Privacy Policy

1. Who we are

Cadas AS (Norwegian org. no. 926 572 229) operates Evenero at www.evenero.com, event.evenero.com, and app.evenero.com. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Norwegian Personal Data Act, Cadas AS is the data controller for the personal data processed through Evenero.

2. What data we process

• Account data: email address and (optional) display name when you create an Evenero account.
• Payment data: handled entirely by Stripe. We never see or store full card details. We receive transaction status, amount, currency, and the email you provided to Stripe.
• Print orders (Gelato): when you order printed products we collect your name, shipping address, phone (optional) and email. These are required to fulfil and ship the order.
• Event media: photos and videos uploaded by you or your event participants. Uploaded media is stored in your event and shared as you configure it.
• Support correspondence: messages you send to us and the metadata around them.
• Technical data: IP address, browser and device information, and request logs, for security, abuse prevention, and operating the service.
• Cookies and similar technologies: see our Cookie Policy.

3. Why we process it and on what legal basis

4. Who receives your data

We use the following data processors. Each is bound by a Data Processing Agreement (DPA) and, where applicable, Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF).

5. International transfers

Our application data is hosted in the EU (Google Cloud, europe-north1 / Finland). Some of the processors listed above are based in the United States. Where data is transferred outside the EEA we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses to ensure an adequate level of protection.

6. How long we keep data

When the retention period ends, data is either permanently deleted or anonymised so it can no longer be linked to an individual.

7. Your rights

Under GDPR you have the right to:

• Access — receive a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion when the data is no longer necessary.
• Restriction — ask us to limit processing in certain circumstances.
• Objection — object to processing based on legitimate interest, including profiling.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — at any time, for processing that relies on consent (analytics, marketing). You can change your cookie choices via the CookieHub icon in the bottom-left of every page.
• Lodge a complaint — with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

To exercise any of these rights, email post@evenero.com. We will respond within 30 days.

8. Children

Evenero is intended for users aged 18 or older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

9. Security

We use HTTPS in transit, encryption at rest for our database and media storage, role-based access controls, and regular security updates. While no system can guarantee absolute security, we work to keep your data safe and notify affected users without undue delay in the event of a breach as required by GDPR.

10. Changes to this policy

We may update this Privacy Policy when our processing or tooling changes. Material changes will be highlighted on the Site. The "Effective Date" at the top of this page always reflects the latest version.

11. Contact us

For any privacy question or to exercise your rights: