Privacy Policy
Last updated: October 6, 2026
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection provisions is:
2. General Information on Data Processing
We only process your personal data to the extent necessary to provide a functional website and our content and services (SaaS application). Konvio is an event management platform that enables organizers (organizations) to plan and run trade fairs, career fairs, and other events.
For event-related data (e.g. attendee registrations, exhibitor data, CRM contacts, form submissions), the respective organizer acts as the data controller. Konvio processes this data as a data processor pursuant to Art. 28 GDPR, solely on the organizer's instructions.
3. Data Collection and Processing
a) Website Visits (Server Log Files)
When you access our website, the browser on your device automatically sends information to our web server. This information is temporarily stored in a log file:
- IP address of the requesting device
- Date and time of access
- Name and URL of the accessed file
- Browser used and, where applicable, operating system
Art. 6(1)(f) GDPR (Legitimate interest in technical stability and system security).
b) Registration and Use of the SaaS Application
When you register for our service, we process the data you provide to fulfill the user agreement and provide the service to you.
Name, email address, password (hashed), language preference, timezone, timestamp and IP address of last login.
Art. 6(1)(b) GDPR (Performance of a contract or pre-contractual measures).
c) Sign-in via Google or Microsoft
If you sign in with your Google or Microsoft account, we receive your name, email address and a unique ID from that provider, and store the access and refresh tokens it issues so the sign-in keeps working.
Art. 6(1)(b) GDPR (Performance of a contract). Signing in via Google or Microsoft is voluntary and offered as an alternative to standard registration.
d) Contact Requests
When you contact us (e.g. via contact form or email), your information is processed to handle and respond to your inquiry.
Art. 6(1)(b) GDPR (Contract) or Art. 6(1)(f) GDPR (Legitimate interest in responding).
e) Event Registration and Check-in
When you register for an event or attend one, we process the data collected during registration as well as check-in and scan data.
Name, email address, company affiliation, registration status, IP address at registration, check-in timestamps, visitor codes, location and scan data when using scan points.
Art. 6(1)(b) GDPR (Performance of a contract with the organizer) or Art. 6(1)(f) GDPR (Legitimate interest of the organizer in event execution).
f) Exhibitor Registration and Event Participation
Exhibitors participating in an event (including exhibitor applications) provide us with company and personal data.
Company name, contact email, website, booth number, participation status, package orders with order details.
Art. 6(1)(b) GDPR (Performance of a contract or pre-contractual measures).
g) CRM Contact Management
Organizers can create and manage business contacts through the platform. The responsibility for this processing lies with the respective organizer.
First name, last name, email address, position/role, photo, tags, activity logs, notes.
Art. 6(1)(f) GDPR (Legitimate interest of the organizer in maintaining business contacts) or Art. 6(1)(b) GDPR (Pre-contractual measures).
h) In-App Messaging
Organizers and exhibitors can exchange messages through the platform. Messages may also be delivered and replied to via email.
Message content, sender information, timestamps.
Art. 6(1)(b) GDPR (Performance of a contract).
i) Form Submissions
Organizers can create custom forms and request attendees or exhibitors to provide information. The type and scope of data collected is determined by the respective organizer.
Name, email address, phone number of the submitter, and custom form field responses (depending on the organizer's configuration); for forms open to the public, also the IP address and browser used to submit.
Art. 6(1)(b) GDPR (Contract) or Art. 6(1)(a) GDPR (Consent, where configured by the organizer).
j) Usage Statistics and Analytics
We count visits to public event pages and to this website ourselves, without external analytics services, using a code derived from the IP address, browser and date that changes every day. For signed-in users we record which pages of the application they open, linked to their account, to see how the product is used. Where a visit arrives through promotional material we produced (a printed QR code, an embedded event card or a handout), we record which material it was, and if that visitor then sends a form, the submission notes the material as well. In the event app, organizers see statistics drawn from QR and NFC scans, session check-ins and app installs, linked to a per-event device code that is not derived from your device. The link to that code is removed 28 days after the event ends.
Page and route, time, the daily visitor code, browser type, the referring page and campaign parameters (this website only), the promotional material a visit arrived through; for signed-in users, the account and organization.
Art. 6(1)(f) GDPR (Legitimate interest in improving and analyzing the platform).
k) Push Notifications
If you enable push notifications for an event, we store the technical data required for delivery. Notifications are delivered by your browser maker's push service (Google, Apple, Mozilla or Microsoft).
Browser push endpoint, browser type, language, the sessions you saved for reminders, timestamps.
Art. 6(1)(a) GDPR (Consent). You can withdraw consent at any time in the event app or your browser settings.
l) Feedback and Support Requests
When submitting feedback or support requests through the platform, we process the information you provide. Problem reports sent from the event app also include technical details (app version, browser, screen size, language, time zone) and, if available, the per-event device code.
Email address (optional), name, message content, rating, category.
Art. 6(1)(f) GDPR (Legitimate interest in improving the service).
m) Billing and Payment Data
For invoices we process billing data. Konvio does not take card payments. An organization's bank details are stored so they can appear on its invoices.
Billing name, billing address, subscription plan, billing period, order details, bank details (IBAN, BIC).
Art. 6(1)(b) GDPR (Performance of a contract).
n) Email Delivery and Logging
We log the sending of system emails (e.g. invitations, confirmations, notifications) to ensure delivery and resolve technical issues. We do not record whether an email was opened or a link clicked.
Recipient address, time sent, delivery status (delivered, bounced, complained, unsubscribed), error messages; for some messages, the content as sent.
Art. 6(1)(f) GDPR (Legitimate interest in ensuring email delivery).
o) Internal Activity Log (Audit Log)
To ensure the security and integrity of the platform, we log certain user actions in an internal activity log. This serves to detect misuse, analyze errors, and maintain traceability of security-relevant operations.
Type of action (e.g. login, data modification), affected object (e.g. event, contact), time and the user who acted. The IP address and time of the last sign-in are stored with the account.
Art. 6(1)(f) GDPR (Legitimate interest in the security, integrity, and traceability of platform usage).
Activity logs are deleted after 90 days, unless a statutory retention obligation or an ongoing security investigation requires longer storage.
p) Detection of Automated Data Harvesting
To protect exhibitor and staff details published on public event pages from being copied in bulk by automated systems, we count how many exhibitor pages a single client requests within a short period. Only requests to public event pages are counted, and only a pseudonymous record of unusual patterns is stored. This does not restrict, slow down, or block your use of the site.
A truncated IP address range, a coarse browser category, a pseudonymous code derived from your session or, without one, from your IP address, request counts and times. The full IP address is never stored.
Art. 6(1)(f) GDPR (Legitimate interest in the integrity and availability of the service and in protecting the personal data of exhibitor staff published on event pages).
Records are deleted after 90 days.
q) Newsletter and Fair Recommendations
If you ask us to, we send you our newsletter, or occasional recommendations of fairs that may interest you. These are two separate requests: you can ask for one without the other, and stop one without stopping the other. We only add your address to a list after you confirm it by clicking the link in a confirmation email (double opt-in). Unlike event data, we are the controller for this processing rather than a processor: you asked us directly, not an organizer.
Email address, which list you asked for, language, the page you signed up from, the date you asked and the date you confirmed, the exact wording of the consent you were shown, and the IP addresses used to sign up and to confirm.
Art. 6(1)(a) GDPR (Consent). You can withdraw your consent at any time using the link in any message we send, without giving a reason. Withdrawing does not affect the lawfulness of what we sent before.
We keep your sign-up until you unsubscribe. After that we keep it marked as unsubscribed, so that we can show the opt-out was honoured and nobody can sign you up again. An address that is never confirmed receives only the confirmation email, and unconfirmed sign-ups are deleted after one month.
r) Sharing Your Details with Exhibitors at a Stand
When you scan the code at a stand, you can review and confirm which details to send and optionally attach a CV. Your contact details are sent only after you confirm; the scan itself is recorded as a visit to the stand. Each share goes only to the exhibitor at that stand. After you share, a link to remove your details is shown at the stand, and kept in the event app where you use it. You can also withdraw by contacting the exhibitor or us.
The fields shown before you confirm: name and email address and, depending on the event, phone number, company or institution, job title or field of study, and graduation year; the CV file if you attach one; and the exhibitor, stand and time of the share.
Art. 6(1)(a) GDPR (Consent). Sharing is voluntary. You can withdraw your consent at any time using the removal link or by contacting the exhibitor or us. Withdrawal does not affect the lawfulness of processing before it.
The exhibitor is the data controller and may delete your details at any time. Otherwise they are kept for the exhibitor's retention period, 24 months after you share them unless the exhibitor chose a different period. If the exhibitor's company never activated its Konvio workspace, your details are erased 12 months after the event. A deleted entry is erased for good 30 days later. The removal link works for as long as the record exists.
s) Exhibitor Series Registration Announcements
An organizer can offer emails about future registration openings for one event series. The subscription belongs to your email address and is separate from a company’s approval or an application. The organizer controls the audience and purpose; Konvio stores and processes the data on its behalf.
A guest or an account using another address confirms that address by email. If your account address is already verified, you can subscribe it with explicit consent without another confirmation email. Account verification alone does not subscribe you.
An organizer can import documented existing permission for the same series purpose, including its source references and original consent details where available. Its declaration records what it asserts and does not by itself prove your consent or record a Konvio email confirmation.
You can stop announcements for one series through the link in its emails or, for your verified account address, in email preferences. This leaves your other series subscriptions, applications and access intact. Broader address-level opt-outs, bounces and complaints remain effective.
Recipient address; supplied or account name and company information; signup and confirmation times and IP addresses; consent wording, version, language and source evidence; withdrawal records; and any accepted association with a company.
Art. 6(1)(a) GDPR (Consent) for new subscriptions. The organizer must document the original consent for imported permissions.
Subscription records and permission, withdrawal and suppression history remain stored after you stop emails. Never-confirmed public attempts that were never subscribed or withdrawn are erased after one month by default, through the scheduled retention task; a fresh request restarts that window. Temporary subscriber import sources expire after 30 minutes and are deleted on completion or discard, or by cleanup attempted every ten minutes. A failed deletion is retried by later cleanup. Accepted import evidence remains with the subscription.
4. Recipients and Disclosure of Data
We do not transfer your personal data to third parties for purposes other than those listed below. We only share your personal data with third parties where this is permitted by law or where we use service providers (data processors).
We use the following categories of service providers:
- Hosting and server infrastructure: Hetzner Online GmbH (Germany)
- Email delivery: Lettermint B.V. (Netherlands)
- File storage and backups: BunnyWay d.o.o. (Slovenia), data stored in Germany
- AI features (floor-plan analysis, PDF page titles): Mistral AI SAS (France), EU endpoint
- Venue maps: Geoapify (Cyprus); map images are fetched by our server, not your browser
Additionally, the following recipients may have access to personal data:
- Organizers (Organizations): Have access to the data of their event attendees, exhibitors, and CRM contacts within their scope of responsibility.
- Exhibitors: Receive the details you confirm sharing with that exhibitor at a stand, including a CV if attached; the visitor details carried by a badge their staff scan at their stand; and whatever their staff record about a conversation. The receiving exhibitor is the data controller for those details; a share does not give other exhibitors access to them.
- Google Ireland Limited: When using sign-in via Google (OAuth). Location: Ireland (EU).
- Microsoft: When you sign in with Microsoft.
- Your browser maker's push service (Google, Apple, Mozilla or Microsoft): When you enable push notifications; the notification content is encrypted.
- DuckDuckGo: To find a company's logo, our server sends the company's website domain; no personal data about you.
- European Commission (VIES): To verify a VAT number.
5. International Data Transfers
Konvio runs in the EU. A few optional features involve providers that may process data outside the EEA: signing in with Google or Microsoft, browser push notifications (your browser maker's push service) and company logo lookups through DuckDuckGo, which receive only a company's website domain. Where data reaches the United States, the transfer relies on the EU-US Data Privacy Framework if the provider is certified, otherwise on standard contractual clauses.
7. Data Retention
We only store personal data for as long as it is necessary for the purposes for which it is processed, or as long as a statutory retention obligation exists. Specifically:
- User accounts: Until the account is deleted (on request within 30 days)
- Server log files: 30 days
- Public event page views: Raw records 30 days, then daily totals without any visitor code
- Event data (registrations, check-in): The link to your device is removed 28 days after the event; other registration data is kept for the duration of the event plus applicable statutory retention periods
- Details shared at a stand, including CVs: 24 months after sharing unless the exhibitor chose a different period or deletes them sooner; 12 months after the event if the exhibitor's company never activated its workspace; a deleted entry is erased for good 30 days later
- CRM contacts: Until deletion by the organizer or termination of the user relationship
- Billing data: 7 years pursuant to Section 132 BAO
- Email delivery logs: 90 days; records that prevent a duplicate one-time message, without a time limit
- Push notification subscriptions: Until you turn notifications off in the app, or your browser reports the subscription expired
- Activity logs (audit log): 90 days
- Feedback and inquiries: As long as needed to answer and follow up; if a contract follows, the statutory retention period. For public form submissions, the IP address and browser are removed after 90 days
- Problem reports from the event app: 90 days after the event ends
- Backups: Up to two years; deleted data disappears from them as they expire
8. Your Rights (Data Subject Rights)
You have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification or erasure (Art. 16 & 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to object to processing (Art. 21 GDPR), set out separately in Section 9
- Right to data portability (Art. 20 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
To exercise your rights, please contact us at the address provided in Section 1.
You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. In Austria, this is the:
Austrian Data Protection Authority
Barichgasse 40-42, 1030 Wien
https://dsb.gv.at/
9. Right to Object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data that we base on legitimate interests under Art. 6(1)(f) GDPR. This includes the movement statistics an organizer draws from the QR and NFC scans made at their event. If you object, we erase what is linked to the device reference you give us for that event and remove the link between your device and those statistics, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims. To keep new scans from being counted, clear the event app's data in your browser.
Where we process personal data for direct marketing, you may object at any time and without giving reasons. We then stop the processing for that purpose.
To object, write to the address in Section 1 and say which processing you object to. If it concerns an event you visited, include the device reference the event app shows you under Profile, so we can find what belongs to you. An objection costs nothing and puts you at no disadvantage.
10. Automated Decision-Making
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.
11. Requirement to Provide Personal Data
Providing your personal data (name, email address) is contractually required for registration and use of our service. Without this data, we cannot provide the service. For event-related data, the respective organizer determines which information is required.
12. Data Security
All connections use TLS. We apply technical and organizational measures under Art. 32 GDPR, including salted password hashes, role-based access and daily backups.
13. Changes to This Privacy Policy
We may update this privacy policy as needed to comply with new laws, regulations, or changes to our data processing practices. The current version is always available on our website.