Legal
Eventonite Privacy Policy
Effective date: 9 November 2026
This Privacy Policy explains how Eventonite processes personal data, in line with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
1. Who we are
Eventonite is a ticketing platform for the music scene. Organizers (clubs, promoters, concert organizers and festivals) pay a flat subscription to use it. Ticket money is paid directly into the organizer's own Stripe account; Eventonite never holds it.
Controller: Tokolics Attila ev. (Hungarian sole proprietor)
Seat: 8481 Somlóvásárhely, Vásár u. 12., Hungary
Registration number: 26437683 · Tax number: 65724473-1-39 · EU VAT number: HU65724473
Contact for privacy requests: support@eventonite.com
We have not appointed a data protection officer, as the law does not require one for our activity.
2. Our two roles
Eventonite as controller. We decide how and why data is processed for:
- organizer accounts and team members,
- visitors to our website and app, including the measurement of our own marketing (section 3.5),
- billing of the Eventonite subscription,
- the emails we send in our own name.
Eventonite as processor for ticket buyers and guests. When you buy a ticket for, or are put on the guest list of, an event sold through Eventonite, the organizer of that event is the controller of your data. We process that data only on the organizer's behalf and under their instructions, based on the data processing agreement that forms part of our Terms of Service (GDPR Article 28). This includes the Eventonite scanner app, which the organizer's door staff use to check tickets at the entrance: the app stores the event's ticket list (ticket holder names, ticket types and check-in status) on the staff member's device so that tickets can be checked without an internet connection, and uploads check-ins to us when the device is online. If you are a ticket buyer or guest, please contact the organizer of the event (their support email is shown on their event page and in your ticket email) to exercise your rights or ask questions. If you contact us, we will forward your request to the organizer. If the organizer uses their own Google Analytics, Meta Pixel or TikTok Pixel on their event pages, the organizer is the controller of that processing as well: we only load the scripts on the organizer's instruction, after your consent, and receive none of the data they collect (section 3.6 of our Cookie Policy).
Payments for tickets are handled by Stripe under the organizer's own Stripe account. Stripe processes card and payment data as the organizer's payment provider, not as our subprocessor. We never receive or store card data.
3. What data we process, why, and on what legal basis
3.1 Organizers and their team members (account data)
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (also used as username), first and last name, password (stored only as an argon2 hash), avatar image, country, account creation and modification times | Creating and running your account, logging you in, providing the service | Art. 6(1)(b), contract |
| Email confirmation, password reset, email change and team invitation tokens with their expiry, pending new email address | Confirming your email, resetting your password, changing your email, inviting team members | Art. 6(1)(b), contract |
| Workspace role and team membership | Managing access within a workspace | Art. 6(1)(b), contract |
| API keys (key, description, expiry) | Giving you API access | Art. 6(1)(b), contract |
| Newsletter preference | Recording whether you agreed to receive our newsletter | Art. 6(1)(a), consent, which you can withdraw at any time in your account settings |
| Session data: IP address, browser User-Agent, session expiry | Keeping you logged in, protecting accounts and detecting misuse | Art. 6(1)(b) for the login session; Art. 6(1)(f), our legitimate interest in the security of the service for the IP address and User-Agent |
| Scanner access codes you create for your door staff, and for each scanner device its session, last scan time and scan count | Letting your door staff check tickets, and showing you which devices are online | Art. 6(1)(b), contract |
- Data
- Email address (also used as username), first and last name, password (stored only as an argon2 hash), avatar image, country, account creation and modification times
- Purpose
- Creating and running your account, logging you in, providing the service
- Legal basis
- Art. 6(1)(b), contract
- Data
- Email confirmation, password reset, email change and team invitation tokens with their expiry, pending new email address
- Purpose
- Confirming your email, resetting your password, changing your email, inviting team members
- Legal basis
- Art. 6(1)(b), contract
- Data
- Workspace role and team membership
- Purpose
- Managing access within a workspace
- Legal basis
- Art. 6(1)(b), contract
- Data
- API keys (key, description, expiry)
- Purpose
- Giving you API access
- Legal basis
- Art. 6(1)(b), contract
- Data
- Newsletter preference
- Purpose
- Recording whether you agreed to receive our newsletter
- Legal basis
- Art. 6(1)(a), consent, which you can withdraw at any time in your account settings
- Data
- Session data: IP address, browser User-Agent, session expiry
- Purpose
- Keeping you logged in, protecting accounts and detecting misuse
- Legal basis
- Art. 6(1)(b) for the login session; Art. 6(1)(f), our legitimate interest in the security of the service for the IP address and User-Agent
- Data
- Scanner access codes you create for your door staff, and for each scanner device its session, last scan time and scan count
- Purpose
- Letting your door staff check tickets, and showing you which devices are online
- Legal basis
- Art. 6(1)(b), contract
3.2 Workspace and public organizer page data
Much of this is business data; it is personal data where it identifies a person (for example a sole trader).
| Data | Purpose | Legal basis |
|---|---|---|
| Company name, logo, country, tax number (a normalised copy is kept to enforce one free trial per company), Stripe customer, account and subscription IDs | Running the workspace and the subscription | Art. 6(1)(b), contract; Art. 6(1)(f), legitimate interest in preventing abuse of the trial |
| Public page details: support email (by default the owner's), legal name and address of the business, the organizer's own policies, venue addresses, event cover images | Publishing the organizer's event pages | Art. 6(1)(b), contract |
- Data
- Company name, logo, country, tax number (a normalised copy is kept to enforce one free trial per company), Stripe customer, account and subscription IDs
- Purpose
- Running the workspace and the subscription
- Legal basis
- Art. 6(1)(b), contract; Art. 6(1)(f), legitimate interest in preventing abuse of the trial
- Data
- Public page details: support email (by default the owner's), legal name and address of the business, the organizer's own policies, venue addresses, event cover images
- Purpose
- Publishing the organizer's event pages
- Legal basis
- Art. 6(1)(b), contract
3.3 Billing of the Eventonite subscription
| Data | Purpose | Legal basis |
|---|---|---|
| Billing name, address, tax number and email of the subscribing business; payment method (held by Stripe, not by us) | Charging the subscription | Art. 6(1)(b), contract |
| Invoice data (buyer name, address, tax number, email) | Issuing invoices and keeping accounting records | Art. 6(1)(c), legal obligation under Hungarian tax and accounting law |
- Data
- Billing name, address, tax number and email of the subscribing business; payment method (held by Stripe, not by us)
- Purpose
- Charging the subscription
- Legal basis
- Art. 6(1)(b), contract
- Data
- Invoice data (buyer name, address, tax number, email)
- Purpose
- Issuing invoices and keeping accounting records
- Legal basis
- Art. 6(1)(c), legal obligation under Hungarian tax and accounting law
Billing details are stored with Stripe, not in our database. Invoices are issued and emailed through Billingo, which reports invoice data to the Hungarian tax authority (NAV) as required by Hungarian law.
3.4 Website and app visitors
| Data | Purpose | Legal basis |
|---|---|---|
| IP address and technical request data received by our hosting provider when you load pages and images | Delivering the website and app | Art. 6(1)(f), legitimate interest in operating the website |
| IP address sent to Google when the embedded Stripe component on the organizer Finances page (inside the app) loads fonts from Google Fonts | Displaying the Stripe component | Art. 6(1)(f), legitimate interest in displaying the payments settings correctly |
| Server logs (time of the request, requested address, response status, IP address and browser User-Agent), kept on our AWS hosting in Frankfurt for 30 days | Operating and securing the service | Art. 6(1)(f), legitimate interest in security |
- Data
- IP address and technical request data received by our hosting provider when you load pages and images
- Purpose
- Delivering the website and app
- Legal basis
- Art. 6(1)(f), legitimate interest in operating the website
- Data
- IP address sent to Google when the embedded Stripe component on the organizer Finances page (inside the app) loads fonts from Google Fonts
- Purpose
- Displaying the Stripe component
- Legal basis
- Art. 6(1)(f), legitimate interest in displaying the payments settings correctly
- Data
- Server logs (time of the request, requested address, response status, IP address and browser User-Agent), kept on our AWS hosting in Frankfurt for 30 days
- Purpose
- Operating and securing the service
- Legal basis
- Art. 6(1)(f), legitimate interest in security
Our website and app load their fonts from our own servers, not from Google. In the app and in the scanner app we use no analytics, advertising pixels, captcha or tracking tools. On our website we count visits with our own cookie-free analytics and, only with your consent, use Google Analytics and the Meta Pixel (section 3.5). Organizer event pages load third-party analytics or advertising pixels only if the organizer has enabled them and you have accepted them on that organizer's pages; the organizer is the controller of those (section 2).
3.5 Website analytics, advertising measurement and sign-up attribution
| Data | Purpose | Legal basis |
|---|---|---|
| Visitor statistics with Umami on our website: page address, referring website, screen size, language, and the IP address and browser details used to tell your device type and approximate country and to group page views into a visit; clicks on our sign-up buttons | Understanding how our website is used, as totals | Art. 6(1)(f), our legitimate interest in understanding how our website is used (details in section 10) |
| Google Analytics 4, only after you accept analytics cookies: pages viewed, sign-up button clicks, screen size, browser, language, approximate location derived from your IP address (not stored by Google), a random visitor identifier in the _ga cookie | Understanding how the website is used and which campaigns bring visitors | Art. 6(1)(a), your consent given in the cookie banner; you can withdraw it any time with "Cookie settings" in the footer |
| Meta Pixel, only after you accept marketing cookies: your page views on our website, the _fbp and _fbc cookies, your IP address and browser; if you are logged in to Facebook or Instagram, Meta can link these to your account | Measuring our ads on Facebook and Instagram | Art. 6(1)(a), your consent given in the cookie banner |
| Sign-up attribution stored with your account when you register: the sign-up button you clicked and the plan you chose (read from the address of the sign-up page, no cookie involved) | Knowing which of our pages and buttons bring paying organizers | Art. 6(1)(f), our legitimate interest in measuring our marketing |
| Also stored with your account, only if you accepted analytics or marketing cookies: the campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) of the link that brought you to us, read from the eventonite-attribution cookie | Knowing which campaigns bring paying organizers | Art. 6(1)(a), consent: the cookie is set only after you accept analytics or marketing cookies in the banner |
| Also stored with your account, only with your consent: with analytics consent, the Google Analytics visitor and session identifiers; with marketing consent, the Meta identifiers from the _fbp and _fbc cookies and the IP address and browser of your sign-up request; and a record of your cookie choice (what you accepted and when) | Reporting your sign-up, trial start and first subscription payment to Google Analytics and Meta so that they can be attributed to the campaign; proving your consent | Art. 6(1)(a), consent; for the consent record Art. 6(1)(c) together with Art. 7(1), our obligation to be able to demonstrate your consent |
| Server-side conversion events sent by our server: to Meta (Conversions API): the event (sign-up, trial start, first subscription payment), the plan, the amount paid, your email address, first and last name, country and user id in hashed (SHA-256) form, your IP address, browser and Meta identifiers; to Google Analytics (Measurement Protocol): the event, plan, amount, your Google Analytics identifiers and user id; to our own Umami: the event, plan, campaign labels and amount, with your IP address and browser only if you accepted marketing cookies | Seeing in our ad accounts which campaigns bring paying organizers and what they pay, so we can spend our marketing budget well | Art. 6(1)(a), consent, for Meta and Google Analytics; Art. 6(1)(f), legitimate interest, for the Umami event |
- Data
- Visitor statistics with Umami on our website: page address, referring website, screen size, language, and the IP address and browser details used to tell your device type and approximate country and to group page views into a visit; clicks on our sign-up buttons
- Purpose
- Understanding how our website is used, as totals
- Legal basis
- Art. 6(1)(f), our legitimate interest in understanding how our website is used (details in section 10)
- Data
- Google Analytics 4, only after you accept analytics cookies: pages viewed, sign-up button clicks, screen size, browser, language, approximate location derived from your IP address (not stored by Google), a random visitor identifier in the _ga cookie
- Purpose
- Understanding how the website is used and which campaigns bring visitors
- Legal basis
- Art. 6(1)(a), your consent given in the cookie banner; you can withdraw it any time with "Cookie settings" in the footer
- Data
- Meta Pixel, only after you accept marketing cookies: your page views on our website, the _fbp and _fbc cookies, your IP address and browser; if you are logged in to Facebook or Instagram, Meta can link these to your account
- Purpose
- Measuring our ads on Facebook and Instagram
- Legal basis
- Art. 6(1)(a), your consent given in the cookie banner
- Data
- Sign-up attribution stored with your account when you register: the sign-up button you clicked and the plan you chose (read from the address of the sign-up page, no cookie involved)
- Purpose
- Knowing which of our pages and buttons bring paying organizers
- Legal basis
- Art. 6(1)(f), our legitimate interest in measuring our marketing
- Data
- Also stored with your account, only if you accepted analytics or marketing cookies: the campaign labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) of the link that brought you to us, read from the eventonite-attribution cookie
- Purpose
- Knowing which campaigns bring paying organizers
- Legal basis
- Art. 6(1)(a), consent: the cookie is set only after you accept analytics or marketing cookies in the banner
- Data
- Also stored with your account, only with your consent: with analytics consent, the Google Analytics visitor and session identifiers; with marketing consent, the Meta identifiers from the _fbp and _fbc cookies and the IP address and browser of your sign-up request; and a record of your cookie choice (what you accepted and when)
- Purpose
- Reporting your sign-up, trial start and first subscription payment to Google Analytics and Meta so that they can be attributed to the campaign; proving your consent
- Legal basis
- Art. 6(1)(a), consent; for the consent record Art. 6(1)(c) together with Art. 7(1), our obligation to be able to demonstrate your consent
- Data
- Server-side conversion events sent by our server: to Meta (Conversions API): the event (sign-up, trial start, first subscription payment), the plan, the amount paid, your email address, first and last name, country and user id in hashed (SHA-256) form, your IP address, browser and Meta identifiers; to Google Analytics (Measurement Protocol): the event, plan, amount, your Google Analytics identifiers and user id; to our own Umami: the event, plan, campaign labels and amount, with your IP address and browser only if you accepted marketing cookies
- Purpose
- Seeing in our ad accounts which campaigns bring paying organizers and what they pay, so we can spend our marketing budget well
- Legal basis
- Art. 6(1)(a), consent, for Meta and Google Analytics; Art. 6(1)(f), legitimate interest, for the Umami event
Nothing optional loads or is collected before you choose in the cookie banner, and "Necessary only" declines all of it. For the collection of data through the Meta Pixel and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers under Meta's Controller Addendum (https://www.facebook.com/legal/controller_addendum); Meta is solely responsible for what it does with the data afterwards, as described in its privacy policy (https://www.facebook.com/privacy/policy). Google Analytics processes data as our processor under the Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/); we have switched off Google Signals and the sharing of data with other Google products. The identifiers, IP address and browser details stored with your sign-up are deleted 90 days after your registration; the campaign labels, the clicked button and the chosen plan stay with your account data. We do not use any of this for automated decisions about you. Details of the cookies are in our Cookie Policy (https://eventonite.com/cookies).
3.6 Emails we send
| Sent to | Legal basis | |
|---|---|---|
| Registration confirmation, password reset, welcome, team invitation, email change confirmation and notice | Account holders | Art. 6(1)(b), contract |
| Personal onboarding and feedback emails from our founder (after registration and at the end of the trial) | Workspace owners | Art. 6(1)(f), our legitimate interest in onboarding our customers. These emails are about using the service only and contain no offers. You can ask us to stop them at any time by replying or emailing support@eventonite.com. |
| Invoices and credit notes | Subscribing businesses | Art. 6(1)(b) and (c) |
| Ticket emails (with PDF ticket and QR code) and ticket cancellation notices | Ticket buyers and guests | Sent on behalf of the organizer, as their processor (see section 2) |
- Registration confirmation, password reset, welcome, team invitation, email change confirmation and notice
- Sent to
- Account holders
- Legal basis
- Art. 6(1)(b), contract
- Personal onboarding and feedback emails from our founder (after registration and at the end of the trial)
- Sent to
- Workspace owners
- Legal basis
- Art. 6(1)(f), our legitimate interest in onboarding our customers. These emails are about using the service only and contain no offers. You can ask us to stop them at any time by replying or emailing support@eventonite.com.
- Invoices and credit notes
- Sent to
- Subscribing businesses
- Legal basis
- Art. 6(1)(b) and (c)
- Ticket emails (with PDF ticket and QR code) and ticket cancellation notices
- Sent to
- Ticket buyers and guests
- Legal basis
- Sent on behalf of the organizer, as their processor (see section 2)
Emails are sent through Amazon Simple Email Service (AWS SES) in the EU. We do not track whether you open our emails or click the links in them.
4. Where the data comes from
Most data comes directly from you. Data about team members may come from the workspace owner who invites them. Ticket-buyer and guest data comes from the buyer or from the organizer who adds a guest. Payment-account verification (KYC) for organizers is collected directly by Stripe, not by us.
5. Recipients and subprocessors
We share personal data only with the service providers we need to run Eventonite:
| Recipient | What for | Data | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Hosting: website and app, database, cache and job queue (Redis), file storage (images), email sending (SES), server logs and backups | All data described above, including job data that can contain names, email addresses and tokens | Region eu-central-1 (Frankfurt, Germany) |
| Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland | Subscription billing (Stripe Billing); connecting organizers' own Stripe accounts (Stripe Connect) | Billing details of the subscribing business; workspace name, ID and country for Connect | Ireland (EU); see section 6 |
| Billingo Technologies Zrt., 1133 Budapest, Váci út 76, Hungary | Issuing and emailing invoices | Invoice buyer name, address, tax number, email | Hungary (EU) |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Fonts), only via the embedded Stripe component on the app Finances page | Font delivery | Visitor IP address | Ireland (EU); font requests may be served from Google servers outside the EU, see section 6 |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4), only after your consent on our website | Website analytics and conversion measurement, as our processor | Pages viewed, events, visitor and session identifiers, approximate location (Google does not store the IP address), sign-up conversions with plan and amount | Ireland (EU); may be processed by Google LLC in the United States, see section 6 |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta Pixel and Conversions API), only after your consent on our website | Measuring our ads; joint controller for the collection and transmission, independent controller afterwards | Page views, _fbp and _fbc identifiers, IP address, browser; conversion events with plan and amount and your hashed email address, name, country and user id | Ireland (EU); may be processed by Meta Platforms, Inc. in the United States, see section 6 |
- Recipient
- Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg
- What for
- Hosting: website and app, database, cache and job queue (Redis), file storage (images), email sending (SES), server logs and backups
- Data
- All data described above, including job data that can contain names, email addresses and tokens
- Location
- Region eu-central-1 (Frankfurt, Germany)
- Recipient
- Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
- What for
- Subscription billing (Stripe Billing); connecting organizers' own Stripe accounts (Stripe Connect)
- Data
- Billing details of the subscribing business; workspace name, ID and country for Connect
- Location
- Ireland (EU); see section 6
- Recipient
- Billingo Technologies Zrt., 1133 Budapest, Váci út 76, Hungary
- What for
- Issuing and emailing invoices
- Data
- Invoice buyer name, address, tax number, email
- Location
- Hungary (EU)
- Recipient
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Fonts), only via the embedded Stripe component on the app Finances page
- What for
- Font delivery
- Data
- Visitor IP address
- Location
- Ireland (EU); font requests may be served from Google servers outside the EU, see section 6
- Recipient
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4), only after your consent on our website
- What for
- Website analytics and conversion measurement, as our processor
- Data
- Pages viewed, events, visitor and session identifiers, approximate location (Google does not store the IP address), sign-up conversions with plan and amount
- Location
- Ireland (EU); may be processed by Google LLC in the United States, see section 6
- Recipient
- Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland (Meta Pixel and Conversions API), only after your consent on our website
- What for
- Measuring our ads; joint controller for the collection and transmission, independent controller afterwards
- Data
- Page views, _fbp and _fbc identifiers, IP address, browser; conversion events with plan and amount and your hashed email address, name, country and user id
- Location
- Ireland (EU); may be processed by Meta Platforms, Inc. in the United States, see section 6
The Google Analytics, Meta and TikTok pixels that organizers may use on their own event pages are the organizers' providers, not ours; we receive none of that data.
We may also disclose data to authorities where the law requires it. We do not sell personal data.
6. International transfers
Our hosting provider is an EU company (Amazon Web Services EMEA SARL, Luxembourg), and our data is stored in its Frankfurt, Germany region. Its US parent company, Amazon Web Services, Inc., is covered by the EU-U.S. Data Privacy Framework certification of Amazon.com, Inc., so any transfer to it is covered by the European Commission's adequacy decision for the Framework (GDPR Art. 45). Stripe's US company, Stripe, Inc., is also certified under the EU-U.S. Data Privacy Framework. Billingo is a Hungarian company and processes data in the EU. Google Fonts is provided by Google Ireland Limited; font requests may be served by Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework. Google LLC (Google Analytics) and Meta Platforms, Inc. (Meta Pixel and Conversions API) are also certified under the EU-U.S. Data Privacy Framework. You can check certifications at https://www.dataprivacyframework.gov. The Framework was upheld by the General Court of the European Union in September 2025 (case T-553/23); an appeal is pending before the Court of Justice (case C-703/25 P). If the Framework is invalidated, we will rely on the standard contractual clauses approved by the European Commission that form part of our agreements with these providers (GDPR Art. 46(2)(c)), or stop the transfer. You can ask us for a copy of the relevant safeguards at support@eventonite.com.
7. How long we keep data
| Data | Retention |
|---|---|
| Invoices and accounting documents | Until the tax authority's right to assess the tax lapses: 5 years from the last day of the calendar year in which the tax return was due (Act CL of 2017 on the Rules of Taxation, Sections 78 and 202), so up to 6 years |
| Account data | While your account exists, then deleted within 30 days of your account or workspace being closed, except data we must keep for the period above |
| Unconfirmed registrations (name, email address, password hash, country, chosen plan) | Deleted 7 days after the last confirmation link expired (a link is valid for 24 hours) if the email address was not confirmed; the cleanup runs daily |
| Session and security data (IP, User-Agent) | For the lifetime of the session (24 hours, or 14 days with "remember me"), then deleted within 30 days |
| Scanner sessions and scan counts | Until the organizer revokes the scanner access or the event is deleted |
| Job queue (Redis) data, on our AWS hosting | Completed jobs are kept for 7 days and failed jobs for 30 days, then deleted |
| Server logs and backups | 30 days |
| Uploaded images (logos, cover images, avatars) | Until you replace or delete them, or until the event, workspace or account they belong to is deleted |
| Ticket-buyer and guest data | As instructed by the organizer under the data processing agreement, and deleted when the organizer's workspace is closed |
| Sign-up attribution identifiers (IP address, browser, Google Analytics and Meta identifiers) | Deleted 90 days after registration by a daily cleanup |
| Clicked sign-up button, chosen plan, campaign labels and your cookie-choice record | With your account data |
| Your cookie choice in your browser (eventonite-consent, eventonite-site-consent) | 180 days, then the banner asks again |
| Umami visitor statistics | 12 months |
| Google Analytics user- and event-level data | 14 months (Google Analytics retention setting), aggregated reports longer |
| Data received by Meta through the Pixel and the Conversions API | Kept by Meta under its own policy |
- Data
- Invoices and accounting documents
- Retention
- Until the tax authority's right to assess the tax lapses: 5 years from the last day of the calendar year in which the tax return was due (Act CL of 2017 on the Rules of Taxation, Sections 78 and 202), so up to 6 years
- Data
- Account data
- Retention
- While your account exists, then deleted within 30 days of your account or workspace being closed, except data we must keep for the period above
- Data
- Unconfirmed registrations (name, email address, password hash, country, chosen plan)
- Retention
- Deleted 7 days after the last confirmation link expired (a link is valid for 24 hours) if the email address was not confirmed; the cleanup runs daily
- Data
- Session and security data (IP, User-Agent)
- Retention
- For the lifetime of the session (24 hours, or 14 days with "remember me"), then deleted within 30 days
- Data
- Scanner sessions and scan counts
- Retention
- Until the organizer revokes the scanner access or the event is deleted
- Data
- Job queue (Redis) data, on our AWS hosting
- Retention
- Completed jobs are kept for 7 days and failed jobs for 30 days, then deleted
- Data
- Server logs and backups
- Retention
- 30 days
- Data
- Uploaded images (logos, cover images, avatars)
- Retention
- Until you replace or delete them, or until the event, workspace or account they belong to is deleted
- Data
- Ticket-buyer and guest data
- Retention
- As instructed by the organizer under the data processing agreement, and deleted when the organizer's workspace is closed
- Data
- Sign-up attribution identifiers (IP address, browser, Google Analytics and Meta identifiers)
- Retention
- Deleted 90 days after registration by a daily cleanup
- Data
- Clicked sign-up button, chosen plan, campaign labels and your cookie-choice record
- Retention
- With your account data
- Data
- Your cookie choice in your browser (eventonite-consent, eventonite-site-consent)
- Retention
- 180 days, then the banner asks again
- Data
- Umami visitor statistics
- Retention
- 12 months
- Data
- Google Analytics user- and event-level data
- Retention
- 14 months (Google Analytics retention setting), aggregated reports longer
- Data
- Data received by Meta through the Pixel and the Conversions API
- Retention
- Kept by Meta under its own policy
You can ask us to delete your account at any time by emailing support@eventonite.com; we handle these requests manually.
8. Your rights
Under Articles 15-22 GDPR you have the right to:
- access your data and receive a copy (Art. 15),
- have inaccurate data rectified (Art. 16); you can also edit your name, email and newsletter preference in your account,
- have your data erased (Art. 17),
- restrict processing (Art. 18),
- data portability (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)); for analytics and marketing cookies, use "Cookie settings" in the website footer.
Your right to object
- Where we process your data on the basis of our legitimate interest (visitor statistics, server logs and session security data, the sign-up button and plan stored with your registration, preventing abuse of the free trial, and the onboarding emails from our founder), you can object at any time by emailing support@eventonite.com. We will then stop that processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms (Art. 21(1)).
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Art. 22).
To exercise your rights, email support@eventonite.com. We handle requests manually and respond without undue delay and within one month; where necessary we may extend this by two further months and will tell you why (Art. 12(3)). We may ask you to confirm your identity.
9. Right to lodge a complaint
You can lodge a complaint with a supervisory authority, in particular in the EU country where you live or work, or where you think the infringement happened. In Hungary this is:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Hungarian National Authority for Data Protection and Freedom of Information
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Postal address: 1363 Budapest, Pf. 9.
Phone: +36 (1) 391 1400
Email: ugyfelszolgalat@naih.hu
Website: https://naih.hu
You can also go to court.
10. Cookies
Strictly necessary cookies and storage need no consent: the session cookie that keeps you logged in (eventonite-session, 24 hours or 14 days with "remember me", valid across eventonite.com and its subdomains), two app display preferences, your ticket selection on organizer event pages, the scanner app's offline ticket data, the cookie that stores your cookie choice, and Stripe's own cookies in the embedded component on the organizer Finances page. On our website a consent banner asks whether you accept Google Analytics (analytics) and the Meta Pixel (marketing); nothing optional loads before you choose, and you can change your choice at any time with "Cookie settings" in the footer. On organizer event pages the organizer's own pixels, if any, are asked for separately. The full list of cookies, their lifetimes and purposes is in our Cookie Policy.
Visitor statistics. On our website (the eventonite.com landing and product pages, not the app or organizer event pages) we use Umami, an open-source analytics tool that we run on our own server (analytics.creati.dev), hosted by Amazon Web Services in Frankfurt, Germany. It sets no cookies, does not track you across websites and does not run if your browser sends a Do Not Track signal. It records the page address, referrer, screen size and language, and uses your IP address and browser details to estimate your device type and approximate country and to group page views into a visit. Our analytics server may briefly log IP addresses for security purposes. We use these only as totals, never for advertising, and never link them to your account. Legal basis: our legitimate interest in understanding how our website is used (Art. 6(1)(f)). You can object under Art. 21 by writing to support@eventonite.com. When an organizer signs up, starts a trial or pays their first subscription, our server also reports this to Umami as an event with the campaign labels, the plan and the amount; the IP address and browser are included only with marketing consent, so the event can be grouped with the earlier visit. We keep the statistics for 12 months.
More details: Cookie Policy (https://eventonite.com/cookies).
11. Is providing data required?
Account, billing and invoice data are needed to conclude and perform the subscription contract and to meet our legal obligations; without them we cannot provide the service. The newsletter is optional. Analytics and marketing cookies are optional; declining them does not limit the service.
You must be at least 18 years old to create an Eventonite account. Eventonite is a service for businesses.
12. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections, hashed passwords, signed QR codes on tickets, hashed scanner access codes and access controls.
13. Changes to this policy
We may update this Privacy Policy. We will publish the new version on this page with its effective date, and notify account holders by email of material changes.