Privacy Policy for Vepino

• Organisers’ accounts, user data and login credentials
• Invoice and payment data with the organiser
• Operational and security logs for the Service
• Our own marketing to organisers and prospects (see HS Privacy Policy)

• Participant data (invited, registered, checked in)
• Distribution lists and contact data for marketing or newsletters
• Custom fields the organiser chooses to collect
• Content of campaigns and event pages

For this category we act as data processor under the organiser’s instruction in accordance with our Data Processing Agreement (DPA, Annex C with appendices) with the organiser.

If you have received an email campaign, an event invitation or an SMS delivered via Vepino: the sender — not Vepino — has decided to contact you and is the data controller for that processing. Vepino provides the technical infrastructure for delivery, registration and communication.

For information about why you received the campaign, how long your data is retained, what legal basis is invoked and how to exercise your rights — turn to the sender. The sender’s contact details and privacy policy can normally be found in the campaign or on the registration page.

For questions about Vepino’s technical processing as processor, you can contact privacy@humansyn.tax. We normally forward such questions to the sender as the data controller.

• Name and email address
• User ID and authentication data (one-time code via email or federated login via SSO — see §6.3)
• Associated workspaces and organisation affiliation
• Settings (language, Live/Demo environment, etc.)
• Usage data (logins, activity, IP address, browser and operating system, timestamps)

As processor for the organiser we process the data the organiser chooses to collect or import. This typically includes:

• Name
• Email address
• Mobile number (if relevant)
• Company and role/title (in professional context)
• Custom fields created by the organiser (may in some cases contain special categories under Article 9 GDPR — see 3.4)
• Check-in data (time, status, attendance)
• Payment confirmation for paid events (Swish reference, invoice reference)
• Engagement data per campaign (delivery, opens, clicks, bounces, unsubscribes)

A complete and structured list is available in Annex C Appendix 1A — Record of Processing Vepino.

When you visit an event or registration page operated on Vepino’s infrastructure, we technically log:

• IP address
• Browser and operating system
• Timestamp, pages visited, referrers

This takes place as processor for the organiser and is used for security, troubleshooting and statistics.

Vepino allows the organiser to create custom fields for participant registration. These may contain special categories of personal data under Article 9 GDPR depending on the organiser’s design — for example:

• Food allergies or dietary preferences (health)
• Disabilities or accessibility needs (health)
• Religion or belief (diet, holidays)
• Other data covered by Article 9

It is the organiser’s responsibility to obtain explicit consent under Article 9(2)(a) or another applicable basis for processing special categories.

• Authentication tokens in encrypted storage (iOS Keychain and Android Keystore respectively)
• Local cache of event and participant data to enable offline mode
• Device identifiers for paired Bluetooth printers (locally on the device)
• Diagnostic logs (stored locally; not sent automatically from the device, but a user can choose to share them manually with support for troubleshooting purposes)

All local data is deleted on logout or uninstall.

The app contains no ad networks, analytics tools or third-party libraries that collect data for marketing or tracking purposes.

All communication between the app and the Vepino backend takes place via HTTPS (TLS 1.2 or later). Authentication tokens are deleted from the device on logout and invalidated server-side so they can no longer be used for access.

We use the following data processors to operate Vepino:

• Oderland Webbhotell AB (Sweden) — hosting and operation
• AC PM LLC (operator of Postmark, subsidiary of ActiveCampaign) — outgoing email for campaigns initiated by the organiser
• Amazon Web Services EMEA SARL (Amazon SES) — outgoing email for campaigns initiated by the organiser
• Microsoft Ireland Operations Limited (Microsoft 365) — office tools we use for support cases, customer correspondence and file storage (Exchange/Outlook and OneDrive/SharePoint) where personal data from the Service may occur. Microsoft also appears as an independent data controller for SSO login, see §6.3.

A complete and current subprocessor list is available in Annex C Appendix 2 — Subprocessors.

SMS delivery is mediated via 46elks AB (Sweden), a Swedish telecommunications operator. 46elks acts as an independent data controller for traffic data under the ePrivacy Directive and the Swedish Electronic Communications Act (LEK), not as a subprocessor to Vepino.

When the Customer chooses federated login (Single Sign-On), the following identity providers handle authentication data as independent data controllers, not as subprocessors to Vepino:

• Google Ireland Limited (Sign in with Google)
• Microsoft Ireland Operations Limited (Sign in with Microsoft)
• Apple Distribution International Ltd. (Sign in with Apple — available in beta)

For EU-based end users, each Irish company is the data controller in accordance with the provider’s terms. No third country transfer occurs via the SSO mechanism.

We use subprocessors both within and outside the EU/EEA. For transfers to third countries (USA), the EU-U.S. Data Privacy Framework applies primarily, and Standard Contractual Clauses under EU Commission Decision 2021/914 as backup. Detailed information about each subprocessor, place of processing and applicable mechanism is available in Annex C Appendix 2. Otherwise our primary processing takes place within the EU/EEA.

We may disclose personal data to authorities where required by law.