GDPR And UK GDPR

Who Is The Controller And Who Is The Processor

For the registrant data in your workspace, you are the controller and OPVII is the processor. You decide which events to run, who to invite, what to say to them, and how long to keep their records. We act on your instructions and do not use your registrants' personal data for any purpose of our own.

For your own account data, which is the name, email address, phone number and billing details of the people who sign in, OPVII is the controller. That is the only personal data we determine the purpose of, and the Privacy Policy covers it.

The distinction matters because the rights below are exercised against the controller. If you are a registrant who received an email or a text message about somebody else's seminar, the business that ran the seminar is the controller, and we will pass your request to them rather than act on their records without instruction.

Lawful Basis For Each Thing We Do

Processing registrant data in your workspace rests on your instruction as controller, under Article 28, and on your own lawful basis for collecting it.

Sending a confirmation, a reminder, a calendar invitation or an attendance follow-up for an event somebody registered for rests on the performance of that registration and on the consent captured at the point of registration.

Running your account, taking payment, keeping an audit trail and defending against abuse rests on our legitimate interests and, for billing records, on a legal obligation to keep them.

Analytics on our own marketing site rests on consent, and that consent is asked for before any analytics or advertising cookie is set for a visitor in the EEA, the United Kingdom or Switzerland.

Rights A Registrant Or Account Holder Has

Under the GDPR and the UK GDPR you have the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, the right not to be subject to a decision based solely on automated processing, and the right to withdraw consent at any time without that withdrawal costing you anything.

Nothing on this platform makes an automated decision that has a legal or similarly significant effect on anybody. There is no profiling, no scoring of individuals and no automated eligibility decision.

How To Exercise A Right

A registrant can handle the common cases without contacting anybody. The attendee portal at /attendee/login signs you in with a one-time code sent to your email address, with no password to create, and from there you can see every event you are registered for, correct your own name and phone number, opt out of text messages, and opt out of email.

For anything beyond that, including access, erasure, restriction and portability, write to dev@opvii.local. We acknowledge a request promptly and respond within one month, which the regulation allows us to extend by two further months for a genuinely complex request. If we extend, we will tell you why inside the first month.

We will ask for enough information to be confident you are who you say you are, because handing somebody else's registration history to the wrong person is the worse failure. We will not charge a fee and will not ask you to explain why you are asking.

An account holder exercising a right over their own account data writes to the same address. A controller asking us to act on their workspace's registrant data can do it themselves in the product, and we will help if the volume makes that impractical.

Where Your Data Is And How It Moves

The platform and its database run in the United States, and every subprocessor listed on this site is either United States based or operates a global edge with a United States origin. There is no European hosting region today, and we would rather say that plainly than leave it to be discovered during a procurement review.

For a transfer of personal data out of the EEA, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, Module Two, controller to processor, which are incorporated into our Data Processing Addendum. The United Kingdom International Data Transfer Addendum applies to a transfer from the United Kingdom, and the Swiss Federal Act on Data Protection applies to a transfer from Switzerland, in both cases on top of the same clauses.

Our subprocessors are bound by equivalent terms. We carry out a transfer impact assessment before adding one and will not add a provider whose jurisdiction we cannot assess.

Retention

Workspace records live for as long as the account does. When an account is closed, its data is deleted on request and otherwise removed on our ordinary schedule.

Administrative audit records are retained for two years and security events for seven, so that a question about what happened to an account can still be answered long after the fact.

Opt-in and opt-out records are retained even after a number or an address has opted out, because carrier rules and consumer protection law expect us to be able to demonstrate that consent existed and that the opt-out was honored. Deleting that record would remove the only evidence protecting the person who asked to be left alone.

A Personal Data Breach

If we become aware of a personal data breach affecting your workspace, we will notify you without undue delay and in any event within 72 hours of becoming aware of it, with what we know at the time rather than waiting for a complete picture.

The notice will describe the nature of the breach, the categories and approximate number of people and records involved, the likely consequences, and the measures we have taken or propose to take. As your processor we notify you; notifying a supervisory authority or the affected people is the controller's decision and we will give you what you need to make it.

Subprocessors And Changes To Them

The full list is published at /subprocessors and is kept current rather than being sent out on request. You can object to a new subprocessor on reasonable data protection grounds, and the Data Processing Addendum sets out what happens if we cannot resolve the objection.

Children

The platform is sold to businesses and is not directed at children. We do not knowingly collect personal data from anybody under 16. If you believe a registrant record in a workspace belongs to a child, write to dev@opvii.local and we will work with the controller to remove it.

Our Data Protection Contact

We have not appointed a statutory Data Protection Officer, because the scale and nature of our processing does not require one under Article 37, and we would rather tell you that than name a role nobody holds. Data protection questions, requests and questionnaires go to dev@opvii.local and reach a person who can answer them.

We have not appointed an Article 27 representative in the European Union or the United Kingdom. If your procurement process requires one, tell us and we will say plainly whether we can meet the requirement.

Complaining To A Supervisory Authority

If you think your data has been handled badly, we would like the chance to put it right first. You do not have to give us that chance. You can complain to the supervisory authority in the country where you live or work, or where you believe the problem happened. In the United Kingdom that is the Information Commissioner's Office. Exercising that right costs you nothing with us.

What We Do Not Claim

We have not completed a SOC 2 or ISO 27001 audit, we hold no ISO 27701 privacy certification, and we do not describe ourselves as certified under any of them. Encryption at rest covers integration credentials rather than every registrant field. There is no European hosting region.

The full list of what we do not claim, with the reasoning, is on the Trust Center at /trust. It is there because a compliance page that only lists strengths gets read as a sales page and discounted entirely.