privacypolicy

Nyxus OÜ, registry code 17364522, Sepapaja tn 6, 15551 Tallinn, Estonia, represented by Maurice Haacke, operates 2gather.events, 2gather.me and the mobile app and is responsible for its own processing. Data-rights requests, privacy complaints and account deletion: legal@2gather.events. General technical help: support@2gather.events. Requests received in the other inbox are routed internally with the original receipt date preserved. No data protection officer is currently appointed; the legal contact handles privacy matters. Any required appointment is assessed as processing changes.

You may complain to a competent supervisory authority, including where you live, work or believe an infringement occurred. Andmekaitse Inspektsioon (www.aki.ee) is the Estonian authority. Any lead-authority role follows GDPR establishment and decision-making facts rather than company registration alone. You do not have to complain to us before exercising your authority or court rights.

We do not ask for sensitive data in public profiles or ordinary support requests. Users may nevertheless reveal health, political, sexual or other special-category information in content or reports. We minimise access/use, remove unnecessary material and apply an Article 9 exception where processing is required; posting it does not supply blanket consent for other uses. Health/accessibility data is not an ordinary Ticket field or shared through ticketing in this release. Accommodation requests can be made directly to the Organiser through its own explained lawful process.

No automated face-matching or biometric identification feature is introduced by this policy. If one is proposed, it needs a separate legal basis, notice, assessment and safeguards before activation. Human review is available for challenged access/moderation decisions. Device permission is not assumed to satisfy every GDPR consent requirement.

Identity checks are reviewed by a person. We do not use automated face matching for those checks.

We use declared interests, selected area/distance, Event dates and limited activity to provide requested discovery. The main ranking parameters are described in the CGU. You can request reset of recommendation history. We do not use this history to make solely automated decisions with legal or similarly significant effects. Optional analytics/marketing are separate from delivery of the Service and subject to the required choice/consent. Push permissions can be withdrawn in device/app settings; email marketing also offers an objection/unsubscribe route.

Deletion does not automatically cancel Tickets or create a new refund right. Before deletion we provide a secure account-independent route to valid upcoming Tickets and retain only necessary booking/admission records. Refunds follow the original purchase contract. Statutory records, claim evidence and backups are kept separately or with appropriately restricted access. These exceptions are not authority to continue unrelated marketing or recommendation profiling.

Other members see your published name/age/profile content and Event participation as disclosed by the feature, and messages intended for them. Email and phone contact details are not published to other members by the Service. Do not post private information in public content.

Organisers receive only admission information needed for their Event, such as name, booking reference and Ticket status. They are controllers for independently determined Event purposes and must provide their own information and respect legal retention/marketing rules. Any jointly determined processing or processing on instructions requires the Article 26/28 arrangement appropriate to the actual activity; labels do not decide the roles. Partner-venue marketing sharing requires a separate explained opt-in; no marketing permission is inferred from buying a Ticket.

Full messages sent to legal@2gather.events are routed into a private Slack channel accessible only to leadership. Messages sent to support@2gather.events are routed into the team support channel. Access is limited to the relevant team for the stated purposes; mail and automation administrators may have necessary technical access under confidentiality obligations. Particularly sensitive identity documents, bank evidence or intimate allegations are moved to restricted case storage when needed; only necessary details remain in Slack. You may request a secure channel at legal@ before sending sensitive evidence. Please do not send identity documents to ordinary support email.

Each provider acts under its actual controller/processor role, appropriate terms and security measures. Providers are not authorised by this policy to use support content for unrelated advertising. No subscription-processing provider is introduced for this ticketing launch. A later subscription/digital purchase requires updated information and the applicable store/payment process. Authorities receive data only on a lawful basis and to the necessary extent.

Primary hosting is in Europe; email, coordination, mapping, notification and diagnostic providers may process data outside the EEA, including in the United States. For each transfer we use a currently valid adequacy decision only where the recipient and transfer are actually covered, or the appropriate approved contractual clauses with required risk assessment and safeguards. Self-certification is checked before relying on the EU-US Data Privacy Framework. The clause module follows the actual recipient role; one processor module is not assumed for every recipient. Contact legal@2gather.events for information or a copy of the applicable safeguards, with legitimate redactions.

You may request access, correction, erasure, restriction, objection to legitimate-interest processing, portability where applicable, and withdrawal of consent without affecting prior lawfulness. Any applicable post-mortem rights remain. Write to legal@2gather.events; another secure request route is available where account access is lost. We reply within one month. A lawful extension of up to two additional months is explained within that first month. We request identity evidence only if reasonably necessary and proportionate.

We use appropriate transport protection, credential hashing, role-based access and controls proportionate to the data. Report security incidents privately to legal@2gather.events. Do not publish another person's sensitive evidence. We assess breaches promptly after awareness and notify the competent authority within seventy-two hours where Article 33 requires it, explaining any delay; affected people are informed where Article 34 requires it. Organisers report relevant incidents to us without undue delay and within twenty-four hours under their contract. These internal targets do not delay statutory duties.

Strictly necessary authentication/security storage is used for requested functionality, such as the tg_rt session cookie (up to thirty days), short-lived session tokens, language/theme and an unfinished Event draft. The current storage information is provided in settings and when consent is collected. Non-essential analytics, external tracking or marketing storage is not activated before valid consent where required; refusal must be as easy as acceptance, and choices can be changed. Location, camera/photo and push permissions are requested only for their explained features; the Service can use manual location input.

Relevant professional contact data for venue/organiser prospecting may be processed under a documented legitimate-interest assessment with legally required information and an easy objection to legal@2gather.events. Retention is at most three years after the last positive contact, unless a specific contract/legal purpose applies. Representatives receive only necessary data under the role and contract appropriate to their actual work. Material privacy changes are notified before taking effect; historical versions remain accessible. A notice change does not itself authorise a new incompatible purpose or replace required consent.

If you choose to leave a telephone message after the recording/transcription notice and affirmative keypress, we record and automatically transcribe it to handle your request. You may instead email legal@2gather.events. Twilio provides telephone/recording infrastructure; the selected transcription provider and actual transfer safeguards must be identified before activation. Access is limited to authorised case handlers and necessary service providers. Transcripts are routed to the private leadership Slack channel; especially sensitive evidence is handled in restricted case storage. Maurice Haacke handles legal cases, with Helal as backup. We aim for a first human response within one business day, Monday to Friday; this is not a guaranteed resolution time and does not change legal deadlines.

Audio is deleted after the transcript has been checked by a handler, within seven days of that check and ordinarily no later than thirty days after the call. Ordinary complaint transcripts and case data are deleted twelve months after closure. Necessary evidence for a particular legal claim or legal duty may be retained for its justified period with restricted access and periodic review. Relevant rights and the separate backup limits above apply. Do not leave payment-card details or identity documents in voicemail.