Privacy Policy
Last updated: 26 September 2026
At Eventus, we are committed to protecting our users' privacy. This Privacy Policy aims to inform you about how we collect, use, store, and protect your personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
1. Identity of the data controller
- Controller: Eventus
- Postal address: Calle Saturnino Baquer, 22003 Huesca, Spain
- Email: [email protected]
2. Personal data we collect
Depending on your interaction with the Platform, we may collect the following categories of personal data:
2.1. Registration and account data
- Full name
- Email address
- Password (stored in encrypted form using bcrypt)
- Preferred language
2.2. Business/professional data
- Company name or legal entity name
- Tax ID (NIF/CIF)
- Address, city, postal code, and country
- Company phone and email
- Corporate logo (image uploaded by the user)
- Currency, timezone, and date format preferences
- Payment settings and payment note templates
2.3. User's client data
Users enter data about their own clients on the Platform. In this context, the user acts as the data controller for their clients' data and Eventus acts as the data processor. This data may include:
- Name, email, phone number
- Full postal address
- Tax ID (NIF/CIF)
- Preferred language for quotes
2.4. Quote, event, and payment data
- Quotes: number, date, line items, amounts, VAT, and status
- Events: name, description, dates, venue, guest count, tasks, and notes
- Event payments: amount, date, description, and payment method
- Products and services: name, description, category, and prices
2.5. Company logo
- Logo image provided by the user
- Conversion of the logo to PNG format for use on the Platform
- Logo reference associated with the business account
2.6. Team and collaboration data
- Team membership and assigned roles
- Invitations: email address, invitation token, expiry date
- Permissions by resource (events, quotes, clients, and products)
2.7. Technical browser data
The Platform stores the following information in the user's browser (localStorage, not cookies), strictly necessary for the operation of the service:
- JWT access token and session refresh token
- Basic user profile (identifier, name, email)
- Visual theme preference
- Language, currency, timezone and date format
- Technical state of the initial setup process
2.8. Access requests
- Name
- Email address
- Company or professional activity
- Optional information about current tools and workflow
3. Purposes of processing
Your personal data is processed for the following purposes:
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Handling and evaluating requests for access to Eventus | Data subject consent (Art. 6(1)(a)) |
| Managing user registration and accounts | Performance of a contract (Art. 6(1)(b)) |
| Providing Platform services (event management, quotes, payments, and clients) | Performance of a contract (Art. 6(1)(b)) |
| Managing team invitations | Performance of a contract (Art. 6(1)(b)) |
| Generating branded quote PDFs | Performance of a contract (Art. 6(1)(b)) |
| Retaining quotes, events, and payment records | Performance of a contract (Art. 6(1)(b)) |
| Service-related communications (terms changes, security notices) | Legitimate interest (Art. 6(1)(f)) |
| Improving and maintaining Platform security | Legitimate interest (Art. 6(1)(f)) |
4. Data recipients
Your personal data will not be disclosed to third parties, except in the following cases:
4.1. Data processors
| Provider | Service | Data processed | Location |
|---|---|---|---|
| Resend (Resend, Inc.) | Transactional email delivery | Recipient email address and service notification content | United States (with adequate safeguards) |
| Stripe | Subscription payments and billing portal | Name, email, internal identifier, subscription and payment information | European Union and other countries under its contractual safeguards |
| Hetzner | Hosting of the application, databases, and logos | Account, business, client, event, quote, and technical log data | European Union |
| Cloudflare | Network, security, proxy and administrative access control | IP address, HTTP headers, identifiers and technical security events | Global network, subject to applicable international transfer safeguards |
4.2. Legal obligations
Data may be disclosed to competent authorities (Tax Agency, Courts and Tribunals, Law Enforcement) when required by applicable legislation.
5. International data transfers
Some technology providers may process data outside the European Economic Area. Where required, transfers will rely on an adequacy decision, the EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as applicable to the provider and service.
Eventus's primary infrastructure and database are hosted in the European Union. You may request details of the applicable safeguards at [email protected].
6. Data retention periods
| Data category | Retention period |
|---|---|
| User account data | While the account remains active. After closure, data will be erased or restricted according to its purpose and applicable legal periods |
| Quotes | While the account remains active or until deleted by the user |
| Events and payments | While the account remains active or until deleted by the user |
| User's client data | While the account remains active or until deleted by the user |
| Team data and invitations | While the team remains active. Expired invitations are retained only for the necessary technical period and removed through the cleanup procedure |
| Access requests | For the time needed to respond to and evaluate the request, up to a maximum of 12 months |
7. Data subject rights
In accordance with the GDPR and LOPDGDD, you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR): obtain confirmation of whether we are processing your data and access it.
- Right to rectification (Art. 16 GDPR): request the correction of inaccurate or incomplete data.
- Right to erasure (Art. 17 GDPR): request the deletion of your data when it is no longer necessary, you withdraw consent, or you object to processing, unless there is a legal obligation to retain it.
- Right to object (Art. 21 GDPR): object to the processing of your data in certain circumstances.
- Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used, and machine-readable format.
- Right to restriction of processing (Art. 18 GDPR): request restriction of the processing of your data in the cases provided by the GDPR.
- Right not to be subject to automated decisions (Art. 22 GDPR): Eventus does not carry out automated decisions or profiling.
How to exercise your rights
To exercise any of these rights, including account closure and erasure, you may write free of charge to [email protected] from the email associated with your account, including:
- Your full name and the email address associated with your account.
- The right you wish to exercise.
- Only where reasonable doubts about identity exist, the minimum additional information requested to verify it.
We will respond to your request within a maximum of one month from receipt, which may be extended by a further two months for complex or numerous requests, in accordance with Article 12(3) of the GDPR.
Complaint to the supervisory authority
If you consider that the processing of your personal data does not comply with applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
- Website: www.aepd.es
- Address: C/ Jorge Juan, 6 — 28001 Madrid, Spain
8. Security measures
At Eventus, we implement appropriate technical and organisational measures to ensure the security of personal data in accordance with Article 32 of the GDPR, including:
- Password encryption: passwords are stored using bcrypt hashing (10 salt rounds), making plain-text recovery impossible.
- JWT authentication: API access uses a short-lived signed token and a revocable refresh token with a maximum 7-day expiry.
- Data isolation (multi-tenancy): each user can only access their own data. All queries are filtered by user identifier.
- Role-based access control: teams have granular permissions per resource.
- Data validation: all inputs are automatically validated and sanitised before processing.
- Information protection: access to data is limited through authentication and role-based permissions.
- Encrypted communications: all communication between the browser and server is conducted over HTTPS (TLS).
9. Minors
The Platform is not intended for persons under 18 years of age. If you become aware that a minor has provided personal data without parental consent, please contact us so we can proceed with its deletion.
10. Updates to this policy
Eventus reserves the right to update this Privacy Policy to adapt it to legislative developments or changes in data processing. The date of the last update will always be indicated at the top of this page.
In the event of material changes, registered users will be notified via the email address associated with their account.
11. Contact
For any enquiries regarding this Privacy Policy or the processing of your personal data, you may contact us at:
- Email: [email protected]
- Postal address: Calle Saturnino Baquer, 22003 Huesca, Spain