Privacy policy

1. Who we are

The data controller is NSS EVENTS S.r.l.s., Via G. E. Pestalozzi 4, 20143 Milan, Italy, VAT and tax code 12624870965, e-mail privacy@eventleash.com, certified e-mail (PEC) nssevents@pec.it.

NSS EVENTS runs Eventleash, the event management platform available at www.eventleash.com and app.eventleash.com.

2. Who it is for

This policy covers two groups of people, each with its own part below:

• Part A: people who visit the Eventleash website or use the platform with an account of their own, that is customers and their users. Here NSS EVENTS is the data controller.
• Part B: people invited to, or registering for, the events organised by Eventleash customers. In this case the controller is the customer organising the event, and NSS EVENTS processes the data only on its behalf, as data processor.

Part C contains the common rules: providers, transfers, security, rights and changes. The use of cookies is described in the cookie policy.

1. What data we process

• Account data: first and last name, e-mail, password (stored only in encrypted form), phone, language and the account preferences.
• Organisation and billing data: company name, VAT number and tax code, billing address, country. Payments are handled by Stripe: we neither see nor store card details.
• Contact requests: the data you enter in the contact form or send us by e-mail.
• Technical and usage data: access and security logs, IP address, browser and device type, needed to run and protect the service.
• Data collected with cookies and similar tools on the website and, only on the signup and account creation pages, on the app, within the choices made in the banner, as described in section 4 and in the cookie policy.

The data customers upload to the platform about the contacts and guests of their own events is not covered by this part: see Part C.

2. Why we process it and on what legal basis

Account data is needed to use the platform; the data marked as optional can be left out with no consequence on the service.

3. Platform e-mails

The service e-mails the platform sends to users (account invitations, notices, alerts) are there to run the service: they contain no tools to measure opens or clicks and are not used to profile you.

4. Advertising and campaign measurement

We may promote Eventleash with ads on Google, on Meta's platforms (Facebook and Instagram) and on OpenAI's ChatGPT. Only if you accept marketing cookies in the banner, the website and the app's signup and account creation pages load the pixels of these platforms, which are used to:

• tell whether you came from one of our ads and then signed up or started the trial, to measure the results of the campaigns;
• show Eventleash ads to people who already visited the website.

The platforms receive the pages visited, the identifier of the ad click, the signup and trial start events, technical browser and device data and the IP address, and may link them to your profile on the platform, if you have one. They receive them as independent controllers and also use them under their own privacy policies: Google, Meta, OpenAI. For the collection and transmission of data through the Meta pixel, NSS EVENTS and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR): the essence of their arrangement is in Meta's controller addendum, and the rights over the data Meta processes after receiving it can be exercised directly with Meta.

The pixels are never loaded on the other pages of the platform, nor on the pages the platform shows to the guests of the customers' events (event pages, registrations, preferences): the data of the customers' contacts and guests (Part B) is never used for our advertising.

You can withdraw your consent at any time from the "Cookie preferences" link at the bottom of the website or from the cookie policy; without consent no pixel is loaded.

5. How long we keep it

• Account and organisation data: for the whole term of the contract. When it ends the account stays read-only for 30 days and is then deleted; backup copies are removed within the following 14 days.
• Tax and accounting documents: for the period required by law (10 years).
• Contact requests: 60 months from the last exchange, unless they become a contract.
• Consent to Eventleash news: until you withdraw it.
• Technical and security logs: 12 months, in minimised form.
• Advertising data: on your device, for the cookie duration stated in the cookie policy; at the advertising platforms, under their own privacy policies. We keep no copy of it.

1. Who the controller is

When an Eventleash customer invites you to one of its events or adds you to one of its lists, the data controller is the customer, whoever it is: it decides whom to invite, what to ask you and on what legal basis, and provides you with its own privacy notice, linked in its registration forms and at the bottom of its e-mails. NSS EVENTS processes your data only on its behalf and following its instructions, as data processor, under the data processing agreement (DPA) published on this website.

2. How the platform works for you

Whoever the organiser is, the platform guarantees that:

• at the bottom of every e-mail there is a link to a personal preferences page, where you can stop receiving the organiser's invitations, turn individual measurement of opens and clicks off while still receiving the e-mails, see your data and ask for its deletion;
• opens and clicks are recorded for you only if you gave consent; otherwise they only go into the anonymous campaign totals;
• individual opens and clicks are kept for 24 months from the sending of the e-mail, then remain only in the anonymous totals;
• a deletion request makes your data inaccessible to the organiser at once and deletes it permanently after 30 days;
• if you no longer receive the organiser's invitations and have no interaction with its events and e-mails for 60 months, your data is deleted automatically.

For any other question and to exercise your rights, contact the organiser of the event, or read the privacy notice it gave you, linked in its registration forms and at the bottom of its e-mails.

1. Who processes the data

The data is processed by authorised NSS EVENTS staff and by the providers that help us deliver the service, appointed as data processors. For the data of the customers' events (Part B) they are listed in the sub-processors list published at www.eventleash.com/sub-processors. For the website and the account they also include:

• NSS S.r.l. (Milan): development and technical support of the platform (Italy);
• Amazon Web Services: infrastructure and e-mail sending (European Union, Ireland);
• MongoDB: database (European Union);
• Cloudflare: page delivery, protection from attacks and spam protection of forms (Turnstile);
• Stripe: payments;
• Usercentrics (Cookiebot): consent management for the website cookies (European Union);
• Google: statistics of the www.eventleash.com website (Google Analytics), only with your consent to statistics cookies.

The advertising platforms (Google, Meta and OpenAI) receive data only with your consent to marketing cookies, not as our processors but as independent controllers or, for Meta, joint controllers: see Part A, section 4.

2. Transfers outside the European Union

The data is stored in the European Union. Some providers also process data in the United States: Cloudflare (technical browsing data, such as the IP address, to deliver and protect the pages), Stripe (payment data), Google (with your consent, Google Analytics on the website and Google Ads), Meta and OpenAI (with your consent to marketing cookies). These transfers rely on the European Commission adequacy decision on the EU-US Data Privacy Framework, for the providers that adhere to it, and alternatively on the standard contractual clauses approved by the Commission. Amazon Web Services and MongoDB store the data in the Union and can access it from outside only for technical support, based on standard contractual clauses.

3. Security

We adopt technical and organisational measures suited to protect the data: a separate database for each customer, limited and logged access, encryption of communications and passwords, regular backups. The personal links in e-mails do not contain your e-mail address and cannot be traced back to you.

4. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest and withdraw the consents you gave, without affecting what was done before the withdrawal (Art. 15-22 GDPR). To exercise your rights write to privacy@eventleash.com; for the data of a customer's event contact the customer organising it (Part B). You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

5. Cookies

The use of cookies and tracking tools on the website and the app is described in the cookie policy, where you can also change your choices.

6. Changes and versions

We may update this policy when the service or the law changes; the version in force is always on this page, with the number and date of the last update. This is version 2.0 of 29 October 2026, replacing version 1.0 generated with iubenda. Earlier versions are available on request.