# Privacy Policy
**Status: draft — interim version, pending NGO registration. Not yet implemented as an app feature.**
*Last updated: 2026-07-02*
## 1. Who is responsible for your data
This project is currently operated by:
> **Ingentics LTD**
> bul. "Tsar Boris III" n°81, Office 9, 1612 Sofia, Bulgaria
> EIK: 203 328 132
> VAT: BG203328132
> Contact: contact@ingentics.com
This application is being built on behalf of a non-governmental organisation (NGO) that is **currently in the process of being legally established** in Bulgaria. Until that association is officially registered (i.e. until it obtains its own EIK number from the Bulgarian NPO register), **Ingentics LTD acts as the data controller** for the personal data processed through this application.
Once the association is registered, this policy will be updated to name the association as the data controller, and users will be informed of the change (see [Section 11](#11-changes-to-this-policy)).
## 2. What this document covers
This policy explains what personal data the application collects, why, for how long, who can access it, and what rights you have over it, in line with the EU General Data Protection Regulation (GDPR).
## 3. Data we collect
| Data | Source | Purpose |
|---|---|---|
| Email address, name, profile picture | Google OAuth login | Account identification |
| Language and timezone preference | User profile / browser | Displaying the app in the right language/time |
| Date terms of use were accepted | User action | Proof of consent to the terms |
| Event subscriptions (which events, subscription/withdrawal dates) | User action | Managing your participation in events |
| Contact consent (yes/no) | User action, per subscription | Whether organizers may contact you about that event |
| Optional comment left when subscribing | User action | Helping organizers prepare the event |
| Optional logistics answers (transport offered/seats, tools brought, accommodation needs) | User action, per subscription | Helping organizers plan event logistics |
| Session identifier | Automatic, technical | Keeping you logged in |
We do not use analytics, advertising, or tracking cookies. We do not collect any data beyond what is listed above.
## 4. Why we process your data, and on what legal basis
- **Account management** (email, Google profile info): necessary to provide you with an account — legal basis: performance of a contract with you / your consent given at login.
- **Event subscription management** (subscriptions, comments, logistics answers): necessary to organize events you sign up for — legal basis: performance of a contract with you.
- **Being contacted by organizers**: only if you explicitly opted in via the contact consent checkbox — legal basis: consent, which you can withdraw at any time.
- **Terms of use acceptance record**: necessary to demonstrate compliance — legal basis: legal obligation / legitimate interest.
## 5. Who we share your data with
- **Event administrators**: volunteers or staff acting on behalf of the organisation described in Section 1, who need to see subscriber information (email, comments, logistics answers) to organize events. They are bound by a confidentiality commitment and only access what is necessary for their role.
- **Ingentics LTD** (see Section 1): as the technical host and operator of the application infrastructure.
- **Google**: as the identity provider used for login (Google OAuth). See Google's own privacy policy for how Google processes your authentication data.
We do not sell or rent your personal data to any third party.
## 6. International data transfers
Google, our login provider, is a US-based company. Data exchanged during login (email, name, profile picture) may be processed outside the EU/EEA. Google is bound by its own data protection commitments (including EU-US Data Privacy Framework / standard contractual clauses, depending on Google's current certification). No other data in this application is transferred outside the EU/EEA.
## 7. How long we keep your data
- While your account is active: your data is kept for as long as you use the application.
- **Planned (not yet implemented):** accounts inactive for **3 years** will be automatically anonymised.
- You can request deletion (anonymisation) of your account at any time from your profile page; this is immediate and irreversible.
- Anonymisation removes your email, Google identifiers, name, avatar, locale and timezone, while keeping non-identifying event statistics.
## 8. Your rights
Under the GDPR, you have the right to:
- **Access** your data (available directly from your profile via the "Export my data" feature).
- **Rectify** inaccurate data (via your profile settings).
- **Erase** your data / request anonymisation (via your profile's "Delete my account" feature).
- **Port** your data (the export is provided in a structured, machine-readable format).
- **Object** to or **withdraw consent** for processing based on consent (e.g. the contact consent checkbox, which you can uncheck at any time).
- **Lodge a complaint** with the competent supervisory authority. As this project currently operates from Bulgaria, this is the **Commission for Personal Data Protection (CPDP / КЗЛД)**, cpdp.bg, Sofia.
To exercise any of these rights beyond what's available in the app, contact us at the address in Section 1.
## 9. Security
Access to administrative data is restricted to authenticated administrators. Sessions are stored server-side. We take reasonable technical measures to protect your data but cannot guarantee absolute security of data transmitted over the internet.
## 10. Minors
**To be confirmed once the NGO's activities and target audience are finalised.** At present, the application does not implement a specific consent mechanism for minors. If event participation by minors is expected, this section will be updated with the appropriate safeguards (e.g. parental consent) before such participation is enabled.
## 11. Changes to this policy
This is an interim policy that will be revised once the NGO is legally registered, notably to update the data controller's identity in Section 1. When the policy changes in a way that affects your rights or our processing, we will ask you to re-accept the terms of use.
## 12. Contact us
For any question about this policy or your data: **contact@ingentics.com**