleted. When you delete your account, we also delete your chat messages and files.
• Photos from events with paid storage: deleted automatically when the paid period ends.
• Guest account: deleted automatically 12 months after your last activity at an event. Your attendances, activity, connections and comments are deleted with it. Questions, poll votes, posts and photos stay in the event but are no longer linked to you.
• Activity records in events, which the organizer's reports are built from, and presence in the room: deleted automatically after 12 months.
• In-app notifications: deleted after 12 months, read or not.
• Email sign-in link: usable once. Valid for 30 minutes, or 3 days in an invitation from an organizer. Deleted 30 days after it was used or expired.
• Invoices: kept for as long as the Bulgarian Accountancy Act requires.
• We also keep a log of who viewed or downloaded personal data, for example an admin view or an organizer's data export, and changes to organization teams, for 12 months, for security and accountability.
• Emails to business contacts: if you do not reply and do not use the invite, we delete the contact 6 months after the last email (or 6 months after it was added, if we never wrote to you).
• Email opt-out: we delete your name, our notes about you and the text of the emails right away. We keep the email on the block list so we do not write to you again.
• Records of failed background jobs, such as an email that did not go out: deleted after 30 days.
• Emails from organizers: you get news from a Space only if you signed up for it. We keep the consent until you withdraw it on the community page, under "My data" or with the unsubscribe link in the email. We keep for 12 months which address we emailed and when, and whether the email bounced or was marked as spam. An address that bounces, marked an email as spam or unsubscribed stays on a block list so we do not email it again.
• Landing page registrations and subscriptions: kept until the event or the Space is deleted for good, or until you delete your account (we then delete those made with its verified email). Cancelling a registration or unsubscribing stops the emails at once; the organizer sees the entry as cancelled or unsubscribed. We keep the number of visits, registrations and subscriptions per page and day without anything that identifies you.
• Amazon's notices about bounced emails and complaints: kept for 30 days, so we never process the same notice twice.
• One-time sign-in codes for a Space's address or an organization's own domain: valid for less than a minute and deleted one day after they expire.
• Organizer demo: deleted automatically 7 days after it was created, together with the sample data and the guests who joined the demo event. The record that the demo was started and whether a sign-in with a real account followed is deleted after 12 months.

8. Your rights

Under Articles 15–22 GDPR you have the right:

• to get a copy of your data (Art. 15);
• to correct it (Art. 16). You can change most of it yourself in your profile;
• to ask for it to be erased (Art. 17);
• to restrict its processing (Art. 18);
• to receive it in a format you can take elsewhere (Art. 20);
• to object to processing based on legitimate interest, including emails to business contacts (Art. 21);
• to withdraw consent at any time, without affecting processing already done.

We make no automated decisions with legal effects on you (Art. 22). Networking suggestions are ordered automatically by shared interests, but they are only suggestions.

You can download a copy of your data (JSON) and delete your account yourself under "My data". For anything else, write to [email protected]. We reply within one month.

If you think we are breaching your rights, you can complain to the Bulgarian Commission for Personal Data Protection (CPDP), cpdp.bg.

9. Security

The site works over HTTPS only. Passwords are stored as hashes. Uploaded files are reachable through temporary signed links.

When you share a link in the community, we show a preview with an image. We cache the image on our own server instead of loading it directly from the site the link points to.

10. Changes

If we change this policy we will update the date at the top. For significant changes we will email registered users.