Privacy Policy

This Privacy Policy applies to personal data collected and processed by Eventfo in connection with your use of our Services. It covers data collected through our website at eventfo.co.uk, our mobile application, and our organiser platform.

This Policy should be read alongside our Terms & Conditions, which govern your use of the Services. By using the Services, you acknowledge that you have read and understood this Privacy Policy.

Eventfo is the data controller responsible for your personal data. As data controller, we determine the purposes and means of processing your personal data in connection with the Services.

We are registered with the Information Commissioner's Office (ICO) under registration number C1932673.

If you have any questions about this Privacy Policy or our data practices, please contact us at legal@eventfo.co.uk.

3.1 Information You Provide

• Account information: your full name, email address, and password when you register.
• Business account information: your company name if you register as an event organiser.
• Profile information: any optional profile details you choose to add.
• Event preferences: event categories and interests you select during onboarding or in your settings, used to personalise your event recommendations.
• Push notification subscription data: a device-specific push subscription token generated by your browser when you enable push notifications. This token is used solely to deliver event reminders to your device.
• Event listings: event names, descriptions, dates, locations, images, vendor details, and schedules submitted by organisers.
• Communications: messages or enquiries you send to us via email or our contact form.

3.2 Information We Collect Automatically

• Usage data: pages visited, events viewed, event impressions (a record that an event was displayed to you in a list, rail, or search result), event card taps, reminders set or removed, vendor interactions (including section views, menu views, and likes), performer section views, gallery image opens, map interactions, and external link clicks.
• Advertising interaction data: whether an advertisement was displayed to you (an impression) and whether you clicked on it. This data is linked to an anonymous session identifier, not your account.
• Device and technical data: browser type, operating system, IP address, and app performance logs.
• Session data: a randomly generated session identifier stored in your browser's session storage for the duration of your visit.
• Authentication data: secure identifiers generated when you log in, including via third-party providers such as Google.

3.3 Information from Third Parties

If you choose to register or log in using Google OAuth, we receive your name and email address from Google as part of the authentication process. We do not receive your Google password or any other data beyond what is necessary to create your account.

We collect personal data in the following ways:

• Directly from you when you register an account, complete your profile, submit event listings, or contact us.
• Automatically through your use of the Services, via cookies and similar technologies (where you have consented).
• From third-party authentication providers (e.g. Google) when you choose to sign in using those services.

In addition to the personal data above, Eventfo operates as an independent events guide and compiles some event listings (such as event names, dates, venues, and descriptions) from publicly available sources. This event information is factual listing content rather than personal data about you as an attendee. If you are an organiser and wish to claim, correct, or remove an independently compiled listing, you can do so at eventfo.co.uk/claim.

We process your personal data only where we have a valid legal basis to do so under UK GDPR Article 6. The legal bases we rely on are:

5.1 Contract Performance

Processing necessary to provide the Services you have requested, including creating and managing your account, enabling event discovery, and delivering reminders and notifications.

5.2 Consent

Processing based on your specific, informed consent - in particular, the use of analytics cookies and tracking technologies. You may withdraw your consent at any time by updating your cookie preferences or contacting us.

5.3 Legitimate Interests

Processing necessary for our legitimate business interests, including improving the Services, preventing fraud, maintaining platform security, and monitoring for technical errors - provided those interests are not overridden by your rights and interests.

5.4 Legal Obligation

Processing necessary to comply with a legal obligation to which we are subject under UK law, including applicable data protection, tax, and regulatory requirements.

We use the personal data we collect for the following purposes:

• To create, manage, and maintain your Eventfo account.
• To provide the core features of the Services, including event discovery, reminders, calendar integration, and notifications.
• To allow event organisers to create, publish, and manage event listings and associated content.
• To personalise your experience, including remembering your preferences and showing you relevant events.
• To send you service-related communications, such as account verification emails, password reset emails, and important updates about the Services.
• To send you event reminders and notifications where you have enabled them.
• To monitor, analyse, and improve the performance and features of the Services (where you have consented to analytics).
• To provide event organisers with aggregated, anonymised analytics dashboards showing how users interact with their events, including impressions (how often an event was displayed), page views, event card taps, reminder rates, external link clicks, vendor engagement, and section-level activity.
• To provide advertisers with anonymised campaign performance reports, including impression counts, click counts, and click-through rates for their advertisements. These reports are accessible via a secure, token-protected URL and do not include any information that identifies individual users.
• To detect, investigate, and prevent fraudulent, abusive, or unlawful activity.
• To respond to your enquiries, complaints, and support requests.
• To comply with our legal and regulatory obligations.

7.1 What Are Cookies

Cookies are small text files placed on your device when you visit our website. We also use similar technologies such as session storage identifiers. Some are essential for the Services to function; others require your consent.

7.2 Cookies We Use

• Essential cookies: authentication session cookies set by Supabase to keep you logged in. These are strictly necessary and cannot be disabled without affecting your ability to use the Services.
• Analytics cookies: we use a first-party analytics system to record interactions such as pages visited, events viewed, vendor and performer engagement, and advertisement impressions and clicks. These are only set after you have given your consent via our cookie banner.
• Error monitoring: we use Sentry to capture technical errors. This runs as a legitimate interest to maintain platform security and stability.

7.3 Your Choices

When you first visit the Services, you will be shown a cookie banner asking for your consent to analytics cookies. You may accept or decline. If you decline, no analytics data will be collected. You can change your preference at any time by clearing your browser's local storage or contacting us.

We do not sell your personal data. We may share your information only in the following limited circumstances:

8.1 Service Providers

We use trusted third-party service providers to help us operate the Services. These providers act as data processors on our behalf under written agreements, and are only permitted to process your data in accordance with our instructions and for no other purpose:

• Supabase (Supabase Inc., USA) - database, user authentication, and file storage. Your account data, event data, and authentication credentials are stored on Supabase infrastructure.
• Sentry (Functional Software Inc., USA) - error monitoring and crash reporting. Sentry may receive technical diagnostic data such as error messages and stack traces. We have disabled the collection of personally identifiable information within Sentry.
• Vercel (Vercel Inc., USA) - website hosting, content delivery, and server-side rendering. Vercel processes request data including IP addresses as part of serving the platform.
• Resend (Resend Inc., USA) - transactional email delivery. Resend processes your email address when we send you account-related emails such as password resets and verification messages.
• Google (Google LLC, USA) - authentication only, via Google OAuth. If you choose to sign in with Google, your name and email address are shared with us by Google as part of the authentication flow. We do not receive any other Google account data.

8.2 Legal Requirements

We may disclose your personal data if required to do so by law, court order, or regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Eventfo, our users, or the public.

8.3 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your personal data may be transferred to the relevant third party as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

8.4 With Your Consent

We may share your data with other third parties where you have given your explicit consent for us to do so.

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law.

• Account data: retained for the duration your account is active. If you delete your account, we will mark it as inactive and will permanently delete your personal data within 90 days, unless we are required to retain it for legal or regulatory purposes.
• Event preferences: retained for the life of your account and deleted alongside it.
• Push notification tokens: retained until you disable notifications in your settings or delete your account.
• Event listings: retained while the organiser account is active. Organisers may delete their own listings at any time.
• Analytics data: retained in aggregated or pseudonymised form for up to 24 months.
• Error logs: retained for up to 90 days for security and diagnostic purposes.
• Communications: retained for up to 3 years from the date of last contact for customer support purposes.

After the applicable retention period, your data will be securely deleted or anonymised.

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access: you have the right to request a copy of the personal data we hold about you.
• Right to rectification: you have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure: you have the right to request that we delete your personal data in certain circumstances (the 'right to be forgotten').
• Right to restriction of processing: you have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: you have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of these rights, please contact us at legal@eventfo.co.uk. We will respond to your request within one calendar month. We may ask you to verify your identity before processing your request.

The Services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you are between 13 and 17, you may only use the Services with the verifiable consent of a parent or legal guardian, as set out in our Terms & Conditions.

If we become aware that we have collected personal data from a child under 13 without appropriate consent, we will take steps to delete that data promptly. If you believe we may have collected data from a child under 13, please contact us immediately at legal@eventfo.co.uk.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit using HTTPS/TLS.
• Encryption of data at rest within our database infrastructure.
• Access controls limiting who within our organisation can access personal data.
• Authentication security including password complexity requirements and support for third-party OAuth providers.
• Error monitoring and security logging to detect and respond to potential threats.

While we take all reasonable steps to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.

The Services may contain links to third-party websites, applications, or services - including event social media pages and external mapping services. These third-party services are not operated by Eventfo and are not subject to this Privacy Policy. We have no control over and accept no responsibility for the privacy practices of those third parties.

We encourage you to review the privacy policies of any third-party services you access through links on our platform before providing any personal data to them.

Some of our third-party service providers are based outside the United Kingdom and process your personal data in countries that may not provide the same level of data protection as the UK. Where such transfers occur, we ensure that appropriate safeguards are in place as required by UK GDPR Article 46.

The safeguards we rely on for each provider are as follows:

• Supabase (USA) - we use Supabase's EU-hosted region where data is stored within the European Economic Area (EEA), which benefits from a UK adequacy decision. Supabase also provides a Data Processing Agreement (DPA) incorporating UK-approved Standard Contractual Clauses (SCCs).
• Sentry (USA) - Sentry provides a DPA incorporating UK-approved Standard Contractual Clauses.
• Vercel (USA) - Vercel provides a DPA incorporating UK-approved Standard Contractual Clauses and offers EU data residency options.
• Resend (USA) - Resend provides a DPA incorporating Standard Contractual Clauses for international transfers.
• Google (USA) - Google LLC is certified under the EU-US Data Privacy Framework, which the UK has recognised as providing adequate protection. Google also provides Standard Contractual Clauses.

You may request a copy of the relevant safeguards by contacting us at legal@eventfo.co.uk.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where reasonably practicable, notify registered users via email or an in-app notification.

We encourage you to review this Policy periodically. The most current version will always be available at eventfo.co.uk/privacy-policy.

16.1 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

16.2 How to Complain

If you are unhappy with how we have handled your personal data or a request you have made under your data subject rights, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority:

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO, so please contact us in the first instance.