Privacy Policy

Your privacy is important to us. Please read this policy carefully.

Who is responsible for processing your personal data?

NEVENTECH is the DATA CONTROLLER responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR) EU 2016/679 and the Spanish Organic Law 3/2018 (LOPDGDD).

Why do we process your personal data?

To maintain a commercial relationship with users. The planned operations include:

Sending commercial communications via email, SMS, social media, or any other electronic or physical means.
Conducting market research and statistical analysis.
Processing orders, requests, and responding to inquiries submitted through our contact forms.
Sending newsletters about news, offers, and promotions.

Legal basis for processing

Processing is legitimized under Article 6 of the GDPR:

User consent: for sending commercial communications and newsletters.
Legitimate interest: for market research, statistical analysis, and processing user requests.

How long will we keep your personal data?

Data will be retained for no longer than necessary to fulfill the processing purposes or as required by legal obligations. When no longer needed, data will be deleted with appropriate security measures to ensure anonymization or complete destruction.

Who do we share your personal data with?

No personal data will be shared with third parties except when necessary for service execution, with our communication service providers who have signed confidentiality and data processing agreements as required by privacy regulations.

Do we use analytics and measurement tools?

Yes. We use the following tools to understand how our website and partner portal are used, measure the effectiveness of our communications, and manage requests for our programs:

Google Analytics 4, through Google Tag Manager, to measure usage of the website and the partner portal (pages visited, traffic source, interactions). Provider: Google Ireland Limited.
Meta Pixel and Conversions API, to measure the effectiveness of our advertising and, where applicable, show you relevant ads. When data is sent server-to-server (Conversions API), the necessary identifiers are transmitted in accordance with Meta's technical and privacy requirements. Provider: Meta Platforms Ireland Limited.
Microsoft Clarity, only on the partner portal, to generate heatmaps and session recordings that help us identify interface usability issues (clicks, scrolling, mouse movement). Content containing personal data is masked, and this tool does not run on the admin area. It is not used to make individual decisions about any Partner. Provider: Microsoft Ireland Operations Limited.
A CRM (Pipedrive) and an automation orchestrator (n8n) to manage requests and the partner program, and Chatwoot for support chat.

Legal basis: the DATA CONTROLLER's legitimate interest in measuring and improving our services and promoting our activity (art. 6.1.f GDPR), and the USER's consent where required by regulations. You can object to these processing activities or withdraw your consent at any time by exercising your rights as described in the "What are your rights?" section of this policy.

International transfers: these providers may give access to data from outside the European Economic Area. Such access is safeguarded by standard contractual clauses and/or recognized adequacy frameworks, such as the Data Privacy Framework, for U.S. providers adhering to it.

Retention period: analytics data is retained according to the periods configured in each tool (for example, in Google Analytics 4 and Microsoft Clarity retention is limited and configurable), never exceeding the periods set by applicable regulations.

Google user data in the Google Analytics and Google Ads integrations

Nevent is a marketing and ticketing platform for event organisers. Its customers can optionally connect, through Google OAuth, their Google Analytics 4 property and their Google Ads account, and any user can sign in with Google. This section explains which Google data we process in each case.

Google Analytics

Permission requested: read-only access to Google Analytics (https://www.googleapis.com/auth/analytics.readonly), from Settings → Channels → Analytics.
Data we access: the names of the Analytics accounts, the properties and the web data streams the authorising account can read; the available dimensions and metrics; and aggregated reports (for example, page views, sessions and events, with domains, landing page paths, campaigns, channels and sources/mediums).
Purpose: to set up the integration, suggest which pages belong to each event and show the customer, in their Nevent dashboard, the aggregated traffic of their event pages next to their ticket sales.
Storage: the refresh token is stored encrypted (AES-256-GCM) and linked to the customer's organisation; access tokens are kept temporarily in memory. We keep the connection settings (selected property, its name, time zone, currency, domains, granted permissions and configuration records) and the pages associated with each event until the customer requests their deletion. Reports, suggestions and the catalogue of dimensions and metrics are only cached temporarily.
Disconnection: when you disconnect, we delete the stored refresh token. Disconnecting does not guarantee that the permission is removed in Google; you can remove it at https://myaccount.google.com/permissions. Disconnecting does not automatically delete the settings described above: you can request their deletion as explained in "What are your rights?".

Google Ads

Permissions requested: access to the Google Ads API (https://www.googleapis.com/auth/adwords) and the Data Manager API (https://www.googleapis.com/auth/datamanager), from the advertising section of Nevent.
Data we access: the Google Ads accounts the authorising user can access and, for the selected account, its name, currency, time zone and tracking settings; its campaigns, ad groups, ads, targeting and performance metrics (for example, impressions, clicks, cost and conversions); and its customer lists.
What we do in the account: Nevent does not create, modify or delete campaigns, ads or budgets. Its only write is, when the customer asks for it, to create a Customer Match list in the customer's own account from a segment of their fans and send to that list, through the Data Manager API, those fans' email addresses, normalised and hashed with SHA-256 before they leave Nevent. In every upload we exclude deleted accounts and users who have registered in Nevent their objection to advertising audiences; unsubscribing from emails is not the same as that objection. Disconnecting or unlinking in Nevent does not remove the list or its members from Google Ads: their removal is managed in Google Ads. The customer must use data collected directly from their own customers, inform them that it is shared with Google, obtain the consents required by law and by Google's policies, and comply with the Customer Match restrictions.
Purpose: to show the customer, in their Nevent dashboard, the performance of their Google Ads campaigns next to their ticket sales, and to let them use their own fan segments as audiences in their Google Ads account.
Storage: Google Ads tokens are stored encrypted (AES-256-GCM) and linked to the customer's organisation. We keep the connected account settings, the campaign structure and its daily metrics to show the history in the dashboard, and the link between segments and Customer Match lists with their statuses, counts and sync records, until the customer requests their deletion. We do not persistently store the hashes sent to Customer Match: they are processed temporarily in memory to send them.
Disconnection: when you disconnect, we delete the stored tokens. To also remove the permission in Google, do so at https://myaccount.google.com/permissions. Campaign data already stored is kept until you request its deletion as explained in "What are your rights?".

Sign in with Google

Permissions requested: openid, email and profile, when you choose "Sign in with Google" in a Nevent application.
Data and purpose: of what Google provides, we use your Google account identifier and your verified email address only to create your Nevent account, identify you when you sign in and send you security notifications about your account. We do not access any other data in your Google account.

Common commitments

Use: data obtained from Google Analytics is used only for the analytics feature described and is never added to advertising audiences. Data read from Google Ads is used to display and manage the integration described. Separately, and only at the customer's request, we send Google, through Data Manager, the email hashes from the customer's own CRM for Customer Match. We do not sell this data or use it for our own advertising.
Sharing: besides the transfer to Google described for Customer Match, this data is only processed, as processors on Nevent's behalf and under its instructions, by the cloud hosting and database providers needed to provide these features, and it will be disclosed where required by law.
Limited Use: Nevent's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What are your rights?

Users have the following rights:

Right to withdraw consent at any time.
Right of access, rectification, portability, and deletion of data, and limitation or opposition to processing.
Right to file a complaint with the supervisory authority (www.aepd.es) if you believe the processing does not comply with regulations.

Contact details to exercise your rights:
NEVENTECH. Taibo – Carnoedo, 1 – 15169 Sada (A Coruña), Spain
Email: dpo@eritiaprivacidad.com

Mandatory or optional information

By checking the corresponding boxes and entering data in fields marked with an asterisk (*), users expressly and freely accept that their data is necessary to fulfill their request.

Users guarantee that the personal data provided is accurate and are responsible for communicating any changes.

Security measures

In accordance with current data protection regulations, the DATA CONTROLLER complies with all provisions of GDPR and LOPDGDD for processing personal data, following the principles described in Article 5 of GDPR.

The DATA CONTROLLER guarantees implementation of appropriate technical and organizational policies to apply security measures established by GDPR and LOPDGDD to protect users' rights and freedoms.

For more information about privacy guarantees, contact:
NEVENTECH. Taibo – Carnoedo, 1 – 15169 Sada (A Coruña), Spain
Email: dpo@eritiaprivacidad.com