Privacy Policy – UpEventi

1. Introduction

This Privacy Policy describes how UpEventi collects, uses, and protects the personal data of users who access the website https://uat.upeventi.com/.
By using the Site, you express your agreement regarding the processing of personal data in accordance with this policy.

If you have questions related to data protection, you can contact us at any time at: contact@upeventi.com.

2. Personal data we collect

UpEventi may collect the following categories of personal data:

A) Data Provided Directly by Users:

• First and last name
• Email address
• Phone number
• Billing data (for ticket or service purchases)
• Password and authentication information (encrypted)
• Content of messages sent through contact forms or through the user account

b) Automatically collected data:

• IP address and approximate location data
• Type of device and browser used
• Pages visited, session duration, actions performed on the Site
• Cookies and other similar technologies (see Cookie Policy)

c) Data collected from third parties:

• Data obtained through integration with platforms such as Google, Facebook, Stripe, or other payment and advertising processors.

3. Purposes of data processing

Personal data is collected and processed for the following purposes:

• Creating and managing the user account
• Processing orders, reservations, or ticket purchases
• Communicating with users regarding events, orders, or service changes
• Sending notifications and personalized offers (only with explicit user consent)
• Analyzing traffic and improving the website experience
• Complying with legal obligations (billing, accounting, data protection, etc.)

4. Legal basis for processing

We process personal data based on the following legal grounds:

• Contract performance (e.g., processing orders and reservations)
• User consent (e.g., marketing, newsletters)
• Legitimate interest (e.g., platform security, fraud prevention)
• Legal obligations (e.g., keeping invoices and accounting documents)

5. Data storage duration

Personal data is kept only for the period necessary to fulfill the purposes for which it was collected or in accordance with applicable legal requirements.

Examples:

• Account data: until the account is deleted by the user.
• Billing data: minimum 10 years, according to tax legislation.
• Marketing data: until consent is withdrawn.

6. Disclosure of data to third parties

UpEventi does not sell or rent personal data to third parties.
However, it may be transmitted to trusted partners, strictly for service provision, such as:

• payment service providers (e.g., Stripe, Netopia, PayU);
• IT and hosting service providers;
• email marketing platforms (e.g., Mailchimp, Brevo, etc.);
• public authorities, in cases provided by law.

All partners comply with European data protection legislation (GDPR) and are contractually obligated to ensure their confidentiality.

7. User rights (according to GDPR)

As a data subject, you have the following rights:

1. Right of access – to request information regarding personal data held about you;
2. Right to rectification – to request correction of inaccurate or incomplete data;
3. Right to erasure (“right to be forgotten”) – to request deletion of data;
4. Right to restriction of processing – in certain situations;
5. Right to data portability – to receive data in a structured format;
6. Right to object – to oppose processing for marketing purposes;
7. Right to withdraw consent – at any time, if processing is based on it;
8. Right to file a complaint – with the National Authority for the Supervision of Personal Data Processing (ANSPDCP) – www.dataprotection.ro.

To exercise these rights, you can contact us at:
📩 contact@upeventi.com

8. Data security

UpEventi applies appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or modification.
These include:

• communication encryption (HTTPS, SSL);
• secure account authentication;
• restricting staff access to sensitive data;
• continuous monitoring of server security.

9. Data transfer outside the EU

In some cases, data may be stored or processed by partners outside the European Economic Area (e.g., USA – Google, Meta, Stripe).
In these cases, UpEventi ensures that standard contractual clauses approved by the European Commission are respected, to guarantee the same level of data protection.

10. Newsletters and commercial communications

If you have subscribed to the UpEventi newsletter, we will use your email address only to send you relevant information about events and offers.
You can unsubscribe at any time by accessing the “Unsubscribe” link included in each email.

11. Privacy policy modification

UpEventi reserves the right to update this policy to reflect legislative or operational changes.
The updated version will be published on the Site, with mention of the date of last update.

Last updated: [to be completed upon publication]

12. Contact

For any clarifications or requests regarding data protection, you can contact us at:
📩 contact@upeventi.com