1. Controller and contact
9ne.pl Jarosław StarońPolish Tax ID: 8942787122ul. Starobielawska 32a54-061 Wrocław, Polandcontact@eventnado.comThis entity is the controller of account, authentication, Platform security, service-support and Eventnado operational data. No data protection officer has been appointed; privacy matters can be sent directly to the address above.
2. Eventnado and Organizer roles
For account and Platform operation data, Eventnado decides why and how data is processed and acts as controller. For attendee, club-member or contact data entered by an Organizer for its own event, that Organizer normally acts as controller and Eventnado acts as processor under the Data Processing Agreement.
The Organizer must provide its own attendee privacy notice. Processor terms are available in the Data Processing Agreement.
3. Data, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Account, sign-in and organization membership | email, name, account identifier, roles, language and organization profile | contract performance or steps requested before contract (Art. 6(1)(b) GDPR) |
| Service, support and transactional communication | contact details, message content, delivery status and case references | contract and legitimate interest in reliable support (Art. 6(1)(b), (f)) |
| Security, abuse prevention and accountability | IP-derived hashes, timestamps, device/browser information, security events, actions and audit identifiers | legitimate interest and legal duties (Art. 6(1)(f), where applicable (c)) |
| Complaints, rights requests and illegal-content notices | identity/contact data, request content, evidence, decisions and correspondence | legal obligation, contract and claims (Art. 6(1)(c), (b), (f)) |
| Product improvement and aggregated analytics | feature events, route, time, organization/account pseudonymous identifier; no raw IP in product analytics | legitimate interest in improving a secure service (Art. 6(1)(f)) |
| Optional product or marketing updates | email and communication preferences | consent where required; it can be withdrawn at any time (Art. 6(1)(a)) |
PayU production processing and Eventnado charges are disabled in the free pilot. This Policy will be updated before real payment data is processed through the Platform.
4. Sources and whether data is required
Data comes from you, your Organization, another user inviting you, an Organizer whose form you complete, and technical records generated when the service is used. Account email and authentication data are required to create and protect an account. Fields marked as required are needed for the selected feature; optional profile and marketing data can be omitted.
Eventnado does not make decisions producing legal or similarly significant effects solely by automated means. Compliance assessments and readiness indicators support human decisions and may require verification.
5. Recipients and service providers
Data may be disclosed only as needed to:
- the Organizer and authorized members of the relevant organization;
- OVHcloud entities supporting the VPS, network, DNS, domains and email transport;
- providers operating under the Data Processing Agreement and the current subprocessor list;
- professional advisers or authorities where necessary to establish, exercise or defend claims or comply with law.
Eventnado does not sell personal data or provide it to advertising data brokers.
6. Processing location and transfers
Active production and primary data are hosted on an OVHcloud VPS in the EEA. A disaster-recovery copy is encrypted with AES-256 before leaving the primary server and uploaded over a pinned SFTP connection to an isolated node in Toronto, Canada. The destination receives only encrypted archives and checksums; it has no decryption key and the upload account cannot list or retrieve files.
Readable data will not be made available to a recipient outside the EEA without an applicable GDPR Chapter V mechanism and supplementary safeguards appropriate to risk.
7. Retention
Eventnado uses versioned rules and legal holds. Current operational periods include:
- account data — for the contract and then only as needed for legal obligations, security and claims;
- recipient email in delivery diagnostics — 30 days plus a 7-day grace period; delivery metadata — up to 400 days;
- product analytics — up to 400 days in the current production configuration;
- closed privacy-request contact and content — anonymized after 400 days plus a 30-day grace period, unless an active hold applies;
- Organizer-controlled registration data — current default 365 days, adjustable where product settings and the Organizer’s legal basis allow;
- local backups — current 14-day rotation; encrypted off-site copies — controlled minimum copy/day thresholds and deletion by retention service.
More detail is available under Data retention. A dispute, incident or legal duty may temporarily suspend deletion for the narrowly defined record.
8. Your rights
Depending on the legal basis and circumstances, you may request access, a copy/export, rectification, erasure, restriction or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. You also have the right to complain to your competent supervisory authority.
In Poland the authority is the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl.
We may request proportionate information to verify identity. We normally respond within one month; where GDPR permits an extension, we explain it within the first month.
10. Submit a data request
The form creates a tracked case reference and base deadline. For account deletion, you can also use the dedicated instructions linked below.
Account closure details: Complaints and account deletion.
11. Security and policy changes
Eventnado applies data minimization, role-based access, encrypted transport, private databases and object storage, audit records, file scanning, monitoring, backups and tested recovery procedures. No system is risk-free; suspected incidents should be reported to the contact address without sending secrets.
Material changes are announced through the Platform or account email and receive a new version and effective date. Archived versions are available on request.