Privacy Policy

The controller responsible for data processing on this website is:

[NAME / COMPANY], [ADDRESS], email: [EMAIL ADDRESS].

The application is operated at [HOSTING PROVIDER / SELF-HOSTED]. When the pages are accessed, technically necessary access data (server log files) is processed, such as IP address, date and time, the resource requested and the user agent.

The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

The core function of EvePic is the upload of photos and videos by event guests. This content may contain personal data (e.g. depicted persons) and is stored on our servers to make it available to the organizer for review and, after release, in the published album.

Guests may optionally provide a name. To enforce upload limits, a technical identifier (token) is stored in the guest's browser.

The legal basis is consent and/or the legitimate interest in running the event (Art. 6 (1) (a) and (f) GDPR). The organizer is responsible for obtaining any required consent from depicted persons.

For organizers we store an account with an email address, an optional name and a hashed password. This data is required to sign in and manage events (Art. 6 (1) (b) GDPR).

We use only technically necessary cookies or comparable storage techniques:

• a session cookie to sign organizers in;

• a token to enforce per-guest upload limits;

• a token to access password-protected events;

• a session cookie for a manually selected language.

No tracking, analytics or marketing cookies are used. As these are strictly necessary cookies, no consent is required under § 25 (2) TTDSG, so no cookie banner is shown. The language is detected from the browser by default; if you manually choose another language, that choice is stored in a session cookie that is cleared when the browser closes.

To keep the service running, technical error messages may be sent to a messaging service ([TELEGRAM, optional]). These contain technical information about the cause of the error but no deliberately transmitted personal content of users.

Personal data is deleted as soon as it is no longer required for the stated purposes, in particular when an event or account is deleted, and after statutory retention periods expire.

Data is only shared with service providers we use as processors (Art. 28 GDPR), in particular the hosting provider [HOSTING PROVIDER]. Any transfer to third countries only takes place where an adequate level of data protection is ensured.

Guests may optionally leave their email address to be notified once an event's album is published. This is voluntary and not required to use EvePic.

We use a double opt-in process: after you enter your address we send a confirmation email, and the address is only stored and used for the notification once you click the confirmation link. The legal basis is your consent (Art. 6 (1) (a) GDPR).

The email address is used solely for this one notification and never for advertising. You can withdraw your consent at any time with effect for the future using the unsubscribe link in every email, which deletes the address. At the latest, the associated notification addresses are removed when the event is deleted.

While EvePic is in a private test phase, interested visitors may optionally leave their email address to be notified once the service becomes publicly available. This is voluntary.

For this we store your email address, a technical confirmation/unsubscribe token and your chosen language (used for the language of the email). We use a double opt-in process: after you enter your address we send a confirmation email, and the address is only used for the notification once you click the confirmation link. The legal basis is your consent (Art. 6 (1) (a) GDPR).

The email address is used solely for this one launch notification and never for advertising. You can withdraw your consent at any time with effect for the future using the unsubscribe link in every email, which deletes the address.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

We update this Privacy Policy whenever changes to processing make it necessary. The current version published here applies.