Privacy policy

The controller for account, website, security, payment, and business administration data is Nikolaus Redl, trading as Who Attends, Kleistgasse 18/41, 1030 Vienna, Austria. VAT ID: ATU82884407.

Send privacy and security requests to security@supercenter.app. We have not appointed a data protection officer because the current activities do not meet the mandatory appointment criteria. The address above is the direct privacy contact.

We act as an independent controller for account, website, security, payment, and business records. When a business customer asks us to process conference directory and attendee data for its own business purpose, the customer is the controller and we normally act as its processor.

The Data Processing Agreement states the Article 28 terms, security measures, and subprocessors for this customer-directed processing.

We need the core account, conference request, and service data to enter into or perform the contract. Marketing consent is not required to use the website or service.

Attendee results can contain personal data that we did not collect from the person concerned. The data can come from a conference directory that the customer can lawfully access, an event website, company pages, and public professional profiles. Section 3 lists the data categories.

We disclose the result to the customer that requested it and to the technical providers needed to complete the request. When we act as a processor, the customer is responsible for a notice required by Article 14 GDPR. If a result is incorrect or was processed unlawfully, send the event and source details to security@supercenter.app.

We share data only when needed to provide, secure, or measure the service, when you instruct us, or when law requires it. A provider is used only when its related function is configured.

We do not sell customer requests or attendee list outputs.

Some providers process data outside the European Economic Area. If a country has no EU adequacy decision, we use an available transfer safeguard. This can include the European Commission Standard Contractual Clauses and technical and organizational measures. You can request information about the applicable safeguard from the privacy contact.

• Account records: while the account is active, then normally up to 30 days after a verified deletion request, subject to backups and legal duties.
• Sessions: up to 7 days. Security and verification records can have shorter periods.
• Conference access details: only while needed to complete and check the requested list, normally no more than 30 days after delivery. The application stores submitted details with AES-256-GCM authenticated encryption.
• Conference inputs and attendee list outputs: for the service term and for as long as needed to support the delivered work. A verified deletion request can end this period unless a legal duty applies.
• Support, fraud prevention, and operational records: for the account term and applicable limitation periods.
• Invoices and tax records: for the statutory accounting period, which can be up to 10 years in Austria.
• Analytics and optional marketing data: according to provider settings and your marketing choice. The cookie policy lists expected browser storage periods.

We use transport encryption, provider-managed encryption at rest, password hashing, secure session cookies in production, access controls, request validation, limited production access, and operational monitoring. No service can guarantee complete security. Report a suspected exposure to security@supercenter.app.

Subject to the GDPR conditions and exceptions, you can request access, correction, deletion, restriction, portability, or information about recipients. You can object to processing based on legitimate interests. You can object to direct marketing at any time. You can withdraw consent without changing the lawfulness of earlier processing.

Send requests to security@supercenter.app. We can ask you to prove your identity. We normally respond within one month. If we act for a customer, we will refer the request to that customer when we can identify it.

You can complain to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, Austria, at dsb.gv.at, or to another competent supervisory authority.

Necessary authentication, security, and preference storage works without optional consent. PostHog, Google Analytics, and Google Tag Manager are always active when configured. Meta Pixel stays off when marketing is disabled. Rejecting marketing does not prevent account creation or use. Use "Privacy choices" in the footer to change or withdraw marketing consent. We treat Global Privacy Control as a marketing refusal. See the cookie policy for details.

We do not make solely automated decisions about website visitors or account users that have legal or similarly significant effects. The service is for business users aged 18 or older. It is not directed to children.

We update this policy when the processing changes. We will show a material change in the service or send it to the account email when appropriate. The date and version at the top identify the current notice.

This notice follows Articles 13 and 14 of the EU General Data Protection Regulation.