Privacy Policy.

What personal data we collect, why, on what legal basis, with whom we share it, and what rights you have. It is written in a way that is easy to understand.

1. Who processes your data?

The controller within the meaning of Regulation (EU) 2016/679 (GDPR) is:

We are not required to appoint a data protection officer under Article 37 of the GDPR. Please email the address provided with any enquiries.

2. What data do we collect and why?

2.1 Registration for the evening

Data: first name and surname, email address, company or role (optional), IP address and time of submission.
Objective: to plan the capacity, send you a confirmation and let you know if the venue or time changes.
Reason: Article 6(1)(b) of the GDPR — taking steps at your request prior to entering into a contract; regarding the IP address and time — Article 6(1)(f), legitimate interest in protecting against spam and misuse of the form.

2.2 Annual partnership

Data: First name and surname or company name, EIK and VAT number, billing address, email address, contact person, amount and payment history, logo and catalogue description.
Objective: conclusion and performance of the contract, issuing invoices, bookkeeping and tax reporting.
Reason: Article 6(1)(b) — performance of the contract; Article 6(1)(c) — compliance with legal obligations under the Accounting Act and the Value Added Tax Act.

2.3 Questionnaire and feedback

Data: survey responses, name, email address, company, the text of the review, and your explicit choice as to whether we should publish it and whether to include your name.
Objective: to help us improve our events and, if you agree, to publish your review on our website and on social media.
Reason: for the analysis of the questionnaire — Article 6(1)(f), legitimate interest; For the publication of a review under your name — specifically Article 6(1)(a) — your consent is required.

Consent may be withdrawn by sending a letter at any time and without giving a reason. Withdrawal does not affect the lawfulness of processing carried out prior to it. Following withdrawal, we remove the review from our channels and request de-indexing from search engines, but we have no control over third-party caches or internet archives.

2.4 Photos and videos from the events

Data: an image, and in the case of video and audio, together with the context of the photo.
Objective: documenting the community and promoting upcoming events.
Reason: for general and panoramic shots in which an individual is a detail within an image of a gathering — Article 6(1)(f), legitimate interest, where we have assessed that our interest does not override your rights only insofar as the photograph is not a portrait; for portrait photographs and for use in advertising materials — Article 6(1)(a), consent.

In addition to the GDPR, Article 13 of the Copyright and Related Rights Act also applies. Consent is required for portrait images; an exception applies where the person is merely a detail in an image depicting a gathering.

We do not photograph anyone under the age of 18 without the consent of a parent or guardian.

2.5 Correspondence

Data: the content of your letters and the address from which you are writing.
Objective: to respond and follow up on the matter.
Reason: Article 6(1)(f): a legitimate interest in conducting correspondence; and, in the case of a contractual enquiry, point (b).

2.6 What we do not collect

We do not collect special categories of data as defined in Article 9 of the GDPR: ethnic origin, political opinions, religion, health status, sexual orientation or biometric data. Please do not enter such data in the free-text fields. We do not carry out automated decision-making or profiling as referred to in Article 22 of the GDPR.

3. How long do we keep the data?

What	How much	Why
Evening bookings	24 months after the event	Feedback and invitations to future meetings
Invoices and accounting documents for partnerships	11 years	Article 12 of the Accounting Act and Article 121 of the Value Added Tax Act in conjunction with Article 171 of the Tax and Social Security Procedure Code
Contractual correspondence with partners	5 years after the end of the contract	Limitation period under Article 110 of the Obligations and Contracts Act
Published reviews	Until consent is withdrawn	Consent
Record of consent given	3 years after his retirement	Evidence pursuant to Article 7(1) of the GDPR
Photos and videos from events	5 years or until an objection is raised	Community Archive
Technical logos	6 months	Security
Cookie Consent Log	Validity period plus 3 years	Evidence pursuant to Article 7(1) of the GDPR

Once the retention period has expired, the data is permanently deleted or anonymised.

4. Who we share data with

We do not sell data. We do not pass it on to the host venue, partners or other participants. Access is restricted to those suppliers without whom the service cannot operate.

4.1 Payments

Stripe acts partly as a data processor on our behalf in accordance with Article 28 of the GDPR and partly as an independent data controller for its own purposes of fraud prevention and compliance with financial regulatory requirements. Stripe processes your name, email address, billing address, payment amount, IP address and device data.

Part of the processing is carried out by Stripe in the United States. The transfer is based both on the adequacy decision concerning the EU–US Privacy Shield under Article 45 of the GDPR and on standard contractual clauses under Article 46, (2)(c) of the GDPR.

4.2 Statistics and marketing

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — Google Analytics 4, acting as our data processor. Data is also transferred to Google LLC in the USA on the basis of the EU–US Privacy Shield Framework and standard contractual clauses. It is loaded only with your consent.

Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland — Meta Pixel. For the collection and transmission of event data, we and Meta are joint controllers pursuant to Article 26 of the GDPR. The division of responsibilities is as follows: we are responsible for providing the information under Article 13 of the GDPR and for obtaining your consent; Meta is responsible for the exercise of your other rights and for the security of the processing following the transfer. Following the transfer, Meta processes the data as an independent controller for its own purposes. You may exercise your rights directly against Meta. Details of the arrangement can be found in the Meta Administrators’ Supplement. The pixel is only loaded once you have given your consent.

4.3 Technical infrastructure

• [NAME AND ADDRESS OF THE HOSTING PROVIDER] — website and database storage.
• [NAME AND EMAIL ADDRESS OF THE SUPPLIER] — sending and receiving emails.
• [NAME OF THE SUPPLIER OF FORMS OR QUESTIONNAIRES] — collecting registrations and questionnaires.

We have a contract in place with each data processor in accordance with Article 28 of the GDPR.

4.4 Bodies

We only provide data to public authorities where we are required to do so by law and within the scope of the request.

5. Your rights

• Access — a copy of the data we hold about you.
• Correction — correction of inaccurate data.
• Delete — deletion, provided that we are not required by law to retain the document.
• Restriction — temporary suspension of processing.
• Portability — receiving the data in a machine-readable format.
• Objection — against processing on the grounds of legitimate interest, including against the publication of a photograph.
• Withdrawal of consent — at any time, without this affecting the lawfulness of the processing prior to the withdrawal.

Write to hello@gabrovoinformal.com. We will reply within one month in accordance with Article 12(3) of the GDPR. There are no forms to fill in and no fees to pay.

6. Right to appeal

7. Security

The website operates via HTTPS. Data is stored in a secure database with restricted access. Only those responsible for organising events and managing the accounts have access.

8. Children

These events are for people aged 16 and over. We do not knowingly collect data from people under this age. If we become aware that we have received such data, we will delete it immediately.

9. Cookies

Further details can be found in Cookie Policy, and you can change your selection at any time from cookie settings.

10. Changes

When changes are made, we publish the new version here with an updated date. In the event of significant changes affecting a consent that has already been given, we will notify you by email.