Privacy policy

1. Who is responsible

Codiix, Kamstraat 6, 1670 Pepingen, Belgium, enterprise number BE0791.723.106, is responsible ("controller") for the personal data described in this policy. For any question about privacy, email info@codiix.be.

2. Booked an event? Read this first

If you made a reservation with a business that uses EventOS, that business is responsible for your data. Codiix only processes it on its behalf, as a processor, under a data processing agreement.

The business decides what it asks you and how long it keeps it. For questions, or to see, correct or delete your reservation details, contact the business directly; its contact details are on its booking page and in your confirmation email. If you contact us, we pass your request on to the business.

The rest of this policy is about the data Codiix processes for itself: visitors of our website and the businesses that use EventOS.

3. What we collect

Account and team members: name, email address and password (stored only as a secure hash), your role in an organization and invitations you send or receive.

Organization details: business name, page address, contact email and phone, website, language, time zone, logo and brand color.

Billing: plan, subscription status and billing details such as company name, address and VAT number. Payments are handled by Stripe; we never see or store your full card details.

Use of the service: the events, time slots and settings you create, and a log of important actions in your organization (for example who activated an event).

Technical data: IP address, browser type and the time of requests, needed to deliver pages and to protect the service against abuse (rate limiting).

Contact: the content of emails you send us.

4. Why we use it and on which basis

• To provide EventOS (account, organization, events, emails to your guests, support): necessary for our agreement with you.
• For billing and accounting: necessary for the agreement and required by tax and accounting law.
• For security and to prevent abuse (rate limiting, fraud detection, logs): our legitimate interest in a safe and reliable service.
• To inform you about the service (changes to terms, price changes, important notices): necessary for the agreement.

We do not sell personal data, do not use it for advertising and do not send newsletters without your consent.

5. Who processes data for us

We use a few carefully chosen providers. They may only process data on our instructions:

• Supabase: database, login and file storage, hosted in the EU.
• Hostinger: hosting of the application, in the EU.
• Stripe (Stripe Payments Europe, Ireland): subscription payments and invoices.
• Resend: delivery of emails.

Some of these companies are part of groups based in the United States, so data may be transferred outside the European Economic Area. We only allow that with appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

We share data with authorities only when the law requires it.

6. How long we keep it

• Account and organization data: as long as the account exists. After a deletion request we delete it within 30 days. Organizations without an active trial or subscription for 12 months may be deleted after a warning.
• Invoices and billing records: as long as accounting and tax law requires (in Belgium currently up to 10 years).
• IP addresses for rate limiting: at most 1 day.
• Server and error logs: for a short period, normally no longer than 30 days.
• Backups: overwritten in the regular cycle of our hosting provider, at most 30 days.

7. Cookies and browser storage

EventOS only uses what is strictly necessary for the service to work. We do not use analytics, advertising or tracking cookies, so we don't ask for cookie consent.

• Login session (Supabase cookies starting with "sb-"): keep you signed in.
• eventos_locale: remembers the language you chose, for 1 year.
• eventos_org: remembers which organization you are working in, for 1 year.
• Theme preference (browser storage): remembers light or dark mode.
• Booking session (session storage): keeps your progress while you book; removed when you close the tab.

8. Security

We protect data with, among other things: encrypted connections (HTTPS), encrypted storage at our hosting provider, strict separation between organizations enforced in the database, role-based access for team members, hashed passwords and rate limiting. Within Codiix, only the people who need it for support or maintenance have access.

9. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a common format (portability). Where we rely on consent, you can withdraw it at any time.

Send your request to info@codiix.be. We answer within one month. We may ask you to prove your identity.

If you are not satisfied, you can file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

10. Children

EventOS accounts are meant for businesses and are not intended for people under 16.

11. Changes

We may update this policy. The date at the top shows the latest version. We inform account holders by email about important changes.