eventOps privacy policy

Who we are

eventOps is provided by Arkon Event AS, org. no. 923 791 353. This policy covers the eventOps web service and the eventOps mobile app.

Who this policy is for

This policy is for you who sign in to eventOps: the organiser's staff and volunteers, and Arkon's own employees.

If you are a participant, guest or applicant at an event, the organiser decides what happens to the data about you. The organiser's privacy notice applies, which you find in the registration or on the pages the organiser shares with you.

Our role

For data about the event and the people in it, the organiser, our customer, is the controller. Arkon Event AS is the processor and processes that data only as agreed with the organiser.

For your user account, sign-in, security and the running of the service, Arkon Event AS is the controller.

What we process about you

• Account: your name, e-mail address, and the events and roles you have access to.
• Sign-in: when you signed in, your IP address, browser and device, and failed attempts. Used to protect your account and show you your own sign-in history.
• Audit log: what you did in eventOps, when, and from which IP address and browser. Used to document changes and detect misuse.
• Settings: your language and light or dark appearance.
• Technical log: error messages and performance data with IP addresses, to run the service and fix faults.

The mobile app

The mobile app uses the same account and the same service as the web. In addition:

• Camera: the app uses the camera only while you scan a badge or ticket. The image is processed on the device; only the code it reads is sent to eventOps.
• Sign-in: you sign in in the device's browser, and the sign-in is stored encrypted on the device.
• The app does not read your location, shows no ads, does not track you across apps and sends no analytics or crash reports.
• Before we use any further device features, we update this policy.

Legal basis

We process your account, sign-in, audit log and technical log because we have a legitimate interest in running a secure service and documenting who did what (GDPR Article 6(1)(f)). Data we process for an organiser has the organiser's legal basis.

Cookies

eventOps uses only the cookies the service needs to work: your sign-in, your language and light or dark appearance. We use no cookies for tracking or advertising.

This website counts visits with Plausible, without cookies and without storing data about you.

Service providers we use

We never sell data. These providers process data on our behalf, under data processing agreements:

• Amazon Web Services: hosting and storage, in Frankfurt (EU).
• Okta (Auth0): sign-in, stored in the EU.
• Dash0: technical logs and troubleshooting, stored in Ireland (EU).
• Infobip: text messages when the organiser sends them, in the EU.
• PrintNode: badge printing when the organiser prints, in the United Kingdom.
• AeroDataBox: flight status for travellers when the organiser follows flights, in Canada.
• Google Web Risk: checks links against harmful websites when someone makes a short link, in the USA.

Transfers outside the EEA

Most data is stored and processed in the EU. When data is processed outside the EEA, or a company outside the EEA may access it, this rests on GDPR Chapter V:

• Google is certified under the EU–US Data Privacy Framework, approved by the European Commission.
• Amazon Web Services, Okta and Dash0 use the European Commission's standard contractual clauses. The data is stored in the EU; the clauses cover, for example, support from the USA.
• PrintNode is in the United Kingdom, which the European Commission has approved with an adequacy decision.

How long we keep data

• Your account: as long as you have access to eventOps.
• Sign-in history: 90 days.
• Audit log: two years.
• Technical logs: a limited period, for running the service and troubleshooting.
• Data about an event: as long as the organiser decides, deleted by the organiser's rules.

Your rights

You may ask to see the data we hold about you, and ask us to correct, erase or restrict it. You may also object to the processing and ask for your data in a portable form. If the request concerns data we process for an organiser, we pass it on to the organiser.

If you believe we process data in breach of the rules, you may complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).

Deleting your account

Your account is created by the organiser or by Arkon, not in the app. If you no longer want access, ask the organiser to remove you, or write to us to have your account deleted.

Changes

If we change how we process data, we update this policy and the date at the top.