Bernhard Götzendorfer
Rittingergasse 15/11
1210 Wien, Österreich / Austria
Email: office@gotzendorfer.at
We process personal data only to the extent necessary for providing our services. Processing is carried out on the basis of the GDPR (General Data Protection Regulation) and the Austrian DSG (Data Protection Act).
When you visit our website, the following technical data is automatically collected: IP address, browser type, operating system, referrer URL, time of access. This data is necessary for the technical operation of the website (legal basis: Art. 6(1)(f) GDPR — legitimate interest).
When creating an account we collect: email address, and optionally your name (when signing in via Google or Apple). Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
When photos are uploaded, we process: image files, upload timestamp, event association, and optionally the uploader's name (max. 100 characters). GPS location data from EXIF metadata is automatically stripped on upload (privacy protection measure). Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
Payment data is processed directly by our payment service provider Stripe. We do not receive complete credit card numbers. We store: payment status, invoice data, selected plan, Stripe payment ID. Available payment methods include credit card, SEPA direct debit, EPS, and Klarna (via Stripe Automatic Payment Methods). Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
When a photo is reported by a user, we collect: reason for the report, optional description, reporter's IP address, timestamp, and the associated photo/event reference. The event owner is notified by email.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting users from inappropriate content and maintaining platform integrity. Report data is retained for the duration of the event plus 30 days.
When a co-admin is invited to manage an event, we collect: invited person's email address, invitation token (UUID), invitation status (pending/accepted), date of invitation, and the inviting user's reference.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract (enabling collaborative event management as part of the service). Invitation tokens expire automatically after 7 days. Co-admin memberships are retained until the event is deleted.
When a plan upgrade is performed, we create an audit record in theplan_changestable containing: event reference, previous plan, new plan, price paid, Stripe payment ID, and timestamp.
Legal basis: Art. 6(1)(c) GDPR — legal obligation. This data is part of our accounting records and must be retained for 7 years in accordance with the Austrian Federal Fiscal Code (§ 132 BAO).
If you participate in the commission program as an event helper, we process the following data:
Legal basis:Art. 6(1)(b) GDPR — performance of the commission program contract.
Retention:7 years pursuant to § 132 BAO (Austrian Federal Fiscal Code) for tax-relevant records.
If you apply for the EventDrop Partner Program, we process the following data:
Legal basis:Art. 6(1)(b) GDPR — performance of the partner program contract.
Retention:Financial records (commission amounts, payouts, IBAN/BIC) are retained for 7 years pursuant to § 132 BAO (Austrian Federal Fiscal Code). Non-financial data (name, website, motivation) is deleted upon partner account closure or program termination.
We use Sentry (Functional Software, Inc., San Francisco, USA) for error monitoring to ensure the stability and security of our application. When an error occurs, the following technical data is automatically transmitted:
No personal data is collected: IP addresses are not transmitted (sendDefaultPii: false), no cookies are read, and no session replays are recorded during normal usage.
Legal basis:Art. 6(1)(f) GDPR — legitimate interest in maintaining application security and stability. Error monitoring is essential for detecting and resolving technical issues that affect all users.
Retention:Error data is automatically deleted after 90 days by Sentry.
Data transfer: Data may be processed in the USA. Sentry participates in the EU-U.S. Data Privacy Framework.
We use cookies to ensure the basic functions of the website and to improve your user experience. The legal basis for the use of technically necessary cookies is § 165 TKG 2021 (Austrian Telecommunications Act). For non-essential cookies (analytics), we obtain your prior consent in accordance with § 165(3) TKG 2021 and Art. 6(1)(a) GDPR.
Cookie categories:
We work with the following service providers. All listed US-based providers either participate in the EU-US Data Privacy Framework (DPF) or have signed EU Standard Contractual Clauses (SCCs) as a supplementary safeguard. Where DPF certification is the primary basis, SCCs are maintained as a backup mechanism.
Uploaded photos are automatically analyzed by artificial intelligence (Google Gemini via Vercel AI Gateway). Purpose of processing:
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving user experience and protecting against inappropriate content.
Photos are transmitted to the AI provider only temporarily for analysis. There is no permanent storage by the provider and no profiling. Your photos are not used to train AI models.
No automated individual decision-making (Art. 22 GDPR):The AI processing does not produce decisions with legal or similarly significant effects on users. There is no profiling as defined by Art. 4(4) GDPR. All AI results (tags, highlights, captions, moderation flags) serve solely as suggestions and can be overridden by the event owner.
EventDrop offers an AI-powered support chat (Claude by Anthropic via Vercel AI Gateway) to help users with questions about the platform.
Data processed during chat interactions:
Escalation: If the AI assistant cannot resolve your inquiry, your conversation summary may be forwarded to our support team (office@gotzendorfer.at) for manual handling.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract (providing customer support as part of the service). Chat messages are not permanently stored and are not used to train AI models.
When creating an event, the entered event title may be transmitted to an AI service (Claude by Anthropic via Vercel AI Gateway) to generate:
Legal basis: Art. 6(1)(b) GDPR — performance of a contract (assisting event creation as part of the service). The event title is transmitted only temporarily. No permanent storage occurs at the AI provider. Suggestions are optional and can be modified or ignored by the user.
Personal data is deleted as soon as the purpose of processing no longer applies, unless legal retention obligations require longer storage.
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Payment & invoice data | 7 years | § 132 BAO |
| Account data | Until deletion + 30 days | Art. 6(1)(b) GDPR |
| Event photos | Until manual deletion or account deletion | Art. 6(1)(b) GDPR |
| Server logs | 30 days | Art. 6(1)(f) GDPR |
| Analytics data | 365 days | Art. 6(1)(a) GDPR |
| Consent records | 3 years | Art. 7(1) GDPR |
| Photo reports | Event duration + 30 days | Art. 6(1)(f) GDPR |
| Co-admin invitation tokens | 7 days | Art. 6(1)(b) GDPR |
| Co-admin memberships | Until event deletion | Art. 6(1)(b) GDPR |
| Plan change audit records | 7 years | § 132 BAO |
| Commission data | 7 years | § 132 BAO (tax-relevant records) |
| Partner data (financial) | 7 years | § 132 BAO |
| Partner data (non-financial) | Until partner account closure | Art. 6(1)(b) GDPR |
| Error monitoring data (Sentry) | 90 days | Art. 6(1)(f) GDPR |
You have the following rights under the GDPR:
To exercise your rights, please contact: office@gotzendorfer.at
In addition to your right to data portability under Art. 20 GDPR, Regulation (EU) 2023/2854 (EU Data Act, applicable since September 2025) grants you the right to access and transfer data generated through your use of our digital service. You can export all your data at any time via Settings > Data Export in your account. The export includes your profile, events, uploads, comments, reactions, analytics, plan changes, event members, payment history, photo reports, event extensions, recap videos, commissions, commission payouts, partners, and partner referrals in machine-readable JSON format.
The appointment of a data protection officer is not required, as the conditions under Art. 37 GDPR (in conjunction with § 5 DSG) are not met. EventDrop is operated as a small business. There is no core activity consisting of regular and systematic large-scale monitoring of data subjects, nor large-scale processing of special categories of data. For data protection inquiries, please contact office@gotzendorfer.at.
You have the right to lodge a complaint with the Austrian Data Protection Authority:
Österreichische Datenschutzbehörde / Austrian Data Protection Authority
Barichgasse 40-42
1030 Wien
www.dsb.gv.at
Last updated: February 2026