Privacy Policy

Last updated: September 23, 2026

1. Data Controller

iventactive apps GmbH
Urbanstraße 116
10967 Berlin
hello@my-iveo.de

Managing Director: Nicolai Alexander Jakobs
Amtsgericht Charlottenburg, HRB 268628 B
VAT ID: DE449843392

2. Purposes of Data Processing

We process personal data exclusively for the purpose of providing, optimizing, and securing our platform and website. This includes in particular:

  • Registration and management of user accounts
  • Planning and organizing events
  • Managing guests and participants
  • Sharing files (e.g. PDFs, presentations, videos)
  • Collaboration with other users
  • Support and communication
  • Security and abuse prevention

3. Data Collected

a) Upon Registration / Usage:

  • First name, last name
  • Email address
  • Password (encrypted)
  • Profile picture (optional)
  • Roles/access permissions

b) Event-Related Data:

  • Title, location, time, and description of events
  • Participant data (e.g. name, email, registration status)
  • Uploaded files (e.g. presentations, videos)
  • Comments or notes

c) Technical Data:

  • IP address
  • Browser type, operating system
  • Usage times and frequency
  • Log data for error analysis

3a. Speaker Data

When our customers add speakers to their events in iveo, we process personal data about these speakers: name, professional position, organisation, short biography, details of previous appearances. Processing is carried out on the basis of legitimate interest pursuant to Art. 6(1)(f) GDPR.

Speaker information is only visible within the respective customer's workspace. Speakers have the right to access, rectify, delete, or anonymize their data at any time.

4. Legal Basis

Processing is based on:

  • Art. 6(1)(b) GDPR (performance of contract)
  • Art. 6(1)(a) GDPR (consent)
  • Art. 6(1)(f) GDPR (legitimate interest)

5. Retention Period

Personal data is deleted once the purpose ceases to apply or users delete their account. After contract termination, customer data is deleted within 30 days, unless statutory retention obligations apply.

6. Disclosure to Third Parties and Processors

To operate the iveo platform we use the following service providers as processors pursuant to Art. 28 GDPR:

  • Supabase, Inc., San Francisco, USA: Database, authentication, file storage and realtime connections of the iveo app and the public event websites. Processed exclusively in Frankfurt, DE (eu-central-1)
  • Amazon Web Services (AWS), Seattle, USA: Hosting and delivery of the applications (Amplify, CloudFront), AI inference for the iveo assistant (Amazon Bedrock), operation of our own services (PDF generation, TLS proxy for customer domains). Processing location: Frankfurt, DE (eu-central-1); static assets are cached at CloudFront edge locations, including outside the EU (EU SCCs)
  • Bubble Group, Inc., New York, USA: Technical platform operation of the previous version (iveo v1). Processing location: USA (EU SCCs)
  • Google Ireland Ltd. (Workspace), Dublin: Sending and receiving email (data region Europe); sign-in with a Google account (“Sign in with Google”, transfer of name and profile picture URL); at the organiser's request, creation of YouTube live streams in the organiser's channel. Processing location: EU / USA (EU SCCs)
  • Cloudflare, Inc., San Francisco, USA: Protection of public forms against automated access (Turnstile; technical request data such as IP address and browser characteristics are processed). Processing location: global (EU SCCs)
  • HubSpot, Inc., Dublin, Ireland: CRM, support chat, newsletter. Processing location: EU
  • Google Ireland Ltd. (Analytics), Dublin: Web analytics (GA4). Processing location: EU / USA (EU SCCs)
  • Slack Technologies Ltd., Dublin, Ireland: Internal operational alerts (technical error notices without personal data). Processing location: EU / USA (EU SCCs)

On public event websites, organisers may embed map views from Google Maps (Google LLC, USA) or OpenStreetMap (OpenStreetMap Foundation, UK). These load only after your consent; when they do, your browser transmits your IP address to the respective provider.

7. Data Transfers to Third Countries

Transfers to the USA and other third countries are safeguarded by EU Standard Contractual Clauses pursuant to Art. 46 GDPR. The platform's core data (database, authentication, file storage) is processed exclusively in Frankfurt, DE.

8. Data Subject Rights

Users have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), and the right to lodge a complaint with a supervisory authority.

Contact: hello@my-iveo.de

9. Data Security

We employ TLS encryption for data in transit, AES-256 encryption for data at rest, access restrictions, role-based permission management, and regular security audits.

10. Cookies

Our website uses cookies. On your first visit, a cookie banner (Cookiebot) will appear. Your choice is stored and can be revoked at any time.

11. Web Analytics

Our website uses Google Analytics 4 (GA4) with Google Consent Mode and Cookiebot. No processing occurs without explicit consent.

12. Contact Form

Data (name, email, message) is processed to handle your inquiry and deleted after final processing.