Privacy policy
This policy explains which personal data Galla keeps, why, for how long, and how to use your rights. It covers the people who use the back office and visitors of this site. For guests, vendors and sponsors of an event, the organization that runs the event decides what is kept; we keep it on its behalf.
Earlier version, in force from Thursday, October 15, 2026. Read the version in force
Who is responsible
For accounts, sign-in, billing and this site: the company that runs Galla (see the imprint). For the guest lists and everything about an event: the organization that runs it, with Galla as its processor under the data processing agreement.
What we keep about staff
- Your account: name, email address, when it was made and verified, and your second sign-in step (its secret is encrypted).
- Your organizations and your role in each.
- The legal documents you accepted, with their versions and dates.
- Sign-in records and an audit log of changes you make, kept by each organization.
- For owners and finance staff: billing details and invoices of the organization.
We use them to run the service, keep it secure, bill the organization and meet our legal duties (contract, legitimate interest in security, legal obligation for invoices).
Guests, vendors and sponsors
Organizations keep their guests’ names, contact details, replies, meal choices, dietary and allergy notes (encrypted, and shown only to the roles allowed to see them), seats, tickets, photos shared and messages sent. Each organization chooses how long guest data is kept after its events; then it is anonymized.
To ask about your data, use the “Your data” form on your event page or write to the organization. We help organizations answer.
Cookies
We only use cookies needed to keep you signed in and to remember your language. There is no advertising or third-party tracking, and guest pages load no third-party scripts.
Where data is kept
On Google Cloud in the European Union (Belgium, with backups in the Netherlands). The providers we use are listed on the subprocessors page. Where a provider may access data from outside the EU, the European Commission’s standard contractual clauses apply.
How long
- Accounts: until you delete yours, or the only organization you belong to is deleted.
- Organization data: until the organization is deleted; deleted data leaves our backups within 37 days.
- Invoices: 10 years, as French law requires, even after the organization is deleted.
- Logs: 30 days.
Your rights
You can ask to see, correct, download or delete your data, to restrict or object to its use, and complain to your data protection authority (in France, the CNIL). In the back office you can download your own data and delete your account from the account page; owners can export or delete their organization. For anything else, write to us at the address in the imprint.
Changes
We publish each new version here with its date and keep the earlier ones. You are asked to accept a new version at your next sign-in.