Privacy notice

1. Introduction

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR") and, where applicable, the UK General Data Protection Regulation and the Data Protection Act 2018, and describes how personal data are processed in relation to users of the Smappo platform (the "Platform") and to persons contacted by Smappo for commercial purposes.

2. Controller

2.1. The controller is Smappo Ltd ("Smappo" or the "Controller"). The Controller may be contacted on any matter relating to the processing of personal data at privacy@smappo.com.

3. Roles in the processing: Smappo and Organisers

3.1. Data provided when registering for an event (for example, name, email and answers to the form's questions) are disclosed to the event organiser, who processes them as an independent controller for the purpose of managing attendance, in accordance with its own privacy notice, made available through the Platform where provided by the organiser. The organiser is solely responsible for the information it requests from attendees, including any information of a personal nature, such as food allergies or intolerances.

3.2. Smappo processes personal data as an independent controller for the purpose of providing the service and for the further purposes described in this notice.

4. Categories of personal data processed

(a) Account data: first name and surname, email address, password stored in encrypted form, language preference, any two-step verification key.

(b) Registration data: first name, surname, email address and other information, where requested directly by the organiser; data relating to tickets issued, admission to the event and any cancellations.

(c) Payment data: amounts, currency, payment status, refunds and disputes. Payment card data are processed exclusively by Stripe and are never accessible to Smappo.

(d) Organiser and ambassador data: name, logo, description, contact details, social media profiles, data relating to sales and shares earned; for ambassadors, the tax details provided for the yearly statement of payments (full name or company name, tax identification or VAT number, home address).

(e) Support request data: content of messages exchanged with the support team and related metadata.

(f) Campaign data: campaign identifier, use of promotional codes, any objection to further communications; where a gift code is requested, first name and surname, email address and type of events organised.

(g) Technical data: access logs, IP address.

5. Purposes and legal bases of the processing

(a) Provision of the service (creation and management of the account, registrations, issue of tickets, management of payments, refunds, waitlists and ambassador shares, support): performance of a contract or of pre-contractual measures (Article 6(1)(b) GDPR).

(b) Compliance with legal obligations, including tax, accounting and reporting obligations: Article 6(1)(c) GDPR.

(c) Security of the Platform, prevention of fraud and abuse, establishment, exercise or defence of legal claims: legitimate interest of the Controller (Article 6(1)(f) GDPR).

(d) Promotional communications from Smappo or the organiser to registered users: consent of the data subject (Article 6(1)(a) GDPR), which is always optional and may be withdrawn at any time.

(e) Retention of the list of addresses that have objected to further communications, to ensure that the objection is respected over time: compliance with a legal obligation and legitimate interest of the Controller (Article 6(1)(c) and (f) GDPR).

(f) Sending the gift code requested by the data subject and verifying compliance with its conditions, including the allocation of a single code per person and to new accounts only: pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR) and legitimate interest of the Controller in preventing fraud and abuse (Article 6(1)(f) GDPR).

6. Whether provision of data is mandatory

Provision of the data marked as mandatory is necessary to create an account, register for events and make payments; failure to provide them will prevent use of the relevant services. Provision of optional data and the giving of consent are voluntary and do not condition use of the service.

7. Recipients of the data

Data may be disclosed to: (a) the organisers of the events for which the data subject registers, as independent controllers; (b) the companies of the Stripe group (Stripe Payments Europe, Limited or Stripe Payments UK, Ltd., depending on the organiser's country), for payment processing and identity verification of account holders; (c) public authorities, where required by law. Data are neither sold nor disclosed to third parties for their own marketing purposes. Smappo also uses, as processors, technical service providers that host the Platform and send service communications (Amazon Web Services, with servers in the European Union).

8. International transfers

Where data are transferred to countries outside the European Economic Area or the United Kingdom, the transfer is based on an adequacy decision of the European Commission (including that concerning the United Kingdom) or, failing that, on the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. A copy of the safeguards adopted may be requested from the Controller.

9. Retention period

(a) Account data: for the duration of the relationship and until deletion is requested, subject to any further retention obligations under the law.

(b) Registration and payment data: for the period necessary to manage the event and thereafter for the period required by tax and accounting law, namely 10 years for accounting data.

(c) Support request data: 24 months from closure of the request.

(d) Campaign data: 24 months from the last contact, unless an objection is made.

(e) Suppression list: for as long as necessary to ensure the objection is respected, limited to the address and the date of the objection.

(f) Technical data and security logs: 12 months.

10. Rights of the data subject

10.1. The data subject has the right to obtain from the Controller, where applicable, access to personal data, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interest and, in any event, to processing for direct marketing purposes (Articles 15 to 22 GDPR). The data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

10.2. These rights may be exercised by writing to privacy@smappo.com. The Controller shall respond without undue delay and in any event within one month of receipt of the request, extendable where provided by law.

10.3. The data subject has the right to lodge a complaint with the supervisory authority of the State of their habitual residence, place of work or place of the alleged infringement (in the United Kingdom, the Information Commissioner's Office; in Ireland, the Data Protection Commission).

11. Security

The Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including encryption of communications, storage of passwords in encrypted form, access control and logging of administrative operations.

12. Changes to this notice

The Controller reserves the right to amend this notice. The version in force is always published on this page, stating the date of update; material changes are notified to registered users.