Accrevent Private Beta Privacy Policy

1. Categories of data

Private Beta may collect and process the following categories:

• Account data: name, email, password managed by Supabase Auth, preferred language, theme and account settings.
• Access data: a reference to the Authorization Token used at signup, the date and versions of accepted documents. The token itself is stored only as a hash.
• Event data: title, dates, location, teams, coordinators and notes.
• Applicant data from public recruitment forms: full name, email, optional phone number, date of birth, answers to the organizer’s questions and optional uploaded PDF or image files of up to 5 MB each. We do not request copies of identity documents.
• Staff data from an invitation link or entered by an organizer: name, date of birth, phone, email, team, role, shifts, attendance and organizer notes.
• Dietary preferences, including food allergies, only on the staff signup form and only if the person provides them. Allergy information is health data and is used to arrange meals at the event.
• Credential and vehicle pass data: name, team, credential type, access zones, unique code, credential status and, for vehicles, registration number and driver.
• Credential activity log: who issued, changed, cancelled, emailed or reissued a credential or vehicle pass, and when.
• Person lists: an organizer’s notes about people who worked at their events, with normalized email or phone data for matching.
• Acceptance log: document and version accepted, time, source (account signup, recruitment form or staff signup), IP address and browser user agent.
• Feedback: voluntary messages, bug reports, suggestions and experience reports.
• Technical data: IP address, user agent, technical logs, security events, sessions and information needed to run the application.

2. Purposes and legal bases

Each purpose requires a legal basis under Article 6 GDPR:

• Creating and securing accounts, validating Authorization Tokens, and managing events, teams, shifts and credentials: performance of the beta terms (Article 6(1)(b)).
• Receiving and assessing applications and sending applicant emails: steps requested by the applicant before a possible collaboration (Article 6(1)(b)); the organizer may also rely on its legitimate interest in assembling a team (Article 6(1)(f)).
• Matching applicants and staff against an organizer’s person lists: the organizer’s legitimate interest in avoiding repeat incidents at its events (Article 6(1)(f)).
• Dietary preferences that disclose allergies: the person’s explicit consent (Article 9(2)(a)).
• Credential and acceptance logs, spam protection and security logs: legitimate interest in protecting the platform and keeping an audit trail (Article 6(1)(f)).
• Reviewing feedback and fixing bugs: legitimate interest in improving the platform.

3. Emails to applicants

Emails are sent individually, one recipient at a time.

A submission confirmation contains the applicant’s name, email, phone, birth year only, role, period and “Received” status, plus a correction contact. Answers and files are omitted because the applicant may have mistyped the email address.

Decision emails for rejection, waitlisting or closure of the waitlist contain the person’s name, role, event and period. They do not state a reason or mention person lists. Accepted people receive a credential with a QR code and shifts.

4. Technical providers

Data is hosted in the European Union. The providers currently used are:

• Supabase: database, authentication and uploaded file storage in Frankfurt (eu-central-1), Germany.
• Vercel: application hosting, with server functions in Frankfurt (fra1), Germany.
• Resend: email delivery from Ireland (eu-west-1).
• Cloudflare Turnstile: spam protection on account creation, sign-in and public forms.

5. Transfers outside the European Economic Area

The providers above are companies based outside the EEA, mainly in the United States. Even where data is hosted in the EU, support or security staff and systems may access it from outside the EEA. Cloudflare Turnstile processes verification data across its global network.

Before using the service with real data for an external organizer, the applicable legal mechanism for each access or transfer outside the EEA must be checked under Chapter V GDPR. An EU server location alone does not prove that no transfer occurs.

You may request information about providers involved in processing your data at accredo.platform@gmail.com.

6. People entered by event organizers

The organizer configures questions, its team’s access and decisions on applications. If it determines the purposes and essential means of processing, it is the controller for the event data. Processing on its behalf requires documented instructions and an appropriate legal arrangement under Article 28 GDPR.

If you do not know how to contact the organizer, write to accredo.platform@gmail.com and we will forward your request.

Date of birth is requested to check the minimum age of 18. QR codes on credentials identify people in the system; do not publish them or send them to anyone other than their holder.

7. Person lists

An organizer may keep its own lists of people with whom it has worked: one for people it does not want to work with again and one for trusted people, with its own notes. Other organizers cannot see these lists.

An applicant’s email and phone are compared with the list for that event’s organizer. A match can automatically mark the application as rejected or accepted, based on the existing entry. The organizer sees the reason for the mark and may change the status.

The applicant receives the same neutral confirmation as everyone else; emails do not reveal the existence of a list.

You may ask whether you appear on an organizer’s list, request correction or erasure of notes, and object on grounds relating to your situation. Entries remain until the organizer removes them or a valid erasure request is granted.

8. Automated decisions and profiling

Matching against an organizer’s person list may automatically mark an application as accepted or rejected. The waitlist may close automatically two days before the work period starts; remaining applications are marked as rejected and the applicants are notified by email.

These operations need assessment under Article 22 GDPR in light of their actual effect on applicants. A decision requiring human intervention must not be treated as final merely because an organizer could later change its status.

If an outcome affects you, you may request human review, express your point of view and challenge it at accredo.platform@gmail.com. The request is forwarded to the event organizer.

9. Retention

• Administrator and organizer accounts: while used or until an erasure request.
• Coordinator and staff accounts: automatically deleted eight days after their last event ends.
• Rejected and waitlisted applications: no more than six months after the event ends, including answers and files. The organizer may delete them earlier.
• Staff data, credentials and credential logs: for as long as the event remains on the platform. The log retains the operator’s name after their account is removed to preserve the audit trail.
• Acceptance logs: for as long as the relevant account, application or signup remains, to record the accepted version.
• Used Authorization Tokens: deleted three days after use.
• Private Beta data may be deleted or reset. You may request account or data erasure at accredo.platform@gmail.com.

10. If you do not provide data

Name, email, password and Authorization Token are needed to create an account. You have no legal duty to provide them, but cannot create an account without them.

Recruitment forms need a name, email, date of birth and answers marked mandatory so the organizer can assess the application. Phone and files are optional.

11. Your rights

Under Articles 15–22 GDPR, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent where consent is the basis. Withdrawal does not affect processing already carried out lawfully.

To exercise your rights, write to accredo.platform@gmail.com. We respond within one month of receiving a request; for complex requests, this may be extended by two months with notice to you. We may ask you to confirm your identity, usually by replying from the registered email address.

If you are dissatisfied with the response, you may complain to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. General Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro. You may also bring a court claim.

12. Security

We use authentication, role-based access and database row-level security policies so users can access only events for which they have permission. Data is encrypted in transit.

Only the event organizer may download the complete credential register and audit report, after re-entering the account password; access lasts ten minutes.

No testing platform can guarantee absolute security. We notify the authority and affected people of a personal data breach where Articles 33 and 34 GDPR require it.

13. Children

Accrevent Private Beta is not intended for people under 16. Recruitment forms accept only people aged at least 18. We do not intentionally collect data from people below these ages.

If you become aware that someone below the minimum age has created an account or signed up, write to accredo.platform@gmail.com so the data can be removed.

14. Changes to this policy

Each version has a version number and update date at the top of the page. The version presented to you is recorded with your acceptance.

If the policy changes in respect of purposes, legal bases or data categories, we inform you by email before the new version takes effect.