Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Eventtool.com, owner Oliver Sebald, Dubai Airport Free Zone (DAFZA), Level 5 8W Block A, PO Box 9813, Dubai, United Arab Emirates. For all data protection matters, you can reach us at datenschutz@eventtool.com. Further details can be found in the Imprint.

2. Processed data

We process in particular the following data:

• Master and account data: name, e-mail address, postal address, telephone number, login data.
• Contract and booking data: enquiries, bookings, orders, tenders and offers, invoices.
• Payment data: payment method, amount, order or booking number and payment identifiers. Card details are received only by our payment service provider, not by us (see section 7).
• Provider data: in addition, company and profile data, name of the contact person, proof of business registration, VAT identification number and payout account details; where a Google Calendar is connected, the appointments we synchronise with that calendar.
• Communication data: messages in the enquiry chat, input to our AI assistant “Evi” and to the AI event planner, e-mails to us.
• Uploaded content: images, documents and texts that you post on our marketplace.
• Usage data: see section 5.
• Data of invited guests of the press and reference area: name, form of address, organisation, e-mail address, reason for the invitation and – after logging in with the personal access code – the times of visits, the chapters viewed and the IP address in the server logs (see “Press and reference area” below).

Processing is carried out pursuant to GDPR Art. 6 para. 1 lit. a, b, c and f (see section 3). The service providers that receive data in this context are listed in section 7.

Press and reference area. We personally invite individual people to our press and reference area (presse.eventtool.com). In doing so, we process the name, form of address, organisation, e-mail address and the reason for the invitation and, after logging in with the personal access code, the times of visits, the chapters viewed and your IP address in the server logs. This serves to conduct the tour, to greet you personally and to follow up on whether and how the invitation was used, as well as to defend against attacks. The legal basis is our legitimate interest in press and reference work (GDPR Art. 6 para. 1 lit. f); we receive your contact details from you or from publicly accessible professional sources. We delete the information no later than six months after the invitation has expired, and the server logs after 14 days; we can block the access code at any time. You can object to the processing at any time with effect for the future (GDPR Art. 21) – a short message to datenschutz@eventtool.com is sufficient; we will then block your access and delete your information.

3. Legal basis

Processing is carried out for contract performance (GDPR Art. 6 para. 1 lit. b), to fulfil legal obligations (GDPR Art. 6 para. 1 lit. c), on the basis of legitimate interests (GDPR Art. 6 para. 1 lit. f) and, where we ask you for it, on the basis of your consent (GDPR Art. 6 para. 1 lit. a).

4. Your rights

You have at any time the right of access, rectification, deletion, restriction, data portability and objection. Contact datenschutz@eventtool.com. You may withdraw any consent you have given at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (GDPR Art. 77).

5. Cookies and website statistics

We use technically necessary cookies. With your consent, we also use cookies for website statistics with Google Analytics and load content from external media platforms. We do not currently use marketing cookies. You can change your selection at any time via the link “Change cookie settings” at the bottom of every page.

Our own visitor statistics

To understand how our marketplace is used, to detect errors and to design our offering according to demand, we keep visitor statistics on our own servers. For each page view, we record the page called up and the time. We also record the country, which we derive from your IP address, the language set in your browser, device type, browser and operating system, and the address of the website from which you came to us (domain name only). For searches on our marketplace, we additionally store the search term, the number of results and the selected category. So that we can group several page views of the same visit, we create a pseudonymous visitor key – a check value formed with a secret key from which the underlying information cannot be read. It is based on the identifier of your technically necessary session cookie and, only where there is no session, on your IP address and your browser identifier. We do not set a separate statistics cookie. Apart from this, we use your IP address only to determine the country; it is not stored in the statistics. We do not assign the statistics to a user account, even if you are logged in. We do not pass this data on to third parties. We delete it automatically after 400 days.

In addition, we count how often certain actions occur, such as registrations, enquiries, bookings, purchases, published tenders and choices made in the cookie notice. This count is kept only as a daily total per country and language and without reference to individual persons.

The legal basis is our legitimate interest in analysing, detecting errors in and designing our offering according to demand (GDPR Art. 6 para. 1 lit. f). You may object to this processing at any time on grounds relating to your particular situation (GDPR Art. 21), e.g. by e-mail to datenschutz@eventtool.com.

Google Analytics

If you consent to the “Statistics” category in the cookie settings, we use the web analytics service Google Analytics 4 provided by Google (for the provider, see section 7). We measure exclusively in our own Google Analytics account. Without your consent, Google Analytics is not loaded. Google Analytics stores cookies on your device (_ga and _ga_<ID>, each with a lifetime of up to two years) that recognise your browser on later visits. Information about your use is transmitted to Google: pages viewed and their address, time, referring page, device and browser information and your approximate location. Depending on the settings, Google Analytics also automatically records simple interactions such as scrolling, clicks on links to other websites, file downloads and search terms contained in the page address. If you reach us via an advertisement, the page address may contain a click identifier of the advertising network concerned, which is recorded as well. In addition, we report certain actions to Google Analytics as events: registration as a customer or provider, enquiry, rental request or binding rental, purchase (with order value, currency and order number) and publication of a tender, each with the selected country and language. We do not transmit names, e-mail addresses or your user ID to Google. In our integration of Google Analytics, we use Google’s consent mode to tell Google that no advertising cookies may be set and that the data may not be used for advertising purposes or personalised advertising. Google Signals is deactivated, no Google Ads account is linked to Google Analytics, and the User-ID and “user-provided data” features are not activated. According to Google, IP addresses of users from the EU, Switzerland and the United Kingdom are not logged or stored, but are used only to determine the approximate location and are then discarded. We have configured Google Analytics so that Google deletes event-level data after 2 months and user-level data after 14 months; the period for user-level data starts again with each new activity of the same user. Aggregated reports without reference to individual users may be kept beyond that.

The legal basis is your consent (GDPR Art. 6 para. 1 lit. a; for storing and reading the cookies, Section 25 para. 1 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and the corresponding national provisions implementing Art. 5(3) of the ePrivacy Directive 2002/58/EC). You may withdraw your consent at any time with effect for the future by deselecting the “Statistics” category via “Change cookie settings” at the bottom of every page. Google Analytics will then no longer be loaded. You can delete cookies that have already been set in your browser. Further information can be found in Google’s Privacy Policy (https://policies.google.com/privacy).

6. AI assistant “Evi” and speech output

The AI-powered assistant “Evi” is available to you in the chat on our marketplace.

Speech output (read-aloud). When you switch on the speaker in the Evi chat, the text of Evi’s reply is transmitted to our service provider ElevenLabs Inc. (USA) and converted there into an audio file, which we deliver to your browser and play aloud. Only the text of Evi’s reply is transmitted; Evi may repeat information in her reply that you have previously provided in the chat. The audio file generated by ElevenLabs is stored by ElevenLabs in accordance with its Privacy Policy (https://elevenlabs.io/privacy-policy) and deleted once the retention periods stated there have expired. The legal basis for the transfer is your consent (GDPR Art. 6 para. 1 lit. a), which you grant by switching on the speaker. You may withdraw your consent at any time with effect for the future by switching off the speaker.

ElevenLabs Inc., headquartered in the USA, is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the adequacy decision of the European Commission (GDPR Art. 45). Should the certification lapse, the standard contractual clauses agreed with ElevenLabs shall apply (GDPR Art. 46).

7. Recipients and processors

To provide our services, we use the following service providers. Where they process data on our behalf, we have concluded a data processing agreement (GDPR Art. 28) with them or agreed to their data processing terms. DeepSeek and Moonshot AI are an exception: these providers do not offer a data processing agreement, and we have not concluded one with them (see “Transfers to China and Singapore” below). Some service providers also process data under their own responsibility; we point this out below in each case.

Website statistics. For website statistics with Google Analytics (only with your consent, see section 5), we also use Google: the contracting party for customers in the EU is Google Ireland Limited (Ireland); the service is provided through the Google group, including Google LLC (USA), so the data may also be processed in the USA. We have concluded Google’s data processing terms for Google Analytics with Google; under these terms, Google processes the data as our processor (GDPR Art. 28). The transfer to the USA is based on the adequacy decision of the European Commission (EU-US Data Privacy Framework, GDPR Art. 45); Google LLC is certified under it.

Payment processing. Payments on our marketplace are processed via Stripe. You enter your card details directly into the input field provided by Stripe; we do not receive them. We transmit to Stripe your name, your e-mail address, your user ID, the amount and the order or booking number. If you choose PayPal as the payment method, Stripe redirects you to PayPal; PayPal then processes your data under its own responsibility. Providers who receive payouts set up their payout account directly with Stripe (Stripe Connect); Stripe itself collects the identity and account data required for this. For its own purposes, such as fraud prevention and compliance with legal obligations (e.g. anti-money laundering and identity verification), Stripe processes the data under its own responsibility (https://stripe.com/privacy). The legal basis is the performance of the contract (GDPR Art. 6 para. 1 lit. b) and compliance with legal obligations (GDPR Art. 6 para. 1 lit. c).

AI features. In addition to Evi (sections 6 and 8), other features of our marketplace use language and image models from external AI providers: automatic translation of messages in the enquiry chat and of item and profile texts, review of newly listed items, review of new provider accounts (company name, description, location, website, telephone number and name of the contact person) and of the uploaded proof of business registration, text and image suggestions in the product assistant, in the catalogue import and in the shop builder, the AI event planner and the expansion of search terms. Only the content that the feature needs to process is transmitted. We determine which provider performs a feature for each feature and may change this; if a provider cannot process a request – for example due to an outage, overload or error – the next one takes over automatically in the order OpenAI, DeepSeek, Moonshot AI. Images and documents – such as a proof of business registration – are not transmitted to DeepSeek, but in the fallback case they are transmitted to Moonshot AI. Information relating to a person is excluded from this: the review of new provider accounts (including the name and telephone number of the contact person) and the translation of chat messages are carried out exclusively by OpenAI; there is no fallback provider for these features. Your questions to Evi are currently sent to OpenAI. The legal basis is the performance of the user agreement (GDPR Art. 6 para. 1 lit. b) and our legitimate interest in a secure, multilingual and efficiently operated marketplace (GDPR Art. 6 para. 1 lit. f).

Transfers to China and Singapore. According to its own statements, DeepSeek processes and stores data in the People’s Republic of China, and Moonshot AI on servers in Singapore. There is no adequacy decision of the European Commission for either country; a level of data protection equivalent to EU law has therefore not been established there. We have not agreed standard contractual clauses or other appropriate safeguards under GDPR Art. 46 with these providers; they do not offer them. Your data is therefore not protected there in the same way as in the EU; in particular, public authorities may have broader access to data under local law, and you may not have effective legal remedies against this. According to its privacy policy, Moonshot AI reserves the right to also use transmitted content to develop its models; DeepSeek’s terms do not expressly exclude this.

Google Calendar. Providers can connect their own Google Calendar to our marketplace. We then enter bookings with that provider as appointments in their calendar – with the customer’s name, the item, the quantity, the price, the booking number and the period – and read appointments from the calendar in order to block times that are already taken. The data is then held in the provider’s Google account. The legal basis is the performance of the contract (GDPR Art. 6 para. 1 lit. b) and our and the provider’s legitimate interest in reliable availability planning (GDPR Art. 6 para. 1 lit. f).

Fonts and map display. We deliver the fonts used on our pages from our own servers; no data is transmitted to third parties in the process. A Google Maps map is embedded on our contact page. When you open this page, your browser transmits your IP address and information about your browser to Google. The legal basis is our legitimate interest in an easy-to-find address (GDPR Art. 6 para. 1 lit. f).

Verification of VAT identification numbers. If you provide a VAT identification number, we verify it via the VAT Information Exchange System (VIES) of the European Commission (GDPR Art. 6 para. 1 lit. c and f).

8. Chat with the AI assistant

When you ask Evi a question, your input is transmitted for the purpose of generating a response to a service provider for artificial intelligence that we use (see the section “Recipients and processors”). The processing serves to answer your request and is based on our legitimate interest in support that is available at any time and efficient (GDPR Art. 6 para. 1 lit. f); if you are logged in with us, it additionally serves to perform the user agreement concluded with you (GDPR Art. 6 para. 1 lit. b). Please do not provide special categories of personal data (e.g. health data) in chat messages.

According to its own statements, OpenAI generally stores the inputs transmitted in the chat and the responses generated for up to 30 days and removes them from its systems thereafter; by default, OpenAI does not use your chat data for training its AI models (https://openai.com/policies/api-data-usage-policies).

9. Storage period

We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations apply. In detail:

• Account and the content of your account (profile, wish list, reviews, event plans, tenders, Event2Job profile): for as long as your account exists, unless a shorter period is stated below. When your account is deleted, we also delete the files you uploaded (e.g. item images, logos, review photos, attachments).
• Unconfirmed registration: If a registration is not confirmed by e-mail within 30 days, we delete the account automatically.
• Orders, bookings, invoices and payment data: We keep invoices, orders and bookings that have been concluded for the duration of the statutory retention obligations; as long as such records exist, the associated account cannot be deleted.
• Enquiries and chat: We delete messages in the enquiry chat and enquiries to entries in the provider directory (including those sent without an account) two years after the last message; conversations relating to orders and concluded bookings are kept for as long as these are kept.
• Event2Job: We delete applications six months after the job posting has ended.
• Deleted event plans and shopping carts: We permanently remove deleted event plans after 30 days, and shopping carts without an account after 30 days.
• Newsletter: We delete unconfirmed sign-ups after 30 days. After you unsubscribe, we keep the proof of your earlier consent (e-mail address, timestamps, IP address) for three years and then delete it.
• Proof of business registration: We delete the uploaded file from online storage 30 days after the decision on activation. We keep a copy in a secured archive on our own hardware so that we can prove the verification later. We delete this copy three years after the end of our business relationship with you or, if activation was refused, three years after the decision.
• Chat with Evi: We do not store your conversation with Evi on our servers (for retention by OpenAI, see section 8).
• Our own visitor statistics: 400 days (see section 5); Google Analytics: as described in section 5.
• Security data: We delete login and confirmation codes after 30 days, and security logs containing IP addresses (change log, abuse protection) after one year.
• AI checks of items: We delete the logs of our AI checks (moderation, tagging, search engine texts) after 90 days.
• Error logs of our servers and logs of our nightly maintenance runs: 14 days; operational monitoring data: 30 days.
• Login session: it ends after 120 minutes of inactivity.
• Delivery events of our e-mails to providers (such as delivery or opening): 90 days.
• Press and reference area: We delete invitation details, visit times and chapters read no later than six months after the invitation has expired, and the server logs after 14 days.

10. Additional information for US residents (including California)

This section supplements this privacy policy for visitors and users of www.eventtool.com who reside in the United States, including California. It contains the information required by the California Online Privacy Protection Act (CalOPPA). Everything else in this privacy policy applies to you as well. Last updated: 12 October 2026

Who we are

The operator of www.eventtool.com is Eventtool.com, owner Oliver Sebald, Dubai Airport Free Zone (DAFZA), Level 5, 8W Block A, P.O. Box 9813, Dubai, United Arab Emirates (e-mail: datenschutz@eventtool.com). Eventtool is an online marketplace: customers rent or buy event equipment, rent event locations and book event services from independent providers. We do not rent or sell equipment or event locations ourselves and are not a party to the contract between you and a provider.

What information we collect

• Contact and account information: name, e-mail address, postal address, telephone number if you provide it, log-in details.
• Marketplace activity: enquiries, chat messages with providers, bookings, orders, tenders, subscriptions (VIP, Poweruser Pro), wish lists and event lists.
• Payment information: payment status, invoices and order numbers. You enter card details directly with our payment processor; we do not receive them. If you pay a subscription by bank transfer or receive payouts as a provider, we store your bank details in encrypted form.
• Provider information: business name, description, location, website, contact person and the uploaded proof of business registration.
• Questions to our AI assistant “Evi” and, if you switch on the speaker, the text of Evi’s replies for speech output.
• Usage information: pages viewed, search terms, device type, browser, the referring website and the country derived from your IP address; the place or postcode you enter for a radius search.

Details are given in sections 2 and 5 to 8 of this privacy policy.

How we use it

We use this information to provide the marketplace and your account, to process enquiries, bookings, purchases and subscriptions, to handle payments, invoices and payouts, to verify providers, to answer your questions, to keep our services secure, to compile statistics and improve our services, and to comply with legal obligations.

Who we share it with

We share personal information with the following categories of third parties:

• the provider you contact or order from, who handles your enquiry or order as an independent business;
• service providers that work for us: hosting, e-mail delivery and a standby server (Germany), file storage (Amazon Web Services, EU), payment processing (Stripe; PayPal if you choose it), providers of artificial intelligence (OpenAI in the USA, DeepSeek in the People’s Republic of China, Moonshot AI in Singapore), speech output (ElevenLabs, USA) and Google (website statistics only with your consent, calendar synchronisation for providers who connect their Google Calendar, the map on our contact page);
• authorities and advisers where the law requires it.

The complete list with the purpose and location of each service provider is in section 7 “Recipients and processors”. Your information may therefore be processed outside the United States.

We do not sell your personal information. We do not use marketing cookies and do not use your information for advertising on other websites.

Reviewing and changing your information

If you have an account, you can review and change your profile, address and notification settings at any time in your account settings. You can also delete your account there; providers who have made sales cannot delete their account because of statutory retention obligations and can close their shop instead. For anything you cannot change yourself, write to datenschutz@eventtool.com.

Do Not Track

Some browsers send a “Do Not Track” signal. There is no common standard for how websites should respond to it. Our website currently does not respond to Do Not Track signals. You can decide yourself whether we use website statistics and load external media: via “Change cookie settings” at the bottom of every page.

Tracking by third parties

Only if you consent to “Statistics” in our cookie settings does Google, as the provider of our website statistics (Google Analytics), collect information about your use of our website by means of cookies; Google may collect information about your online activities over time and across different websites. Videos and audio samples from external media platforms (for example YouTube or Vimeo) are likewise only loaded with your consent. Our contact page shows an embedded Google Maps map; when it loads, your browser transmits your IP address and information about your browser to Google.

Children

Our marketplace is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe that a child has provided us with personal information, please contact us and we will delete it.

Changes to this privacy policy

If we change this privacy policy, we update the “Last updated” date above. We announce material changes on our website before they take effect.

Contact

Questions about your personal information: datenschutz@eventtool.com or via our contact form. Postal address: Eventtool.com, owner Oliver Sebald, Dubai Airport Free Zone (DAFZA), Level 5, 8W Block A, P.O. Box 9813, Dubai, United Arab Emirates.