Privacy Policy
How event.clinic collects and uses personal data, in line with the EU GDPR and Hungarian data-protection law.
Last updated: October 2026
This policy explains how event.clinic handles personal data. It covers the event.clinic website, the event.clinic web app and mobile apps, and the public directory of venues and suppliers. It follows the EU General Data Protection Regulation (GDPR) and Hungarian law. Each separate product in the event.clinic family has its own privacy notice.
- 1. Who is responsible
- 2. Our two roles: controller and processor
- 3. Laws we follow
- 4. Principles
- 5. What we process, why, on what basis and for how long
- 6. Who receives your data
- 7. International transfers
- 8. Cookies, analytics and similar technologies
- 9. The mobile apps
- 10. Sensitive data
- 11. AI features
- 12. Security
- 13. Children
- 14. Your rights
- 15. Complaints
- 16. Changes to this policy
1. Who is responsible
The controller of your personal data is Marik Péter EV. (sole trader), 1054 Budapest, Aulich utca 3., Hungary, sole-trader registration number 61895726, tax number 91785620-1-41. Email: mail@event.clinic.
We have not appointed a Data Protection Officer. For all data-protection matters, including requests to use your rights, write to mail@event.clinic.
2. Our two roles: controller and processor
As controller we decide why and how personal data is used. This policy covers that. It applies to people who visit our website or write to us, people who register interest in working with us, people who hold an account in our apps, businesses and people listed in our public directory, and the invoicing and security records we keep for ourselves.
As processor we handle data for an organiser who uses event.clinic to run an event. The organiser decides what goes in, for example guest lists, attendees, crew, suppliers, accreditation records and access needs. We process it on the organiser's documented instructions under our Data Processing Agreement. In that case the organiser is the controller and its own privacy notice applies. If you are one of those people, please contact the organiser first. If you write to us instead, we pass your request to the organiser and help it answer. We do not use that data for our own purposes.
Two narrow parts stay with us as controller even when an organiser's event is involved. These are the accounting records of payments we handle ourselves, and a minimised evidence file for our own legal and insurance claims. Both appear in section 5 and are kept apart from the organiser's records.
3. Laws we follow
- Regulation (EU) 2016/679 (GDPR).
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).
- Act CVIII of 2001 on certain issues of electronic commerce services and information society services.
4. Principles
We process personal data lawfully, fairly and openly. We collect it for specific purposes and do not use it for unrelated ones. We ask only for what we need, keep it accurate, and keep it no longer than the purpose requires. We protect it against loss and misuse, and we can show how we comply. We do not sell personal data. We do not use it for advertising or profiling.
5. What we process, why, on what basis and for how long
We receive the data from you unless a row says otherwise. Providers named in the last column are described in section 6.
| Activity | Data | Purpose and legal basis | Kept for | Recipients |
|---|---|---|---|---|
| Visiting the website | IP address, browser and device type, pages requested, date and time. | Deliver the site, keep it secure and find faults. Legitimate interests (GDPR Art. 6(1)(f)). | Request logs for 7 days. | Cloudflare |
| Visit counts | Aggregate counts of visits and page views. No cookies and no local storage. | Learn which pages are read so we can improve them. Legitimate interests (Art. 6(1)(f)). | Aggregate figures only. We keep no record of individual visitors. | Cloudflare |
| Briefs, contact messages and emails to us | Name, email address, organisation and your message. For a brief also event type, date or window, scale, budget and where the pressure is. With each form we also receive the page and language you used, your country, city, region and time zone, a description of your browser and device, and a visitor tag. The tag is derived from your IP address by a one-way hash. We do not store the IP address with your enquiry, but we treat the tag as personal data because it can recognise a returning visitor. | Answer your enquiry and prepare an offer. Steps at your request before a contract and performance of a contract (Art. 6(1)(b)). Spotting duplicates and automated submissions, and keeping the forms secure, rest on legitimate interests (Art. 6(1)(f)). | 24 months after our last exchange. | Cloudflare (bot check and enquiry database in Western Europe), Brevo (notification email), Google (our mailbox) |
| Registering interest in working with us | Name, email, phone, where you are based, role, years of experience, a portfolio or profile link and your message. | Assess and contact event professionals for our specialist network. Legitimate interests (Art. 6(1)(f)), or your consent where required. | 36 months from your last update, or until you ask us to remove it. | Cloudflare, Brevo, Google |
| Accounts and sign-in | Name, email address, password hash or the identity from your social login, workspace memberships and roles, session tokens, and IP address and device data at sign-in. Service emails such as invitations, notifications and digests. | Give you your account and keep it secure. Performance of a contract (Art. 6(1)(b)) and legitimate interests in security (Art. 6(1)(f)). | While your account is active. | Clerk, Cloudflare, Neon, Brevo |
| Security and audit records | Records of actions taken in the system, such as who approved a budget or issued an invoice. Sign-in and activity logs. | Protect the service, show who did what, and meet legal duties. Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). | Audit records for 8 years, then deleted automatically. Activity logs for 24 months. | Cloudflare, Neon |
| Payments and invoices | Name, billing address, tax number, email address, invoice and payment records. Card details go to Stripe directly and never reach us. | Take payment, issue invoices and meet tax and accounting law. Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). | The period Hungarian accounting law sets for accounting records, which is 8 years. | Stripe, the Hungarian tax authority NAV (Online Számla), our accountant |
| Public directory of venues, suppliers and performers | Business name, category, and business address and business contact details taken from public sources or from a business referenced in work done on the platform. If you use the venue search, the text you type is processed by Cloudflare Workers AI to find matches. | Let organisers find suppliers, venues and performers. Legitimate interests (Art. 6(1)(f)). You can object at any time (see below). | While the entry is listed. After a removal is confirmed we keep a minimal suppression record (the entry's identifier) so that it is not automatically republished, and the record of the request. See About this listing and removal requests. | Cloudflare, Neon |
| Our own legal and insurance claims | A minimised evidence file about a concrete claim we can reasonably expect. It may hold names, roles, actions, statements and, only where strictly needed, health information. It is not a copy of every event record. | Establish, exercise or defend legal claims and make insurance claims. Legitimate interests (Art. 6(1)(f)) and, for health information, Art. 9(2)(f). | By claim category and the applicable limitation rules. We do not apply one fixed period to every event. | Our insurer, lawyers, courts and authorities where the law requires |
| Handling your rights requests | Your request, the details we need to confirm who you are, and our reply. | Answer your request and show that we did. Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)). | 5 years, which is the general limitation period for claims. | None |
Keeping the audit records for eight years matches the retention period Hungarian accounting law sets for books and records. They stay even if you ask us to delete your data, because we must keep them. If you ask us to delete your data, we remove every detail that identifies you or your organisation. The audit records remain but no longer name anybody. After eight years nothing about you is left.
6. Who receives your data
These providers process personal data on our behalf under data-processing terms. They act on our instructions. We keep this list current.
| Provider | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Hosting, content delivery, bot protection on forms (Turnstile), cookieless visit counts, the website enquiry database, file storage, and the AI model behind venue search. | Global edge network. Enquiry database in Western Europe. Stored files in the EU. |
| Neon, Inc. (a Databricks company), 160 Spear Street, Suite 1300, San Francisco, CA 94105, USA | Database for the app. | Frankfurt, Germany |
| Clerk, Inc., USA | Sign-in and account management for the app. | Provider's own infrastructure |
| Sendinblue SAS (Brevo), 9-17 rue Salneuve, 75017 Paris, France | Transactional email and text messages. | EU |
| Stripe Payments Europe, Limited, Dublin, Ireland | Card payments and subscription billing. | EU and USA |
| Google (Google Workspace and Google Maps Platform) | Our email mailbox. Address suggestions and maps inside the app. | EU and USA |
We also disclose data where the law requires it. This includes the Hungarian tax authority (NAV), which receives invoice data through its Online Számla system under Act CXXVII of 2007 on VAT, and courts and authorities. We share data with our insurer, lawyers and accountant when we need their advice or must make or defend a claim.
7. International transfers
We keep personal data in the European Economic Area where we can. Some providers above are based in the United States or may process data there. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.
8. Cookies, analytics and similar technologies
The website sets only the storage it needs to work. It uses no advertising, social media or tracking pixels, and no analytics that need cookies. Because of that, the website shows no cookie banner. Visit counts come from Cloudflare Web Analytics, which sets no cookies and uses no local storage on your device. Fonts load from our own server, so your browser contacts no font provider.
Pages with a form load a bot check from Cloudflare. It receives your IP address and signals from your browser so it can tell people from automated software.
The app sets the cookies and browser storage needed to keep you signed in. These are strictly necessary and we do not use them for tracking. Where the app shows address suggestions or a map, your browser contacts Google, which receives your IP address and what you type into that field.
9. The mobile apps
You sign in to the apps with your event.clinic account (section 5). The app stores your session securely on the device. It asks for camera access only to scan tickets, badges and QR codes and to take photos for reports. Nothing is recorded or kept beyond what you send. The apps do not use your microphone. When you use an app at an event, what you record belongs to the organiser, and we process it as described in section 2.
10. Sensitive data
Our website forms do not ask for health data or other special categories of personal data. Please do not put them in free-text fields. Organisers may enter some, for example dietary or access needs, into their own workspace. We process that only as their processor, and the organiser must have its own legal basis and an Art. 9 condition for it.
11. AI features
AI features in the app draft text, translate or search. The organiser switches them on, and a person decides before any draft becomes a record. We do not use your personal data to train AI models. No decision with legal or similarly significant effect on you is made solely by automated means.
12. Security
We use technical and organisational measures that match the risk. The website runs over encrypted connections with strict transport security and a strict content security policy, and the app and its API use encrypted connections too. Public forms use a bot check and a limit on submissions. The app database sits in Frankfurt. Access inside the app follows individual accounts, roles and workspace boundaries, and system actions are written to an audit log. We monitor the service from outside around the clock and are alerted when it stops answering.
If a personal data breach is likely to put you at risk, we notify the Hungarian authority within 72 hours where GDPR Art. 33 requires and inform you where Art. 34 requires.
13. Children
event.clinic is a service for businesses. It is not aimed at children and we do not knowingly collect their data. If you believe a child has sent us personal data, write to mail@event.clinic and we will delete it.
14. Your rights
These rights are personal to you. We may ask you to confirm your identity before we act.
- Access. Ask whether we process your data and receive a copy.
- Rectification. Ask us to correct inaccurate or incomplete data.
- Erasure. Ask us to delete your data when we no longer need it or you withdraw consent. Records we must keep by law are anonymised or kept until the legal period ends, as section 5 explains.
- Restriction. Ask us to pause processing, for example while we check accuracy.
- Portability. Receive data you gave us in a structured, commonly used, machine-readable format, where we process it by automated means on the basis of a contract or consent.
- Objection. Object at any time, on grounds relating to your situation, to processing based on our legitimate interests. This includes a listing in the public directory. We then stop unless we show compelling grounds or need the data for a legal claim.
- Automated decisions. You are not subject to a decision based solely on automated processing that significantly affects you.
- Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Earlier processing stays lawful.
To use any right, write to mail@event.clinic. We answer within one month. To remove a directory listing, write to the same address. You need no account and you need not give a reason. If your data sits in an organiser's workspace, we refer you to the organiser, who decides the request, and we help it answer.
15. Complaints
Please contact us first so we can put things right. You also have the right to complain to the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1125 Budapest, Szilágyi Erzsébet fasor 22/C., telephone +36 1 391 1400, email ugyfelszolgalat@naih.hu, website naih.hu. You may instead complain to the supervisory authority in the EU country where you live or work. You can also take the matter to court.
16. Changes to this policy
We may update this policy as the law, our services or our providers change. The version on this page applies to your current use. If a change affects what we process, why, for how long or your rights in a material way, we say so at the top of this page.