Privacy Policy
EVENTRA is the workforce management platform for events – from recruiting and shift planning to time tracking and accreditation. Here you can find out which data we process ourselves, and when it is not us but our customers who are responsible for your data.
Last updated:
At a glance
I work for an event organiser or applied through their portal. Who is responsible for my data?
The event organiser or the company you work for. We only provide the software and process your application, shift and time data solely on their behalf. You will find their privacy notice in the respective portal.
Does EVENTRA sell data or use it for advertising?
No. The data our customers manage in EVENTRA belongs to our customers. We do not use it for our own purposes and do not pass it on.
Where is the data stored?
Exclusively in data centres in the EU – at Hetzner and at Amazon Web Services in Frankfurt am Main.
Is AI trained on my data?
No. Our AI features run exclusively in the EU, inputs are not stored by the AI service, and no model is trained on our customers' data.
What does EVENTRA analyse itself?
We look pseudonymously at which features are used and how, in order to improve the platform – never at what you enter. We only set cookies for this analysis with your consent. We do not use advertising or retargeting trackers.
How can I reach you?
1. Controller and data protection officer
1.1 The controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR) for the processing described in this privacy policy is:
EVENTRA GmbHCharlottenweg 2a82049 Pullach im IsartalGermany
Email: info@eventra.app
You will find our authorised managing directors as well as the register court and registration number in our legal notice.
1.2 You can reach our data protection officer at datenschutz@eventra.app or at the address above, marked “– Data Protection Officer –”. You can contact them with any questions about the processing of your personal data and about exercising your rights.
2. Controller or processor – our roles
2.1 EVENTRA provides companies (“customers”) with software for staff management at events as software-as-a-service. Depending on how you come into contact with us, we act in different data protection roles:
| EVENTRA is the controller | The customer is the controller, EVENTRA is the processor (Art. 28 GDPR) | |
|---|---|---|
| Data subjects | Visitors to our website, prospects, customers and their contact persons, applicants for positions at EVENTRA, users of the platform with regard to usage analytics (section 5.1) | Applicants, employees, helpers, volunteers and service-provider staff of our customers |
| Data | Contact, contract, billing and communication data, server log files, pseudonymous usage data of the platform | all content that customers and their users process in the platform, in particular application, deployment, time-tracking, accreditation and payroll data |
| Information under Art. 13, 14 GDPR | through this privacy policy | through the privacy notice of the respective customer |
2.2 Where we act as a processor, we process personal data solely on behalf of and in accordance with the documented instructions of the respective customer, on the basis of a contract under Art. 28(3) GDPR. We do not process the data for our own purposes, in particular not for training AI models. The customer is responsible for the lawfulness of this processing and for fulfilling your data subject rights. Please contact the customer directly in this respect; we forward any requests addressed to us to the customer without delay.
3. Visiting our website
3.1 Hosting
Our website and our platform are operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres within the European Union. Hetzner processes the data as a processor on the basis of a contract under Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure, fast and reliable provision of our online services by a professional provider.
3.2 Server log files
Each time our website is accessed, the server automatically collects the following data transmitted by your browser: IP address, date and time of the request, page or file requested, HTTP status code, amount of data transferred, referrer URL as well as browser type, browser version and operating system. This processing is necessary to deliver the website, to ensure its stability and security and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest follows from these purposes. The data is not combined with other data sources. The log files are deleted after 14 days unless they are needed longer in an individual case to investigate a security incident.
3.3 Cookies and consent management
We use cookies and similar technologies (e.g. local storage). Without your consent we only use those that are strictly necessary to operate the website and the platform, in particular for login and session management, protection against misuse, storing your language setting and storing your consent decision (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR). We only use all other technologies if you have consented via our consent banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the footer.
3.4 Contacting us
If you contact us via the contact form, email or phone, we process your details (in particular name, company, email address, phone number and the content of your enquiry) to handle your request and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest being the effective handling of enquiries addressed to us.
3.5 Demo booking
If you book a product demonstration via our website, we process your name, company, contact details and the requested appointment in order to arrange, prepare and hold the demo (Art. 6(1)(b) GDPR).
3.6 Trial access
If you register for free trial access, we process your registration data (name, company, email address, password in encrypted form) to set up and provide the access (Art. 6(1)(b) GDPR). We process personal data of third parties that you enter into the platform during the trial as a processor for your company (section 2). If no contract is concluded, we delete the trial account including all content 30 days after the end of the trial period.
4. Customers, prospects and business partners
4.1 Initiating and performing contracts
As part of our business relationship with customers and prospects, we process personal data of the respective contact persons and users with administrator rights, in particular name, role, business contact details, contract and order data, billing and payment data (e.g. bank details for SEPA direct debit mandates), support requests and our correspondence. The purposes are preparing offers, concluding and performing the contract, providing the platform, customer support and billing. The legal basis is Art. 6(1)(b) GDPR where you are a contracting party yourself. If you act on behalf of a company, we base the processing on Art. 6(1)(f) GDPR; our legitimate interest lies in initiating and performing the contract with the company you work for.
4.2 Legal obligations
We process and retain invoices, accounting records and business letters to fulfil obligations under commercial and tax law (Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)).
4.3 Customer information
We inform existing customers by email about maintenance, changes and new features of the platform as well as about our own similar services (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG)); our legitimate interest lies in looking after our customers and in direct marketing for our own services. You can object to the use of your email address for marketing purposes at any time without incurring any costs other than transmission costs at basic rates; an informal message to datenschutz@eventra.app or the unsubscribe link in every email is sufficient. We only send any further marketing by email with your consent (Art. 6(1)(a) GDPR).
4.4 Legal enforcement
Where necessary, we process data to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR).
5. Platform and app
5.1 Pseudonymous usage analytics
We analyse the use of our web application, the portals accessible to applicants and employees of our customers and our mobile app in order to make the platform more user-friendly, stable and powerful. We carry out this processing under our own responsibility and not on behalf of our customers.
Data processed: views accessed, features and controls used, time and duration of use, device type, browser, operating system, app version and a pseudonymous identifier. Content that is entered, uploaded or displayed in the platform is not processed, in particular names, application documents, deployment, time-tracking and payroll data. Our customers have no access to personal analytics data.
Legal basis: without your consent, the analysis takes place without storing or reading information on your terminal equipment, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the needs-based further development and bug fixing of our platform. If you have consented, we additionally store an identifier on your terminal equipment in order to analyse usage coherently across several sessions (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
Service provider: PostHog, Inc., San Francisco, USA, as processor. The data is processed on servers of PostHog’s EU instance in Frankfurt am Main. For access from the USA, see section 7.3.
Retention period: 12 months.
Withdrawal and objection: you can withdraw your consent at any time via the cookie settings. You can object to the analysis without consent in accordance with section 9.2.
5.2 Error monitoring
To detect and fix technical errors, we log error events of the web application, the app and our server services with PostHog (EU instance, Frankfurt am Main). Where data from a customer’s domain is affected, this is done on the customer’s behalf. Otherwise the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stable and secure operation of the platform. Error logs are deleted after 90 days.
5.3 Sign-in via third-party providers
In addition to signing in with an email address and password, you can sign in with your Apple, Google or Microsoft account. We then receive from the respective provider the data required for sign-in, usually name, email address and a user identifier. The provider processes the data as an independent controller under its own privacy terms. Use is voluntary; the legal basis is Art. 6(1)(a) GDPR.
5.4 Push notifications and wallet passes
We deliver the app’s push notifications via the Apple Push Notification Service or Google’s push service; a device-specific token is processed for this purpose. You can deactivate push notifications at any time in your device settings. If you add an accreditation pass to Apple Wallet or Google Wallet, the details required for the pass are transmitted to the respective provider. Apple and Google act as independent controllers in this respect.
6. Applications to EVENTRA
6.1 If you apply for a position with us, we process the data you submit, in particular contact details, CV, references, proof of qualifications and information on salary expectations and availability, to carry out the application process and to decide on establishing an employment relationship. The legal basis is Art. 6(1)(b) GDPR. If you voluntarily provide special categories of personal data, such as a severe disability, we process them on the basis of Art. 9(2)(b) GDPR in conjunction with Section 26(3) of the German Federal Data Protection Act (BDSG).
6.2 Only the persons involved in the selection process have access to your application.
6.3 If no employment relationship is established, we delete your application documents six months after the procedure has ended. Storage until then is based on Art. 6(1)(f) GDPR; our legitimate interest lies in defending against any claims under the German General Equal Treatment Act (Section 15(4) AGG, Section 61b ArbGG). Any storage beyond this for future vacancies only takes place with your consent (Art. 6(1)(a) GDPR). If an employment relationship is established, we transfer the necessary data to the personnel file.
7. Recipients and transfers to third countries
7.1 Processors
We use the following service providers, who process personal data exclusively in accordance with our instructions on the basis of a contract under Art. 28 GDPR:
| Service provider | Purpose | Place of processing |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of website and platform | EU |
| Amazon Web Services EMEA SARL, Luxembourg | File storage, sending system emails (Amazon SES), AI features (Amazon Bedrock) | Frankfurt am Main (eu-central-1); AI requests exclusively in AWS regions within the EU |
| PostHog, Inc., San Francisco, USA | Usage analytics and error monitoring (sections 5.1, 5.2) | EU instance, Frankfurt am Main |
| Providers of email, communication and office software | Correspondence and internal organisation | EU |
7.2 Other recipients
In addition, where necessary, we transfer data to tax advisers and auditors, banks for payment processing, lawyers and courts for legal enforcement and to authorities where we are legally obliged to do so. Apple, Google and Microsoft receive data as independent controllers within the scope of sections 5.3 and 5.4. We do not pass on personal data to third parties for advertising purposes or sell it.
7.3 Third-country transfers
We generally process your data within the EU or EEA. Amazon Web Services and PostHog belong to groups of companies based in the USA, so access from the USA cannot be completely ruled out. We base any such transfer on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified under it, and additionally on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the standard contractual clauses on request at datenschutz@eventra.app.
8. Retention periods
| Data category | Retention period | Basis |
|---|---|---|
| Server log files | 14 days | Section 3.2 |
| Error logs | 90 days | Section 5.2 |
| Usage analytics data | 12 months; earlier upon withdrawal or objection | Section 5.1 |
| Trial accounts without a contract | 30 days after the end of the trial period | Section 3.6 |
| Application documents | 6 months after the end of the procedure; longer with consent | § 15 Abs. 4 AGG, § 61b ArbGG |
| Contact enquiries | until fully handled | Purpose fulfilled |
| Customer and contract data | Contract term plus the regular limitation period of 3 years | §§ 195, 199 BGB |
| Invoices and business correspondence | 6 or 8 years | § 257 HGB, § 147 AO |
Data that we only keep because of a statutory retention obligation is blocked for any other use. Data that we process on behalf of our customers under section 2 is stored in accordance with their instructions; after the contract ends, we delete it once an export period of 30 days has expired, and backup copies within a further 30 days.
9. Rights of data subjects
9.1 Subject to the statutory requirements, you have the following rights:
- access to the data processed about you, the purposes of processing, recipients, retention period and origin of the data (Art. 15 GDPR);
- rectification of inaccurate and completion of incomplete data (Art. 16 GDPR);
- erasure of your data, unless there is an obligation or right to continue storing it (Art. 17 GDPR);
- restriction of processing, for example while the accuracy of the data is contested (Art. 18 GDPR);
- data portability, i.e. receiving the data you provided in a structured, commonly used and machine-readable format (Art. 20 GDPR);
- withdrawal of consent given at any time with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected (Art. 7(3) GDPR).
To exercise your rights, an informal message to datenschutz@eventra.app or to the address given in section 1 is sufficient.
9.2 Right to object under Art. 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If your data is processed for direct marketing purposes, you have the right to object at any time to processing for this purpose. After your objection, we will no longer process your data for direct marketing purposes.
9.3 Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
9.4 If your request concerns data that we process as a processor for a customer (section 2), please address it to the customer as the controller.
10. Final provisions
10.1 Obligation to provide data
Providing personal data is neither legally nor contractually required. Without the data marked as mandatory, however, we cannot process your enquiry, conclude or perform a contract with you, set up a user account or consider your application. Collecting the server log files is technically essential for operating the website.
10.2 Automated decision-making
No decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR) takes place.
10.3 Changes
We update this privacy policy when our processing activities or the legal situation change. The version published on this page is authoritative.