Eventyora Privacy Policy

Version 1.0 – effective 27 Oct 2026

1. Who we are

DYNAMIC BTL EVENTS SRL ("Eventyora", "we"), Strada Tudor Arghezi nr. 38, Sector 2, București, România, Trade Register J2015009514405, CUI 34846781. Contact for privacy and data requests: privacy@eventyora.com (general support: help@eventyora.com).

2. Two roles, explained simply

• When you are an organizer, venue or agency customer (or you are a visitor of our site), we decide why and how your account data is used. We are the controller of that data.
• When you are a guest at an event, a ticket buyer or a contact in an organizer's CRM, the organizer decides why and how your data is used. The organizer is the controller; Eventyora is its processor and only follows the organizer's instructions. If you want to use your rights over this data, contact the organizer first (we will help them answer).

3. What data we handle

For organizers (we are the controller)

• Account: name, work email, phone, company details, role, password (stored as a hash), sign-in method.
• Billing: company details, invoices and payment status.
• Use of the service: security logs, device and browser data, IP address, error reports, support messages.
• Marketing: your contact details and preferences, if you ask for information or agree to receive it.

For guests and ticket buyers (the organizer is the controller; we are the processor)

• Identity and contact: name, email, phone.
• Tickets and orders: ticket type, price, payment status, QR code, check-in time.
• Answers to the organizer's questions, which may include sensitive information such as dietary or medical needs. Only the organizer decides to ask and must have a valid legal basis.
• Messages, photos and questions you post in the guest app.
• Signature records on contracts in the CRM (typed name, time, document fingerprint, protected code derived from your IP address, device details, account email).
• Device token for notifications, if you turn them on.

We do not store full card numbers. Payments go directly to Netopia.

4. Why we use data and on what legal basis (GDPR art. 6)

Special-category data (art. 9), such as health or diet answers, is processed only on the organizer's instructions and with the organizer's own valid basis (usually explicit consent).

5. Who we share data with

Only providers that help us run the service, under contracts that require protection of the data (subprocessors). The current list is on the Subprocessors page. In short: hosting (Romarg in Romania, then DigitalOcean in the EU), Mailjet (email), Netopia (card payments), Firebase Cloud Messaging by Google (notifications, when enabled), Google (maps and fonts), Google, Facebook and Apple (social sign-in, if you choose it), OpenAI (AI assistance in the CRM, if used). Organizers connect their own tools, such as SmartBill and WooCommerce; those are the organizer's providers. We also share data when the law or an authority requires it. We do not sell personal data.

6. Data sent outside the EU

Some providers (for example Google, OpenAI, Meta, Apple) are in the United States or may process data there. We use only providers that rely on an approved transfer mechanism, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, as listed on the Subprocessors page.

7. How long we keep data

Short version (full details in the Data Retention Policy):

• Organizer account data: while the account is active, then deleted or anonymised after closing, except what the law requires us to keep (for example invoices and accounting records, for the period the law sets).
• Guest answers of people who never paid: erased 30 days after the event (for undated drafts, 30 days after the last activity).
• Paid orders and tickets: kept for the period the organizer needs them and the law requires, then deleted or anonymised by the organizer's instruction.
• Signature records: as long as the contract exists in the organizer's CRM, plus the legal retention for contracts.
• Backups: limited rolling cycle. Security logs: limited period, as long as needed for security.
• You can delete your account yourself from your profile.

8. Cookies and similar tools

We use only the cookies and browser storage needed to sign you in, keep you safe and remember your display choices. See the Cookie Policy. Some pages load Google Fonts, and maps load only after you click. If you use social sign-in, that provider sets its own cookies on its own site.

9. Your rights

You can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time (this does not affect earlier use). We answer within one month (extendable by up to two months for complex requests).

• If you are a guest: contact the organizer, or write to us and we will pass your request on to the organizer and help.
• If you are an organizer: write to privacy@eventyora.com.

We may need to confirm your identity first.

10. Complaints

You can complain to the Romanian data protection authority, ANSPDCP: B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, București; https://www.dataprotection.ro; anspdcp@dataprotection.ro. You may also go to court.

11. Security

We use measures such as encrypted connections (HTTPS), role-based access with separation between organizers, signed and expiring links, payment validation, logging of sensitive actions and backups. See the Security FAQ and the DPA annex. No system is perfectly secure; if there is a breach that affects you we notify as the law requires.

12. Children

Eventyora is for businesses. Events may include minors as guests; in that case the organizer must obtain parental consent where the law requires it. We do not knowingly create accounts for children under 16.

13. Changes

We will update this policy when something changes and show the date at the top. For important changes we will tell organizers by email.

Last updated: 27 Oct 2026