Privacy Policy

The controller responsible for data processing on this website is:

[NAME / COMPANY], [ADDRESS], email: [EMAIL ADDRESS].

The application is operated at [HOSTING PROVIDER / SELF-HOSTED]. When the pages are accessed, technically necessary access data (server log files) is processed, such as IP address, date and time, the resource requested and the user agent.

The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR).

The core function of EvePics is the upload of photos and videos by event guests. This content may contain personal data (e.g. depicted persons) and is stored on our servers to make it available to the organizer for review and, after release, in the published album.

Guests may optionally provide a name. To enforce upload limits, a technical identifier (token) is stored in the guest's browser.

The legal basis is consent and/or the legitimate interest in running the event (Art. 6 (1) (a) and (f) GDPR). The organizer is responsible for obtaining any required consent from depicted persons.

For organizers we store an account with an email address, an optional name and a hashed password. This data is required to sign in and manage events (Art. 6 (1) (b) GDPR).

We use only technically necessary cookies or comparable storage techniques:

• a session cookie to sign organizers in;

• a token to enforce per-guest upload limits;

• a token to access password-protected events;

• a session cookie for a manually selected language.

No tracking, analytics or marketing cookies are used. As these are strictly necessary cookies, no consent is required under § 25 (2) TTDSG, so no cookie banner is shown. The language is detected from the browser by default; if you manually choose another language, that choice is stored in a session cookie that is cleared when the browser closes.

To keep the service running, technical error messages may be sent to a messaging service ([TELEGRAM, optional]). These contain technical information about the cause of the error but no deliberately transmitted personal content of users.

Personal data is deleted as soon as it is no longer required for the stated purposes, in particular when an event or account is deleted, and after statutory retention periods expire.

Data is only shared with service providers we use as processors (Art. 28 GDPR), in particular the hosting provider [HOSTING PROVIDER]. Any transfer to third countries only takes place where an adequate level of data protection is ensured.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). You may withdraw any consent given at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority.

We update this Privacy Policy whenever changes to processing make it necessary. The current version published here applies.