Last updated: 17 September 2026
This notice explains how personal data is processed on the Eventy website and when using Eventy, its apps and the Evie AI assistant. The processing depends on the features you use and whether you are a visitor, account holder, organiser or guest.
1. Controller and contact
Eventy is operated by Basetwo GbR, represented by Anselm Binninger, Ansgar Binninger and Leonhard Künzler, Tetschen-Bodenbacher-Straße 3, 86720 Nördlingen, Germany.
For privacy questions and to exercise your rights, contact support@eventy.de or write to our postal address marked “Data protection”. Further company details are available in our legal notice (German). You do not need an Eventy account to make a privacy request.
2. Eventy and event organisers: different responsibilities
Basetwo is the controller for its own website, Eventy accounts, customer relationships and its own billing. When Eventy processes participant and event data on an organiser's instructions, the organiser is generally the controller and Eventy acts as a processor. An agency may introduce a further processing relationship; the actual tasks and agreements determine the roles.
The organiser's notice explains event-specific purposes, required information, recipients and retention periods. These may concern registration, invitations, tickets, admission, participation requirements or publication of photographs. This notice does not replace the organiser's privacy information. See data processing agreements (German).
3. Website visits and technical operation
When you access our services, technical connection data is processed, including your IP address, request time, requested resource, response status and information about your browser and operating system. This supports delivery, troubleshooting and security. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a functioning and secure service. Article 6(1)(b) GDPR may also apply when providing a function requested under a contract.
The current Eventy platform and its object storage use Hetzner infrastructure in Nuremberg, Germany. This does not mean that all additional services process data exclusively in Germany. External services and possible international transfers are explained below.
4. Accounts, sign-in and security
To create and operate accounts, we process names, email addresses, language, profile details, authentication data and account associations. Password authentication uses derived verification information. Passkeys involve public keys and information about the registered credential; biometric data used to unlock your device locally is not transmitted to Eventy through this process.
Fields marked as required are needed for the function you request. For example, we cannot provide the corresponding account without the necessary contact and authentication details. Additional information depends on the feature you choose. For required event information, the organiser explains why it is needed and what happens if you do not provide it.
If you choose Google sign-in, the identity and profile information authorised for that purpose is exchanged between Google and Eventy. Supported forms use Google reCAPTCHA for abuse prevention; technical device, network and interaction data may be sent to Google. See Google's privacy policy.
Accounts are provided on the basis of Article 6(1)(b) GDPR. Security measures serve our legitimate interests under Article 6(1)(f) GDPR. Where access to your device is not strictly necessary, the consent requirements of section 25 of Germany's TDDDG apply in addition.
5. Events, participants, tickets and media
Depending on the event, data may include names, contact details, registration answers, invitation and attendance status, selected event days, bookings, tickets, orders and check-in information. Messages, feedback, images, videos and other uploaded documents may also be processed. Information may come from the individual, the organiser or authorised team members.
Organisers determine the purposes and legal bases for their collection. Data necessary for booked participation may be processed under Article 6(1)(b) GDPR. Additional optional purposes may require separate consent. Health information, such as allergies, and other special categories of data additionally require a condition under Article 9 GDPR. Provide such information only where needed for the particular purpose and where the organiser has established an appropriate basis.
For imported guest lists, the controller must provide the required information about the source and processing under Article 14 GDPR. Not every invitation requires an Eventy account. Visibility and access depend on the event and the permissions assigned.
6. Payments and billing
Stripe supports paid Eventy services and supported ticket payments. Data includes billing and contact details, payment and transaction identifiers, amounts, status and payment-method information. Payment details may be entered directly with Stripe. Stripe also processes technical data for payment handling and fraud prevention and assumes its own controller responsibilities for certain services.
The legal bases are Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for legal obligations and, where applicable, Article 6(1)(f) GDPR for abuse prevention. See the Stripe Privacy Center and our service provider overview (German).
7. Contact, email, SMS, push and customer communications
When you contact us, we process contact details, messages, attachments and correspondence needed to handle your request. The basis is Article 6(1)(b) GDPR for contractual enquiries or Article 6(1)(f) GDPR for our legitimate interest in handling enquiries appropriately. Where a contact form requests consent for specified processing, Article 6(1)(a) GDPR applies to that processing.
Support uses, among other tools, a Zammad installation operated by us and our email infrastructure. Mautic is integrated for customer contact management; organiser registration may supply a name, email address, language and association with the service. Contact management is distinct from consent to advertising messages. Advertising requires the applicable consent or a relevant statutory exception. You may object to direct marketing at any time.
Transactional messages include account verification, recovery, invitations and ticket information. Where SMS is used, the phone number and message are transmitted to Spryng. Enabled push features process device or registration tokens and message information through Firebase Cloud Messaging and, where applicable, Apple Push Notification service. Delivery depends on the requested function and your device settings. Device permission does not replace any additional legal basis required for the message content.
8. Evie, voice features and connected AI services
Evie processes your input, necessary conversation context and organiser or event data relevant to the request. Depending on the feature, this can include participant information. Supported voice input involves processing audio for transcription. Eventy uses the OpenAI API. The current OpenAI terms identify OpenAI Ireland Ltd. as the contracting entity for customers in the European Economic Area; processing outside the EEA is also possible.
The relevant Evie flows request your agreement to its voluntary use. Where we rely on consent for our own purposes, the basis is Article 6(1)(a) GDPR. Processing organiser data also remains subject to the relevant instructions and lawful purposes. An organiser's agreement does not replace a required legal basis for other people's data.
OpenAI states that API content is not used for model training by default without an explicit opt-in. This differs from storage for service operation and abuse monitoring: no training does not mean immediate deletion. The feature, contract and configuration matter. See OpenAI's data processing terms and API data controls.
You can stop using AI features and withdraw consent for the future through the available Evie settings or our privacy contact. Clients connected independently through API or MCP, or other AI providers you choose, also involve their own information and your organisation's permissions. See privacy and Evie (German).
9. Cookies, analytics and external content
Cookies and similar storage support functions such as sign-in, language, appearance and remembering your choices. Strictly necessary device access falls under section 25(2) TDDDG; other access generally requires consent under section 25(1). Personal data processing also needs an appropriate GDPR legal basis.
The website integrates Google Tag Manager or Google tags, Stripe components, Trustpilot content and support chat. Loading them may transmit an IP address, browser information, page context and other technical data to the relevant services. The cookie interface offers analytics, marketing and AI choices; external integrations can also make their own technical connections and access device storage. Our cookie and external content overview (German) describes the services and observed storage.
Consent can be withdrawn for the future. Reopen the cookie preferences on the website or contact us about privacy. Browser controls can also delete or block cookies, but may affect necessary functions. WhatsApp and social-network links lead to separate services governed by their own privacy notices.
10. Recipients and international transfers
Recipients may include authorised staff, the relevant organiser and authorised team members, and services used for hosting, payments, communication, security and AI. Authorities or professional advisers subject to confidentiality may receive data where there is a legal basis. The service provider overview (German) explains functions and roles; not every provider listed is a processor.
International services may process data outside the EEA, particularly in the United States. Hosting in Germany does not exclude this. Transfers are subject to Articles 44 onwards GDPR, for example an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Providers describe their respective mechanisms. You can ask us for information about the safeguards applicable to a particular processing operation and how to obtain the relevant documents.
11. Retention and deletion
Data may only be processed for as long as its purpose and legal basis justify it. Event data is particularly subject to the controller's instructions and agreed periods. Accounts, conversations, media, support records, security logs and accounting records need to be considered separately.
The existing commitment to delete customer and guest data no later than one year after the contract ends remains applicable, unless earlier deletion is required or a legal retention obligation applies. Any earlier contractual return or deletion remains unaffected. If the platform closes completely, clause 10.4 of the terms (German) also applies. This period does not authorise continued use of data without a purpose and does not describe an immediate self-service deletion feature.
Records subject to statutory retention are retained for the required purpose and period. Necessary evidence or the establishment, exercise or defence of claims may justify additional limited retention. Deletion also needs to cover downstream systems and backups as appropriate. Contact support@eventy.de for access, return or deletion requests; further guidance is available in German.
12. Your rights
Subject to the applicable legal conditions, you have rights to access and obtain a copy of your data, rectification, erasure, restriction and data portability. Where processing relies on legitimate interests, you may object on grounds relating to your particular situation. You can object to direct marketing at any time. Consent can be withdrawn for the future without affecting the lawfulness of processing before withdrawal.
Where applicable, Article 22 GDPR protects against solely automated decisions producing legal or similarly significant effects. Evie assists with tasks; its suggestions should be reviewed before use.
We generally respond to privacy requests within one month. We will inform you within that period if a legally permitted extension is necessary. Reasonable identity verification may require further details; please do not send unsolicited identity-document copies or unnecessary sensitive information. For organiser data, we support the responsible controller in handling the request. Contact support@eventy.de.
13. Complaints and changes
You may complain to a supervisory authority, particularly where you habitually reside, work or believe an infringement occurred. The authority for private businesses at our registered location is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany; poststelle@lda.bayern.de; www.lda.bayern.de.
We update this notice when our services or processing change. Updating this page does not replace additional information or consent where required. Supplementary information is available in our privacy centre (German).