GDPR at Galla

How Galla protects the personal data of your team, your guests, your vendors and your sponsors. And how each of them can use their rights under the GDPR.

There is no official GDPR certificate. This page sets out what Galla does; the legal pages hold the binding details.

• Hosted in the European Union

  The application, the database, files and backups run on Google Cloud in Belgium, with backup copies in the Netherlands. Our sign-in, email and payment providers are listed with where they process data and the safeguard for any transfer outside the EU.

• A data processing agreement

  Your organization decides what it keeps about its guests, vendors and sponsors, and is their controller; Galla processes that data on your behalf. An owner accepts our data processing agreement (GDPR article 28) when the organization is created, and every version stays published.

  Read the data processing agreement

• Subprocessors in the open

  The providers that process personal data for Galla are listed publicly. Owners are told 30 days before one is added and can object.

  See the subprocessors

• Rights people can use in the app

  Team members correct their name, download what Galla keeps about them and delete their account from their account page. Owners download all of the organization’s data and can delete the organization, with 14 days to change their mind. Guests, vendors and sponsors ask the organization from their own page to see, correct, delete, restrict or receive their data, and staff answer within a month.

• Security built in

  Each organization’s data is kept apart by the database itself. Connections and stored data are encrypted, and dietary and allergy notes are encrypted again by Galla and shown only to the roles allowed to see them. Team members sign in with two steps, guest links are stored only as fingerprints and never written to logs, and whenever Galla support opens an organization it records a reason the owners can read.

• Kept only as long as needed

  Each organization chooses how long guest data is kept after an event (365 days unless it changes it); then it is anonymized. Deleted data leaves every backup within 37 days. Technical logs are kept for 30 days, and invoices for 10 years, as the law requires.

• If something goes wrong

  Galla follows a written incident procedure. If a breach affects an organization’s data, we tell its owners without undue delay and within 48 hours, with what we know and what we are doing, so they can meet their own 72-hour deadline. For the data we control ourselves, we notify the supervisory authority within 72 hours where the GDPR requires it.

• No tracking

  Galla sets only the cookies needed to keep people signed in. This public site counts visits without cookies; guest pages and the back office load no analytics. There is no advertising, and fonts are served by Galla itself.

  Read the privacy policy