Privacy notice

1. Introduction

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and, where applicable, the UK General Data Protection Regulation and the Data Protection Act 2018, and describes how personal data are processed in relation to users of the Smappo platform (the "Platform") and to persons contacted by Smappo for commercial purposes.

2. Controller

2.1. The controller is Smappo Ltd ("Smappo" or the "Controller"). The Controller may be contacted on any matter relating to the processing of personal data at privacy@smappo.com.

3. Roles in the processing: Smappo and Organisers

3.1. Data provided when registering for an event (for example, name, email and answers to the form's questions) are disclosed to the event organiser, who processes them as an independent controller for the purpose of managing attendance, in accordance with its own privacy notice, made available through the Platform where provided by the organiser. The organiser is solely responsible for the information it requests from attendees, including any information of a personal nature, such as food allergies or intolerances.

3.2. Smappo processes personal data as an independent controller for the purpose of providing the service and for the further purposes described in this notice.

4. Categories of personal data processed

(a) Account data: first name and surname, email address, country of residence, password stored in encrypted form, language preference, any two-step verification key.

(b) Registration data: first name, surname, email address and other information, where requested directly by the organiser; data relating to tickets issued, admission to the event and any cancellations.

(c) Payment data: amounts, currency, payment status, refunds and disputes. Payment card data are processed exclusively by Stripe and are never accessible to Smappo.

(d) Organiser and ambassador data: name, logo, description, contact details, social media profiles, data relating to sales and shares earned; for ambassadors, the tax details provided for the yearly statement of payments (full name or company name, tax identification or VAT number, home address).

(e) Support request data: content of messages exchanged with the support team and related metadata.

(f) Campaign data: campaign identifier, use of promotional codes, any objection to further communications; where a gift code is requested, first name and surname, email address and type of events organised.

(g) Technical data: logs of sign-ins and main activities, IP address, device type, operating system and browser.

(h) Waiting list data: the email address left on the smappo.com launch page, the date and time of consent, the text of the consent given, the browser language and, where present, the identifier of the campaign the visit came from.

(i) Organisers' billing details: if they have a VAT number, the number and the business name and address shown by the European Commission's VIES register, which we consult to check it; the invoices for Smappo's fees issued to them, one per event, kept for the period required by accounting law even after the account is deleted.

5. Purposes and legal bases of the processing

(a) Provision of the service (creation and management of the account, registrations, issue of tickets, management of payments, refunds, waitlists and ambassador shares, support): performance of a contract or of pre-contractual measures (Article 6(1)(b) GDPR).

(b) Compliance with legal obligations, including tax, accounting and reporting obligations: Article 6(1)(c) GDPR.

(c) Security of the Platform, prevention of fraud and abuse, establishment, exercise or defence of legal claims: legitimate interest of the Controller (Article 6(1)(f) GDPR).

(d) Promotional communications from Smappo or the organiser to registered users: consent of the data subject (Article 6(1)(a) GDPR), which is always optional and may be withdrawn at any time.

(e) Retention of the list of addresses that have objected to further communications, to ensure that the objection is respected over time: compliance with a legal obligation and legitimate interest of the Controller (Article 6(1)(c) and (f) GDPR).

(f) Sending the gift code requested by the data subject and verifying compliance with its conditions, including the allocation of a single code per person and to new accounts only: pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR) and legitimate interest of the Controller in preventing fraud and abuse (Article 6(1)(f) GDPR).

(g) Sending the notice that Smappo has reopened and communications about what is new at Smappo to the addresses on the waiting list: consent of the data subject, given by ticking the dedicated box in the form, which is not pre-ticked (Article 6(1)(a) GDPR). Consent may be withdrawn at any time, through the unsubscribe link included in every communication or by writing to privacy@smappo.com, without affecting the lawfulness of processing based on consent before its withdrawal.

6. Whether provision of data is mandatory

Provision of the data marked as mandatory is necessary to create an account, register for events and make payments; failure to provide them will prevent use of the relevant services. Provision of optional data and the giving of consent are voluntary and do not condition use of the service.

7. Recipients of the data

Data may be disclosed to: (a) the organisers of the events for which the data subject registers, as independent controllers; (b) the companies of the Stripe group (Stripe Payments Europe, Limited or Stripe Payments UK, Ltd., depending on the organiser's country), for payment processing and identity verification of account holders; (c) public authorities, where required by law. Data are neither sold nor disclosed to third parties for their own marketing purposes. Smappo also uses, as processors, technical service providers that host the Platform and send service communications (Amazon Web Services, with servers in the European Union). Waiting list addresses are stored on the same Amazon Web Services servers in the European Union, and the related communications are sent through the Amazon Web Services email service (Amazon SES).

8. International transfers

Where data are transferred to countries outside the European Economic Area or the United Kingdom, the transfer is based on an adequacy decision of the European Commission (including that concerning the United Kingdom) or, failing that, on the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. A copy of the safeguards adopted may be requested from the Controller.

9. Retention period

(a) Account data: for the duration of the relationship and until deletion is requested, subject to any further retention obligations under the law.

(b) Registration and payment data: for the period necessary to manage the event and thereafter for the period required by tax and accounting law, namely 10 years for accounting data.

(c) Support request data: 24 months from closure of the request.

(d) Campaign data: 24 months from the last contact, unless an objection is made.

(e) Suppression list: for as long as necessary to ensure the objection is respected, limited to the address and the date of the objection.

(f) Technical data and security logs: 12 months.

(g) Waiting list data: until consent is withdrawn and, in any case, no longer than 24 months from the last communication sent or, if none has been sent, from sign-up.

10. Rights of the data subject

10.1. The data subject has the right to obtain from the Controller, where applicable, access to personal data, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest and, in any event, to processing for direct marketing purposes (Articles 15 to 22 GDPR). The data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

10.2. These rights may be exercised by writing to privacy@smappo.com. The Controller shall respond without undue delay and in any event within one month of receipt of the request, extendable where provided by law.

10.3. The data subject has the right to lodge a complaint with the supervisory authority of the State of their habitual residence, place of work or place of the alleged infringement (in the United Kingdom, the Information Commissioner's Office; in Ireland, the Data Protection Commission).

11. Security

The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of communications, storage of passwords in encrypted form, access control and logging of administrative operations.

12. Changes to this notice

The Controller reserves the right to amend this notice. The version in force is always published on this page, stating the date of update; material changes are notified to registered users.