Privacy Notice

1. Who is the controller?

The controller responsible under Art. 4(7) GDPR is Ognat Platform, Brunnenstraße 123, 10115 Berlin, Germany. You can reach our data protection team at privacy@ognat.example.

2. What data do we collect?

• Account data: email address, name (if provided), authentication method (Supabase Auth / Google OAuth).
• Registration data: events you register for, ticket type, role (lead/follow/switch), any social profile URL you provide, and optional notes.
• Organiser content: events you publish, ticket types, media uploads, team members, and email campaigns.
• Usage data: server logs (IP, user agent, request path) retained for 30 days for security and abuse prevention.
• Cookies: only strictly-necessary session cookies. We do not use third-party tracking cookies.

3. Why do we process it?

• To provide the service (Art. 6(1)(b) GDPR — performance of a contract).
• To send transactional emails such as registration confirmations and check-in receipts (Art. 6(1)(b)).
• To send campaign emails to opted-in contacts (Art. 6(1)(a) — consent, which you can withdraw at any time via the unsubscribe link).
• To secure the platform and prevent abuse (Art. 6(1)(f) — legitimate interest).

4. Who do we share data with?

We do not sell your data. We do not share it with advertisers. Sub-processors are listed in our Data Processing Agreement (DPA).

• Supabase (auth + Postgres) — our application database and identity provider.
• Amazon Web Services (SES) — transactional and campaign email delivery; per-org isolated tenants in eu-central-1.
• Cloudflare R2 — media storage (hero images, library uploads).
• Resend or Brevo — alternative email providers when configured by the operator.

5. How long do we keep it?

• Account data: until you delete your account, plus 30 days for backup roll-off.
• Registration records: kept anonymised (attendee_user_id nulled) after deletion; the registration itself is retained because it represents a real event interaction and may be needed for tax, accounting, or legal-defence purposes.
• Audit logs: 7 years for tax-relevant actions, 30 days for everything else.
• Backups: 30 days rolling.

6. Your rights

• Access (Art. 15) — request a copy of the data we hold on you via /data-export.
• Rectification (Art. 16) — correct inaccurate data via the organizer settings page or by contacting us.
• Erasure (Art. 17) — request deletion via /data-deletion.
• Restriction (Art. 18) and objection (Art. 21) — contact us.
• Portability (Art. 20) — the export above is machine-readable JSON.
• Withdraw consent (Art. 7(3)) — at any time, for processing based on consent.
• Complain to a supervisory authority — see the box below.

7. Supervisory authority

You have the right to lodge a complaint with the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstraße 219, 10969 Berlin, Germany.

8. Changes to this notice

We will update this notice when our practices change. The "last updated" date at the top of this page tracks the most recent revision. Material changes will be communicated to organizers via email at least 14 days in advance.