Privacy policy

Who is responsible

For accounts, sign-in, billing, support, this site and our own logs: the company that runs Galla, named with its address in the imprint (the controller). For guest lists and everything about an event, including the details of vendor and sponsor contacts: the organization that runs it is the controller, and Galla processes that data for it under the data processing agreement.

How to reach us

For anything about personal data, write to the privacy contact: [email address]. Data protection officer: [name and contact, or “not appointed” once confirmed]. You can also use the contact page.

What we keep about staff, and why

• Your account: name, email address, when it was made and verified, and your second sign-in step (its secret is encrypted). To provide the service you signed up for (contract).
• Your organizations and your role in each. Contract.
• The legal documents you accepted, with their versions and dates. To prove the agreement (contract; legal obligation).
• Sign-in sessions, security logs and an audit log of changes you make, kept by each organization. To keep accounts and data secure (our legitimate interest in security).
• For owners and finance staff: the organization’s billing details and invoices. Billing (contract) and bookkeeping (legal obligation).
• Support requests you send: the subject, your message, screenshots and who sent it. To answer you (contract).
• When Galla support opens your organization to help: who, when and why, shown to your owners. Accountable support (legitimate interest).
• At sign-up: a fingerprint (hash) of your email address, without your name, to prevent repeated free trials (legitimate interest).

An account needs your name and email address; without them we cannot provide the service. We make no decision about you by automated means alone that has legal or similarly significant effects.

Visitors of this site

This site keeps technical request logs (address, page, time, browser) for 30 days to run and secure it (legitimate interest). The contact page is an email address; what you write is kept to answer you.

Guests, vendors and sponsors

Organizations keep their guests’ names, contact details, replies, meal choices, dietary and allergy notes (encrypted, and shown only to the roles allowed to see them), seats, tickets, photos shared and messages sent, and the names, email addresses, phone numbers and files of their vendor and sponsor contacts. They got these details from you or from the person who invited you. Each organization chooses how long guest data is kept after its events; then it is anonymized.

To ask about your data, use the “Your data” form on your event page or on your vendor or sponsor page, or write to the organization. We help organizations answer.

Cookies and storage

Galla uses only cookies and browser storage that are strictly necessary for a service you asked for, so they need no consent:

• eventapp_sid: keeps a team member signed in to the back office; ends at sign-out or after 12 hours.
• eventapp_guest: keeps a guest’s invitation open on that one event’s pages, instead of the link; up to 30 days.
• eventapp_partner: keeps a vendor or sponsor contact signed in; up to 7 days.
• In the back office only, browser storage keeps check-ins made offline at the door until they are sent, a team invitation while you sign in, and which announcements you closed; nothing of it is sent to anyone else.

The pages of this public site (home, pricing, contact and these legal pages, on Galla’s own address) count visits with Umami, which sets no cookies and keeps no personal profile: it records the page, the referring site, the browser, device type and country, to see how the site is used (legitimate interest). Back-office, guest, ticket, vendor and sponsor pages load no analytics. There is no advertising or third-party tracking, and fonts are served by Galla itself. Your language is read from your browser’s settings, not stored. Signing in to the back office talks to Google’s sign-in service (Firebase Authentication) from your browser, without keeping your sign-in there; if you choose to sign in with Google or Microsoft, their sign-in page applies its own cookies.

Who receives data

Galla staff who need it to run and support the service; the providers listed on the subprocessors page, each bound by a data processing agreement; an organization’s own email provider when the organization sends from its own address; and authorities when the law requires it. We do not sell personal data or use it for advertising.

Where data is kept, and transfers

On Google Cloud in the European Union: Belgium, with backups in the Netherlands. Some providers may process data outside the EU, mainly in the United States: staff sign-in (Firebase Authentication), email delivery (Postmark) and payments (Stripe). Each is listed on the subprocessors page with its safeguard: the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and the Commission’s standard contractual clauses in its data processing terms. Write to us for a copy.

How long

• Accounts: until you delete yours, or the only organization you belong to is deleted.
• Organization data, including support requests, data requests and the support access log: until the organization is deleted. Guest data is anonymized earlier, after the period the organization chose (365 days after the event unless it changes it).
• Organization exports: 7 days.
• Deleted data leaves our backups within 37 days.
• Invoices: 10 years, as French law requires, even after the organization is deleted.
• Sign-up fingerprints: as long as needed to prevent repeated free trials, without any name or address.
• Logs: 30 days. Emails at our email provider: 45 days.

Your rights

You can ask to see your data, correct it, delete it, receive it in a reusable file, restrict its use, and object to a use based on our legitimate interest. In the back office you can correct your name, download your own data and delete your account from the account page; owners can export or delete their organization. Guests, vendors and sponsors ask the organization with the “Your data” form. For anything else, such as changing your email address, write to the privacy contact above. We answer within one month, or tell you within that month why we need up to two more.

You may also complain to a data protection authority, in particular where you live or work. In France this is the CNIL (Commission nationale de l’informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr).

Security

Each organization’s data is kept apart by the database itself; connections and stored data are encrypted; dietary notes and secrets are encrypted again by Galla; staff sign in with two steps; guest links are stored only as fingerprints and never logged. If a breach puts your data at risk, we follow a written procedure and tell the authority and, where needed, you.

Changes

We publish each new version here with its date and keep the earlier ones. You are asked to accept a new version at your next sign-in.