Last updated: November 2, 2026 — supersedes the version of March 31, 2026 and the version published on the website on February 13, 2026

1. Data Controller and “Contracting Entity” (IT/CH/UK/USA)

This Policy describes the processing of personal data:

• on the Eventboost website (“Site”); and
• in the use of the Eventboost platform and services (“Services”).

The Data Controller of the processing carried out for its own purposes (account, contract management, invoicing, security, marketing) is the company of the Eventboost group which is a contractual party (“Contracting Entity”), as indicated in:

• Order Form / order / business proposal accepted, or
• Applicable Contractual Documentation.

The Eventboost Group operates through multiple entities in Italy, Switzerland, the United Kingdom and the United States (each an “Eventboost Entity”). For operational needs, some activities (support, IT, security, administration) may be carried out by other Eventboost Entities, as processors/sub-processors, with appropriate safeguards.

Eventboost Entities:

Switzerland (CH): Eventboost SA – Corso San Gottardo 46E, 6830 Chiasso TI – VAT Code: CHE 177.500.574

Italy (IT): Eventboost SRL – Via Carloforte 60, 09123 Cagliari (CA) – VAT Code: IT03858700929

United Kingdom (UK): Eduversal LTD – 49 Effra Rd, The Link, Unit BB26 London SW2 1BZ

United States (US): Eventboost INC – c/o 230 Park Avenue, 3rd Floor West, New York, NY 10169

EU representative of Eventboost SA (art. 27 GDPR): Eventboost SRL – Via Carloforte 60, 09123 Cagliari (CA) – privacy@eventboost.com (subject: “EU representative Eventboost SA”)

As of the date of the last update of this Policy, Eventboost has not appointed a Data Protection Officer pursuant to art. 37 GDPR, unless otherwise communicated. For any request or question relating to the protection of personal data, you can contact Eventboost at the following address:

Privacy contacts: privacy@eventboost.com

2. Roles: Eventboost as Data Controller and Data Processor (DPA)

Depending on the context, Eventboost processes personal data as:

(A) Controller

For the data of “Organiser” users relating to the account and the contractual relationship, and for the browsing and security data of the Site/Services.

(B) Processor on behalf of the Organiser

For data that the Organiser enters or manages in the Services in relation to events (e.g. participants, guests, speakers, sponsors, staff). If the Organiser is an agency organising the event on behalf of its own client, the controller is, as a rule, the agency’s client, the agency is a processor and Eventboost is a sub-processor; the controller is indicated in the communications relating to the event.

Such processing is governed by the DPA/Addendum pursuant to Article 28 of the GDPR, which is an integral part of the contractual framework (together with the Master Terms/Terms & Conditions and the Order Form).

Eventboost does not use the event data provided by the Organisers for its own purposes (e.g. its own or third-party marketing).

3. Personal data processed

3.1 Data processed as a Data Controller

• Account details (first name, last name, email, phone, role/company)
• Credentials and authentication
• Contract and billing data (company name, address, VAT, payment details)
• Technical and security data (logs, IP, technical identifiers, security events)
• Communication preferences (marketing/opt-out)
• Data on the opening of, and clicks in, our emails, as described in Section 4-bis

3.2 Data processed as a Processor (on behalf of the Organiser)

• registration and participant management data (e.g. personal details, ticket, QR, check-in, badge)
• Data relating to participation and event communications
• any special categories only if and to the extent that the Organiser includes them and is entitled to process them.

3.3 Principle of minimization and configuration of event data

Eventboost designs and configures its Services according to the principles of data minimization, access restriction, and data protection by default. It is understood that the Organiser, as the Data Controller of the data relating to the events, is responsible for determining what data to request, collect or import in the context of its events, as well as the related legal basis, transparency and lawfulness of the processing.

When the Services allow optional fields, customizable configurations or additional data collection, Eventboost recommends that the Organiser limit the collection to data strictly necessary for the purposes of the event.

4. Purposes and legal bases (processing by the Data Controller)

Eventboost processes data as a Data Controller for:

• Provision and management of the service (art. 6(1)(b) GDPR)
• Administrative management, invoicing, tax/accounting obligations (art. 6(1)(b) and/or 6(1)(c))
• Security, prevention of abuse and fraud, business continuity (art. 6(1)(f))
• Legal obligations and protection of rights (art. 6(1)(c) and/or 6(1)(f))
• Service communications (art. 6(1)(b) and/or 6(1)(f))
• B2B marketing (consent where required; otherwise art. 6(1)(f) with opt-out always available)
• Measurement of the opening of, and clicks in, our emails (consent for individual measurement; exemption for aggregate anonymous statistics, security and service communications; see Section 4-bis)

Automated decisions and artificial intelligence

Eventboost does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning data subjects or similarly significantly affect them (art. 22 GDPR). As of the date of this Policy, the Services do not include artificial intelligence features; if such features are introduced, this Policy will be updated with a clear and simple description of the related processing (art. 4 of Italian Law no. 132/2025).

4-bis. Emails and tracking pixels

The emails we send may contain tracking pixels: very small images, hosted on a remote server, which are downloaded when the message is opened and allow us to detect the opening, together with technical data such as IP address, device type and email client, date and time. The links in our emails may also allow us to detect clicks.

Purpose	Method	Legal basis
Aggregate and anonymous statistics on the open rate	Same pixel for all recipients; IP address and email client data anonymised	Exemption from consent (art. 122 of Italian Legislative Decree no. 196/2003)
Individual measurement of opens and clicks, campaign evaluation, frequency and personalisation of mailings (marketing)	Pixel with a non-intelligible identifier associated with the recipient	Consent (art. 122 of Italian Legislative Decree no. 196/2003), which may be given together with consent to promotional communications
Security and authentication (e.g. account activation, password change)	Strictly necessary	Exemption from consent
Required service communications (e.g. contractual notices, maintenance)	Strictly necessary	Exemption from consent

You can withdraw consent to tracking alone at any time, and keep receiving our emails without pixels, through the “Manage tracking” link in every message; or you can unsubscribe altogether through the unsubscribe link. Withdrawal does not affect the lawfulness of processing carried out before it.

We use non-intelligible and non-sequential identifiers, kept separate from the email address, so that the address does not appear in the request generated by the pixel. Open and click data are kept for no longer than 12 months.

Emails you receive from an Organiser through the Eventboost platform (e.g. invitations and communications about an event) are sent on behalf of the Organiser (or of the client for whom the Organiser works). The Organiser or its client is the controller: it decides whether and how to track the emails and provides you with its own privacy notice. Eventboost acts as a processor under the DPA. The preference centre reachable from those emails is managed by Eventboost on behalf of the controller indicated on the page. If you write to us to exercise your rights over those data, we forward your request to the controller.

5. Table “Purpose, legal basis and further details”

Role legend: C = Controller / P = Processor (DPA)

Purpose	Role	Legal basis (GDPR)	Data	Details	Retention (indicative)
Account creation, authentication, access management	C	6(1)(b); 6(1)(f)	Account, access log	Security controls and logging	Contract duration + up to 6 months
Service delivery and support	C/P*	C: 6(1)(b); P: DPA	C: account; P: event data	*Depends on the type of support	C: as above; P: according to the DPA
Payments, invoicing, accounting, debt collection	C	6(1)(b); 6(1)(c); 6(1)(f)	Invoicing, transactions	Payment providers as suppliers	Up to 10 years (or legal term)
Security, anti-fraud, audit trail, incident management	C	6(1)(f); sometimes 6(1)(c)	Logs, IPs, security events	See “Security” page	For a period proportionate to the purposes of security, prevention of abuse, investigation and protection of rights, according to internal retention policies and in any case not beyond the time reasonably necessary, except for further retention needs related to incidents, disputes, legal obligations or requests from the authorities.
Service communications (maintenance, alerts)	C	6(1)(b); 6(1)(f)	Email/in-app	Non-marketing	Duration of the relationship
B2B marketing (newsletters, offers)	C	Consent or 6(1)(f)	Contacts, preferences	Opt-out always available	Until opt-out or max 24 months
Measurement of opens and clicks in Eventboost emails	C	Consent (art. 122 of Italian Legislative Decree no. 196/2003); exemption for anonymous statistics, security and service communications	Opens, clicks, IP, email client data	Withdrawal of tracking alone in every email (Section 4-bis)	12 months
Event management: registrations, check-ins, badges	P	DPA (art. 28)	Participant data	Organiser’s instructions	According to the DPA
Invitations/reminders/event communications (email and SMS) on behalf of the Organiser, including any tracking	P	DPA (art. 28)	Participant contacts, telephone number, opens and clicks	Content, legal bases and consents: Organiser	According to the DPA
Necessary cookies	C	6(1)(f) / Exemption	Technical cookies	See Cookie Policy	According to cookie duration
Non-necessary cookies (e.g. performance/targeting)	C	Consent (where required)	Cookie IDs, browsing	See Cookie Policy	According to cookie duration
Privacy request management	C/P	6(1)(c)/(f); P: DPA	Request data	If event data: the Organiser’s primary contact	As necessary to handle the request

6. Recipients and categories of suppliers

Data may be shared with:

• Eventboost Entities of the group for operational support (IT, security, administration), with appropriate measures;
• suppliers necessary to provide the Services (hosting, sending of emails and SMS, technical tools, payments, consultants, support), designated as processors/sub-processors where required. The list of sub-processors is available on request at privacy@eventboost.com.

Eventboost does not sell personal data and does not share it with third parties for third-party marketing purposes.

SMS Program (United States). SMS messages sent by Eventboost Inc. on behalf of Organisers are governed by the SMS Terms published at https://eventboost.com/sms-terms-conditions/. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. International Transfers (EU/CH/UK/US)

Given the presence in multiple countries, data may be processed in different jurisdictions. Where required, Eventboost adopts appropriate measures and safeguards, including:

• adequacy decisions, including Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework for certified US recipients (e.g. analytics providers such as Google);
• Standard Contractual Clauses (Decision (EU) 2021/914) or equivalent instruments for other transfers outside the EU;
• Recognised UK mechanisms (SCCs + UK Addendum/IDTA, where applicable);
• adaptations for Switzerland and alignment with applicable Swiss legislation;
• contractual and technical measures for transfers to the United States. Eventboost Inc. accesses data only in exceptional cases, to provide documented assistance to the client, limited to the data strictly necessary and with the safeguards indicated in this section.

For “Processor” processing, transfers and sub-processors are governed by the DPA.

8. Retention

• Account and contract data: for the duration of the relationship and, as a rule, up to 6 months after termination (including trials) to allow reactivation/export, unless legal obligations or the protection of rights require otherwise;
• Accounting data: up to 10 years or other applicable legal term;
• Marketing: until opt-out or, indicatively, 24 months from the last commercial contact (unless local rules provide otherwise);
• Open and click data of our emails: no longer than 12 months; anonymous statistics may be kept without time limit because they do not identify anyone.

For technical, security and audit trail logs, retention times are determined by Eventboost according to criteria of necessity, proportionality, security, investigation and protection of rights, and may vary according to the category of logs, the criticality of the system and the possible presence of incidents or legal obligations.

For data processed as a Data Processor, retention and deletion are governed by the DPA and the Organiser’s instructions.

9. Rights of the data subjects

To the extent permitted by law, you may exercise your rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (if applicable).

You also have the right to lodge a complaint with the competent supervisory authority: in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the United Kingdom, the Information Commissioner’s Office (ICO).

As of the date of the last update of this Policy, Eventboost has not appointed a Data Protection Officer pursuant to art. 37 GDPR, unless otherwise communicated. For any request or question regarding the protection of personal data, you can contact Eventboost at the following address.

For enquiries: privacy@eventboost.com

If your data has been entered into an event by an Organiser, the latter is typically the Data Controller: the request should be sent primarily to the Organiser; Eventboost will assist within the limits of the DPA.

9.1 Complaints in the United Kingdom

If the controller is Eduversal Ltd, you can make a complaint about the processing of your data directly to Eduversal Ltd, by writing to privacy@eventboost.com with the subject “UK complaint”. We acknowledge receipt within 30 days, carry out the necessary enquiries, keep you informed and tell you the outcome without undue delay. Your right to complain to the ICO is not affected.

10. UK/CH/USA notes (best efforts)

Eventboost is committed with best efforts to align processes and documentation also with the privacy regulations applicable in the UK, Switzerland and the USA (based on context and applicability), maintaining the principles of transparency, minimization, security and accountability as a baseline.

11. Changes

Eventboost may update this Policy; the updated version is effective from publication. Previous versions are archived and available on request.