PRIVACY POLICY

This Privacy Policy explains how SUZANA SAVIĆ PR IZDAVANJE OSTALOG SOFTVERA CONFI EVENTS ĆUPRIJA, a sole proprietorship registered in Serbia, with its seat at Proleterskih Brigada 17, 35230 Ćuprija, Serbia ("Confi," "we," "us," or "our"), collects, uses and shares personal information.

It applies to everything we operate under the Confi and Vows brands (together, the "Services"), including:

• the website at https://confi-events.com;
• the Confi admin portal, where organizers create and manage events;
• the Confi Events and Vows mobile applications;
• white-label (custom branded) applications we build and publish for organizers that link to this Privacy Policy; and
• public registration forms, tickets, emails and other features we provide for events.

Words such as "Organizer," "Attendee," "Event" and "Event Data" have the meaning given in our Terms of Service.

If you have questions, email us at admin@confi-events.com.

Every Event in the Services is run by its Organizer, such as a conference organizer, association, company or couple. That affects who is responsible for your data:

• The Organizer is the controller of Event Data and we process it on the Organizer's behalf, as their processor. Event Data includes the guest list and registration details, sign-up and form answers, check-in records, tickets, sponsor leads, and speaker and poster author profiles the Organizer adds. The Organizer decides what is collected and how it is used, and the Organizer's own privacy notice applies to it. If you have a request about Event Data, contact the Organizer of that Event. We will help the Organizer respond, and if you contact us we will forward your request to them.
• We are the controller of your Confi account, your app usage and crash data, website analytics, support conversations with us, and the account and billing data of Organizers.

The rest of this Privacy Policy describes both, and says where the Organizer is in control.

Account information

When you create an account we collect your name, email address and password. Passwords are handled by our authentication provider and are never stored in readable form. You can also sign in with Google or Apple, in which case we receive your name and email address, and from Google also your profile photo. We do not receive your contacts or friends list from these providers.

When you open one of our apps without signing in, the app creates an anonymous account identifier on your device so that features such as live Q&A and quizzes work.

Your profile

You can add a photo, organization, job title, short bio and LinkedIn profile link. These profile details are visible to other participants of the Events you join. You can also add a phone number. Your email address and phone number are not shown on your profile. They are shared only when you choose to share them on your digital business card.

Content you create

Depending on the features an Organizer enables, we store what you post or submit, including:

• feed posts, replies and likes, including photos and videos;
• chat messages, photos, videos, files and contact cards you send in one-to-one or group chats, and when messages were read;
• questions, answers and likes in live session Q&A;
• answers to polls, surveys, ratings and other forms;
• quiz answers and scores;
• sign-ups for sessions with limited places;
• in the Vows app, wishes left in the wish jar, including text, photos and recorded video messages; and
• photos you upload to an Event's photo gallery.

Chat messages are encrypted in transit and when stored on our servers, but they are not end-to-end encrypted.

Information we receive from Organizers

Organizers can add personal information about other people to their Events, for example by importing a guest list, adding speakers, poster authors and sponsor representatives, or uploading a file of speakers. Guest lists include name and email address and can include any other columns the Organizer adds, such as company or ticket type. Speaker and poster author profiles can include name, photo, organization, job title, bio, LinkedIn link and email address. When you sign in with an email address that an Organizer added, we link your account to those records.

Registration, tickets and check-in

If an Event uses our registration or ticketing, we store your registration details and form answers, a ticket with a QR code, whether your ticket email was delivered, and the time you were checked in and by which member of the Organizer's team.

Sponsor lead scanning

If the Organizer enables lead scanning, sponsor representatives can scan your ticket QR code at the Event. The sponsor then receives your name, email address and all other registration details the Organizer holds about you, including any additional fields such as company or ticket type, together with any notes they add, and can export them. If the Organizer later updates your registration, the sponsor's copy is updated too. Ask the Organizer if you want to know whether lead scanning is used at their Event.

Device permissions

Our apps ask for access to device features only when you use a feature that needs them. You can refuse or change these permissions in your device settings at any time:

• Camera: to scan QR codes and take photos or videos for posts, chats, the gallery and wishes.
• Microphone: to record sound with videos and video messages.
• Photos: to choose photos and videos to upload, and to save photos to your device.
• Contacts: to send a contact from your address book in a chat, or to save a business card you received. We only access the contact you pick and never upload your address book. If you send someone else's contact details, please make sure they are happy for you to share them.
• Notifications: to send you push notifications about messages, replies, announcements and Event news.
• Storage (older Android versions only): to save downloaded files.

We do not collect your device's location. The venue map shows the Event location only.

App usage and device information

Our apps use Google Firebase Analytics and Firebase Crashlytics. They collect information about how the apps are used and about crashes, such as the screens you open, the Event you are viewing, searches you make in the agenda, people and posters lists, sessions you add to favorites, files you download, notifications you open, chat activity counts (not message content), and device and app information such as device model, operating system, app version, language, approximate country and IP address. Screen names can include the name of the person, session or poster you are viewing, because we use them to give Organizers statistics about what attendees look at. We do not link this data to your Confi account.

Our admin portal and Event registration pages load fonts from Google Fonts, so Google receives your IP address when you open them.

On Android, when you install an app through an Event link, we read the install referrer from Google Play to open the right Event. To protect our servers from abuse, our apps and admin portal use Firebase App Check, which relies on Google Play Integrity, Apple App Attest and Google reCAPTCHA.

Website and admin portal

If you accept cookies, we use Microsoft Clarity to understand how visitors use our website and admin portal, for example clicks, scrolling and page visits. We store your cookie choice in your browser.

Payments and billing

Organizers pay for Events by bank transfer against an invoice, by PayPal, or through our Paddle checkout. Paddle.com is the Merchant of Record for Paddle orders and collects your payment details directly. We do not receive or store card numbers. We keep the billing details needed to issue and record invoices, such as name, company, address, tax number and the amount paid.

Support

When you email us or submit a request, we keep your message and contact details to respond.

Business contacts

We contact event organizers who may be interested in the Services. For this we keep business contact details such as name, job title, organization and public LinkedIn profile, together with notes on our conversations. Links we send in these messages can be personal, in which case we record when the link is opened. You can ask us at any time to stop contacting you and to delete these details.

Sensitive information

We do not ask for sensitive information such as health data, religious beliefs or political opinions. Organizers decide which questions to include in their registration forms. If an Organizer asks for information such as dietary or accessibility needs, the Organizer is responsible for it. For face matching in the photo gallery, see "EVENT PHOTO GALLERY AND FACE MATCHING" below.

We use personal information for the following purposes. If you are in the EU, EEA, UK, Switzerland or Serbia, we rely on the legal basis shown for each:

• To provide the Services: create and manage accounts, run Events, show your profile and content to other participants, deliver chats and notifications, send tickets and password reset emails, link your account to Event records, and process Event Data on Organizers' instructions. Legal basis: performance of a contract with you, and for Event Data, the Organizer's instructions.
• To keep the Services safe: prevent abuse, spam and fraud, enforce our Terms, and let Organizers moderate and block participants. Legal basis: our legitimate interests.
• To understand and improve the Services: app analytics, crash reports, and statistics for Organizers about engagement with their Event. Legal basis: our legitimate interests. Website analytics with Microsoft Clarity: your consent.
• To communicate with you: answer requests and send service messages such as team invitations and important changes to our terms. We do not send our own marketing to attendees. Organizers can send their attendees tickets, news and push notifications through the Services, which may include messages from the Event's sponsors; the Organizer is responsible for those messages. Legal basis: performance of a contract and our legitimate interests.
• To contact potential customers: reach out to event organizers about the Services and follow up on that contact. Legal basis: our legitimate interests.
• Push notifications: your consent, given through your device settings.
• Billing, accounting and legal obligations: issue invoices, keep tax and accounting records, and respond to lawful requests from authorities. Legal basis: compliance with legal obligations.

When you post a Q&A question or answer anonymously, your name is hidden from other participants in our apps and on event screens. This is not a guarantee of anonymity: we keep a link to your account so that you can delete the post and so that it is deleted when you delete your account, and that link is stored with the post.

We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not sell it.

Where we rely on legitimate interests, you can object, as described in "YOUR PRIVACY RIGHTS." Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.

Other participants of an Event

Your profile (name, photo, organization, job title, bio and LinkedIn link), your feed posts, replies and likes, your Q&A questions and answers unless posted anonymously, your quiz scores on leaderboards, and your sign-ups for sessions are visible to other participants of the same Event. Organizers can show live Q&A and quiz results on screens at the venue. If an Event is invite-only, this information is visible only to the people on its guest list and to its speakers, sponsors and Organizers. Photos and videos are shared through links that open for anyone who has them. Chat messages are visible only to the people in that chat.

If you share your digital business card, the details you choose to include are shared with whoever scans it.

Organizers and sponsors

The Organizer and the team members they invite can see and manage Event Data and the content posted in their Event, export form answers and session sign-ups, print name badges, and send you tickets and notifications. Sponsors receive only the leads they scan, as described above.

Service providers

We use the following service providers (sub-processors) to run the Services. They process personal information only on our instructions:

• Google (Firebase and Google Cloud): hosting, sign-in, database, file storage, server functions, push notifications, App Check, Analytics, Crashlytics, maps, fonts and reCAPTCHA.
• Google Gemini API: AI processing of speaker files uploaded by Organizers (see "AI FEATURES").
• Apple: Sign in with Apple and push notification delivery to Apple devices.
• Resend: sending emails such as tickets, invitations and password resets.
• Microsoft Clarity: website analytics, only with your consent.

Push notifications for chat messages and posts include a short preview of the message, which passes through Google and Apple notification services.

Independent third parties

• Fotny (Alpeen Technologies GmbH, Switzerland) provides the Event photo gallery, as described in "EVENT PHOTO GALLERY AND FACE MATCHING."
• Paddle and PayPal process payments made through them under their own privacy policies.
• Google and Apple process your data under their own privacy policies when you sign in with them or download our apps from their stores.

Other situations

We may disclose information when required by law or a valid request from authorities, to protect the rights, safety and property of our users, us or others, or in connection with a merger, sale or transfer of our business, in which case this Privacy Policy will continue to apply to your information.

We do not sell personal information and we do not share it for targeted advertising.

Organizers can import speakers and poster authors from a file, such as a spreadsheet or PDF. The file is sent to the Google Gemini API, which extracts names, organizations, job titles, bios, LinkedIn links and email addresses so that the Organizer can review them before publishing. Attendee profiles, chats, registrations and form answers are not sent to AI providers.

Organizers can enable a photo gallery for their Event, provided by Fotny (Alpeen Technologies GmbH, Neuwiesenstrasse 15, 8400 Winterthur, Switzerland). Photographs taken at the Event are published in the gallery. If the Organizer enables it, photos posted in the Event feed are also added to the gallery.

When you open the gallery, your name and email address are shared with Fotny so that you can view, like and upload photos. If you choose to use "find your photos," you provide a selfie or your profile photo, and Fotny uses face recognition to find the photos you appear in. This involves biometric data. It is processed by Fotny as an independent controller, only with the consent you confirm in the app before your photo is sent, and under the Fotny Privacy Policy. You can replace or remove your selfie in the app at any time.

Photos copied from the Event feed to the gallery stay in the gallery when the post is deleted, until Fotny deletes them as described below or you ask for them to be removed.

Gallery photos are deleted by Fotny within 7 days after the end of the gallery period, which is normally 90 days after photos are first published. To delete data held by Fotny, contact Fotny or contact us and we will forward your request.

Our website and admin portal use storage in your browser that is necessary for them to work, for example to keep you signed in and to remember your cookie choice. Google reCAPTCHA, which protects the admin portal and registration pages from abuse, and Paddle, on our payment page, also set storage that they need to work.

With your consent, we load Microsoft Clarity, which sets cookies on our domain (such as _clck and _clsk) and on Microsoft's domains (such as CLID, MUID, ANONCHK, MR and SM). You can change your choice at any time using the "Cookie settings" link in the website footer. If you decline, we do not load Clarity and we remove the cookies it set on our domain. Cookies on Microsoft's domains can only be removed in your browser settings.

We do not use advertising cookies or cookies that track you across other websites.

Most browsers and some devices offer a "Do Not Track" setting. Because there is no common standard for responding to these signals, we do not respond to them. We do not track you across third-party websites in any case.

Our database and server functions run in Google Cloud data centers in the European Union. Files such as photos and videos are stored in the European Union, except for Events in Asian time zones, whose files, including profile photos uploaded from such an Event, are stored in Singapore so that they load faster for attendees.

Some of our service providers, including Google, Apple, Microsoft and Resend, are based in the United States or process data there. Fotny is based in Switzerland. When personal information is transferred outside the EU, EEA or Serbia, we rely on adequacy decisions (for example for Switzerland and for companies certified under the EU-U.S. Data Privacy Framework) or on the European Commission's Standard Contractual Clauses, as permitted by the GDPR and the Serbian Law on Personal Data Protection. You can ask us for more information about these safeguards.

• Account and profile: until you delete your account.
• Event Data and content posted in an Event: until the Organizer deletes it or asks us to delete it, or until you delete your account, as described below.
• Gallery photos held by Fotny: as described in "EVENT PHOTO GALLERY AND FACE MATCHING."
• App analytics and crash reports: kept by Google under its retention settings, no longer than 14 months for analytics and 90 days for crash reports.
• Invoices and billing records: for the period required by Serbian tax and accounting law.
• Support emails: as long as needed to handle your request and any follow-up.
• Business contacts: until you ask us to delete them.

What happens when you delete your account

You can delete your account in the app from your profile ("Delete Account"), or by contacting us. When you do, we delete your account, profile and profile photo, your feed posts with their replies and likes, your own replies and likes, your Q&A questions and answers, quiz answers and scores, answers to in-app forms and polls, wishes, session sign-ups, and the photos and videos you uploaded to posts and wishes.

Some information is kept:

• chat messages and files you sent remain visible to the people you sent them to, but you are removed from the chat;
• Event Data controlled by an Organizer, such as your registration on a guest list, answers to registration and sign-up forms, sponsor leads, and speaker or poster author profiles the Organizer created, is kept by the Organizer and is no longer linked to your account. Ask the Organizer to delete it;
• if you are an Organizer, the Events you created and their Event Data remain available to the other members of the Organizer's team. Ask us if you want an Event deleted;
• content you created before signing in, such as wishes or posts made with the anonymous identifier described above, is not linked to your account. Contact us and we will help find and delete it;
• data held by Fotny, including feed photos copied to the gallery, which you can ask Fotny or us to delete, as described above; and
• analytics and crash data, which is not linked to your account.

Deleted data can remain in backups for a limited time before it is overwritten.

We use appropriate technical and organizational measures to protect personal information, including encryption in transit and at rest, access rules that limit who can read each type of data, and restricted administrative access. No system is completely secure, so we cannot guarantee that unauthorized parties will never be able to access your information. If a personal data breach affects you, we will inform you and the relevant authorities where the law requires it.

The Services are not directed at children. People under 16 may use the Services only with the consent of their parent or legal guardian, or when an Organizer admits them to its Event, for example at a school event or a wedding, in which case the Organizer is responsible for obtaining any consent required by law. If you believe we have collected information from a child without the required consent, contact us at admin@confi-events.com and we will delete it.

Depending on where you live, you have the right to:

• access your personal information and receive a copy;
• correct inaccurate information;
• delete your information;
• restrict or object to our processing, including processing based on legitimate interests;
• receive your information in a portable format; and
• withdraw your consent at any time.

You can update your profile in the app at any time and delete your account from your profile. For other requests, use this form or email us at admin@confi-events.com. We may need to verify your identity before acting on a request. We respond within one month, and we will tell you if we need more time. For Event Data, we will forward your request to the Organizer, who is responsible for it.

Complaints

If you are unhappy with how we handle your information, please contact us first so we can try to resolve it. You also have the right to complain to a data protection authority:

• Serbia: the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), www.poverenik.rs.
• EU and EEA: the data protection authority in the country where you live or work, or where the issue occurred.
• United Kingdom: the Information Commissioner's Office, ico.org.uk.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC).

If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, to obtain a copy of it, and not to be discriminated against for exercising these rights. Some states also give you the right to opt out of the sale of personal information, targeted advertising and profiling. We do not sell personal information, share it for cross-context behavioral advertising, or use it for profiling with legal or similarly significant effects.

In the past twelve months we collected the following categories of personal information:

We collect this information from you, from your device, and from Organizers, as described in "WHAT INFORMATION WE COLLECT." We use it for the purposes in "HOW WE USE YOUR INFORMATION," disclose it to the categories of recipients in "WHO CAN SEE YOUR INFORMATION," and keep it as described in "HOW LONG WE KEEP YOUR INFORMATION." We do not use sensitive personal information for any purpose that would give you the right to limit its use.

To exercise your rights, use this form or email us at admin@confi-events.com. We will verify your identity by matching information you provide with information we hold. You may use an authorized agent, who must provide your signed permission. If we decline your request, you can appeal by emailing us, and we will respond in writing within the time required by law. If your appeal is denied, you can contact your state attorney general.

California residents may also request, once a year, information about personal information disclosed to third parties for their direct marketing purposes. We do not make such disclosures.

Canada. We process your information with your consent, which may be express or implied, or where the law permits processing without consent. You can withdraw consent at any time, subject to legal or contractual restrictions, and you can access and correct your information as described in "YOUR PRIVACY RIGHTS."

Australia and New Zealand. We handle your information in accordance with the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020. If you do not provide the information needed for a feature, we may not be able to provide it to you. You can request access to or correction of your information, and complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

South Africa. You can request access to or correction of your information. If you are unhappy with how we handled a complaint, you can contact the Information Regulator (South Africa) at enquiries@inforegulator.org.za or, for complaints, POPIAComplaints@inforegulator.org.za.

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date at the top of this page. If we make material changes, we will tell you before they take effect, by email where we have your email address, or by a notice in the Services or on this page.

If you have questions about this Privacy Policy or how we handle your information, email us at admin@confi-events.com or write to us at:

SUZANA SAVIĆ PR IZDAVANJE OSTALOG SOFTVERA CONFI EVENTS ĆUPRIJA
Proleterskih Brigada 17
35230 Ćuprija
Serbia