Eventyora Data Retention Policy
Version 1.0 – effective 27 Oct 2026
On this page
1. Principle
We keep personal data only as long as needed for the purpose, the contract or the law. Then we delete it or make it anonymous. For guest data the organizer decides the period inside the limits below; we follow its instructions.
2. Retention table
| Data | Role | Kept for | What happens after | Source |
|---|---|---|---|---|
| Organizer account (name, work email, phone, role) | Eventyora controller | While the account is active | Deleted or anonymised when the account is closed (self-service delete in profile), except items below | Contract |
| Invoices and payment records of Eventyora to the organizer | Eventyora controller | Period required by accounting and tax law (usually 5 years; up to 10 years for some registers) | Deleted | Legal obligation |
| Security and access logs | Eventyora controller | Limited period, as long as needed for security | Deleted automatically | Legitimate interest |
| Support emails | Eventyora controller | As long as needed for the case and legal time limits | Deleted | Legitimate interest |
| Marketing contact (prospect) | Eventyora controller | Until consent is withdrawn | Deleted | Consent |
| Guest answers and registration data of people who never paid (people who started a ticket and answered its questions but no ticket was issued) | Organizer controller | 30 days after the event (dated event: 30 days after the end, or start + 1 day if no end; undated drafts: 30 days after last activity) | Erased automatically by an automatic routine (running since 26 Oct 2026): answers removed and identity fields anonymised in place; rows are not deleted, so organizer counts stay correct. A person who paid for another event is kept for that event | Data minimisation |
| Paid orders, tickets, payment status, check-in | Organizer controller | As long as the organizer needs them and the law requires | Anonymised or deleted on the organizer's instruction | Contract / legal |
| Special-category answers (diet, health) | Organizer controller | Only for the event, delete soon after it. The organizer should delete as soon as the answer is no longer needed | Deleted | Art. 9 GDPR |
| Photos, messages and questions in the guest app | Organizer controller | Set by the organizer | Deleted on organizer's instruction | Organizer's basis |
| Contract signature records (CRM) | Organizer controller | As long as the contract record exists in the organizer's CRM plus the legal period for contracts | Deleted with the contract | Contract |
| Device tokens for push | Organizer / Eventyora | Until the user turns off notifications or removes the app | Deleted | Consent |
| Backups | Eventyora processor | Limited rolling cycle | Overwritten. Deleted data leaves backups at the end of that cycle | Security |
| Data after contract end | Eventyora processor | Export window 30 days | Deleted within 60 days; backups on their cycle | DPA clause 11 |
3. How deletion works in the product
- Account deletion: the owner can delete the account from the profile. The deletion routine removes personal data across the apps, with a safeguard that blocks it while another erase is in progress. Organizer-owned records that the law requires to keep are separated first.
- Erasure for people who never paid: runs automatically (since 26 Oct 2026) by the rule above. It applies to events that ask questions before the ticket is issued; where that option is not in use, no data is in scope. It erases the answers instead of leaving them; a buyer who paid for another event is kept for that event.
- Platform deletion tooling in the admin: PURGE and ER routines were rehearsed on copies before use.
4. Legal hold
If a court, an authority or a dispute requires, we suspend deletion for the data concerned, only for what is needed and as long as needed.
5. Requests from people
A person who asks to delete, access or correct their data gets an answer within one month. Requests: privacy@eventyora.com. For guest data we pass the request to the organizer and help.
6. Review
Eventyora reviews this policy once a year and after any change in the product that stores new personal data.
Last updated: 27 Oct 2026