Privacy Policy

1. Introduction

FX2 INFORMATION SERVICES LIMITED ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Events Manager platform ("Service").

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

2. Data We Collect

2.1 Account Data

When you register for an account, we collect:

• Full name
• Email address
• Phone number (optional)
• Password (stored encrypted using bcrypt hashing)

2.2 Business Data

When you use the Service, you may enter:

• Client and supplier information (names, addresses, contact details, VAT/fiscal codes)
• Event details (dates, venues, fees)
• Financial data (invoices, transactions, payments)
• Employee data (for UNIEMENS/INPS compliance)
• Contracts and document uploads

2.3 Technical Data

• IP address
• Browser type and version
• Login timestamps
• Usage patterns (pages visited, features used)

3. How We Use Your Data

We process your personal data for the following purposes:

• Service delivery: To provide and maintain the Events Manager platform
• Authentication: To verify your identity and manage your account
• Communication: To send you verification emails, password resets, and service notifications
• Legal compliance: To comply with applicable laws (e.g., INPS/UNIEMENS reporting, tax regulations)
• Security: To detect and prevent fraud, abuse, and security incidents
• Improvement: To analyse usage patterns and improve the Service

4. Legal Basis for Processing (GDPR Article 6)

• Contract performance: Processing necessary to provide the Service you subscribed to
• Legitimate interests: Security, fraud prevention, service improvement
• Legal obligation: Tax compliance, employment law (UNIEMENS)
• Consent: Marketing communications (where applicable)

5. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organisational measures including:

• Encrypted passwords (bcrypt hashing with salt)
• HTTPS/TLS encryption in transit
• JWT-based authentication tokens
• Rate limiting and anti-spam protection
• Regular automated backups
• Role-based access control (Creator, Admin, User)

6. Data Retention

We apply the GDPR storage-limitation principle (Article 5(1)(e)) — personal data is kept only for as long as necessary. In practice:

6.1 Active accounts

Your data is retained for as long as your subscription is active (any tier — Solo, Pro, Agency, Enterprise), or during your free trial.

6.2 Cancelled or lapsed accounts (paused state)

If you cancel your subscription, do not convert your trial, or otherwise stop using the Service, your account enters a paused, read-only state:

• Data remains accessible for 12 months so you can re-subscribe and pick up where you left off — no lock-in but no punitive deletion either.
• We send you a warning email approximately 1 month before the retention window ends, and a final reminder 15 days before deletion.
• After 12 months of continued paused inactivity, the account and all associated personal data are permanently deleted. This includes events, clients, suppliers, invoices, contracts, uploaded documents, and stored credentials.
• Upgrading, downgrading, or logging in to view your data resets the retention clock — only sustained inactivity triggers deletion.

6.3 Immediate deletion on request (GDPR Article 17)

You can request immediate deletion at any time — no need to wait 12 months — from Settings → Account → Delete my account, or by emailing info@fx2events.com. See our Data Deletion Instructions for the step-by-step.

6.4 Records retained beyond the account

Some data is kept even after account deletion because we're legally required to:

• Invoices and tax records: retained for up to 10 years (Italian D.P.R. 633/72, HMRC record-keeping requirements). Kept in a segregated, read-only archive — not accessible via the platform UI.
• Audit logs of authentication and payment events: retained for 12 months for fraud prevention and legal compliance.
• Anonymous, aggregated usage statistics that cannot be linked back to an individual.
• Backups containing your data are automatically pruned within 30 days of your deletion.

7. Your Rights (GDPR Articles 15-22)

Under the GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data via your Profile settings
• Right to erasure: Request deletion of your account and data
• Right to data portability: Export your data in CSV format
• Right to restrict processing: Limit how we use your data
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time via your settings

To exercise these rights, contact us at info@fx2events.com or use the data export/deletion features in your Profile.

8. Data Sharing

We do not sell your personal data. We may share data with:

• Service providers: Hosting (Railway), email delivery (SMTP provider) — bound by data processing agreements
• Legal authorities: When required by law or to protect our rights
• INPS/tax authorities: Employment and tax data as required by Italian/UK law

9. International Transfers

Your data may be processed in countries outside the UK/EU. Where this occurs, we ensure appropriate safeguards are in place (Standard Contractual Clauses, adequacy decisions).

10. Cookies

We use cookies for authentication and preference storage. See our Cookie Policy for full details.

11. Connected Social Media Accounts

The Service lets you connect your own social media accounts (for example TikTok, Facebook, Instagram, Threads, LinkedIn, X, YouTube, Bluesky or Mastodon) so you can publish your event content to them from one place. Connecting an account is optional and only happens when you click Connect and approve it on the platform's own sign-in page.

11.1 What we receive

• Basic profile information needed to show which account is connected (account ID, display name, profile picture)
• The access and refresh tokens the platform issues, which let us act on your behalf within the permissions you approved
• For Facebook and Instagram, the list of Pages and linked Business accounts you administer (see our Data Deletion Instructions)

We do not receive or store your social media passwords, private messages, followers or contacts lists, or analytics beyond what you explicitly connect.

11.2 TikTok

If you connect TikTok, we request only two permissions: user.info.basic (your TikTok open ID, display name and avatar, used to show the connected account) and video.upload (used to upload a video you choose to your TikTok inbox as a draft). Nothing is published automatically: you review, caption and publish each draft yourself in the TikTok app. We do not access your existing videos, comments, followers or analytics.

11.3 How we use it

Data from connected accounts is used solely to publish the content you choose, show the status of your posts, and display which accounts are connected. It is never sold, used for advertising, or shared with other users.

11.4 Disconnecting and deletion

• You can disconnect any platform at any time from Settings. Disconnecting deletes the stored access and refresh tokens for that platform.
• You can also revoke our access directly on the platform (for TikTok: Settings and privacy → Security & permissions → Apps and services permissions).
• Deleting your Events Manager account removes all connected-account data (see section 6).

Your use of each platform remains subject to that platform's own terms and privacy policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of significant changes via email.

13. Contact & Complaints

For privacy-related enquiries: info@fx2events.com

You have the right to lodge a complaint with a supervisory authority:

• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Italy: Garante per la protezione dei dati personali — garanteprivacy.it