Privacy Policy
We never sell your data, and we only touch client data to do the work you hired us for.
The short version
- We never sell your data. Not client data, not website visitor data, not to anyone, for any price.
- Your data stays yours. When we work with a client’s data, the client is in charge of it. We only follow the client’s instructions. In legal terms, the client is the data controller and we are the data processor.
- We only access client data to do the work you hired us for. We do not look at it, use it, or share it for any other reason.
- We collect very little for ourselves. Just what we need to answer you, run our business, keep our website working, and see how it is used.
- You have rights, and we honor them wherever you live. You can ask to see, fix, or delete your information at any time.
1. Who we are
Summit Stone Innovations LLC is a company that does business under the name Event Data Pro. In this policy, “Event Data Pro”, “we”, “us” and “our” all mean Summit Stone Innovations LLC.
We build and run data integrations for events and conferences. We connect systems such as registration platforms, mobile event apps, customer databases and marketing tools so that information moves between them correctly.
This policy explains what information we handle, why, and what choices you have. It covers our services, our integration platform, and our website at eventdata.pro.
2. Two kinds of data, two different roles
We handle two kinds of personal information, and our role is different for each.
| Client data | Our own business data | |
|---|---|---|
| What it is | Information that lives in our clients’ systems and passes through the integrations we build, such as records of event registrants, attendees, speakers, exhibitors and sponsors. | Information people give us directly, such as a name and email on a form, a booked consultation, or a job application. |
| Who decides how it is used | The client. The client is the data controller. | We do. We are the data controller. |
| Our role | Data processor (also called a “service provider” under some US state laws). We handle it only on the client’s instructions. | We use it only for the purposes listed in section 4. |
| Where it is covered | Section 3 | Section 4 |
3. Client data
The client owns it and stays in control
Client data belongs to the client. We handle it only as described in our agreement with the client and in the client’s written instructions. We do not decide what data is collected, why it is collected, or who it is shared with. Those decisions belong to the client.
We never sell it
We do not sell client data. We do not rent it, trade it, or share it with anyone for advertising or marketing. We do not combine one client’s data with another client’s data. We do not use client data to build profiles of people, and we do not use it to train artificial intelligence models.
We only access it to deliver our services
Our team accesses client data only when it is needed to do the work the client hired us for. That means:
- checking that an integration is possible, with the access the client chooses to give us;
- building, testing and launching the integration;
- monitoring the integration and fixing problems while it runs;
- answering a support request from the client; and
- meeting a legal obligation, such as a valid court order. If the law allows, we tell the client first.
We do not access client data for any other reason. Access is limited to the team members who need it for the client’s project, and everyone on our team is bound by confidentiality.
Who else may handle it
We use a small number of trusted providers, such as cloud hosting companies, to run our platform. They may only handle client data to provide their service to us, under written contracts that require them to protect it. A current list of these providers is available to clients on request. We also send client data to the systems the client asks us to connect, because that is the purpose of an integration.
How we protect it
We use technical and organizational safeguards designed to protect client data, including encrypted connections, limited and role-based access, and monitoring of our platform. We ask for the lowest level of access needed for each stage of a project. No system can be guaranteed to be perfectly secure, but we work hard to keep data safe.
If we learn of a security incident that affects client data, we will notify the affected client without undue delay and give them the information they need to meet their own legal duties.
How long we keep it
We keep client data only for as long as the integration runs or as our agreement with the client requires. When the work ends, we delete or return client data on the client’s request, and in any case delete it from our active systems within 90 days, unless the law requires us to keep it longer.
Data processing agreement
We offer clients a data processing agreement that sets out these commitments in contract form, including the terms required by the GDPR and by US state privacy laws. To request one, email contact@eventdata.pro.
If you attended or registered for an event. If your information is in a system that belongs to one of our clients, such as an event organizer, that organizer is in charge of it. Please contact the organizer to see, correct or delete your information. If you contact us instead, we will pass your request to the right client and help them respond.
4. Information we collect for our own business
What we collect and why
| Information | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Contact details you give us: name, work email, phone, company, job title, and your message | To answer your question, book and hold a consultation, and send information you asked for | Our legitimate interest in replying to you, or steps you asked us to take before a contract |
| Client account and billing details: business contact names, emails, invoices and payment records | To deliver our services, provide support, send invoices and keep required business records | Performing our contract with you, and legal obligations |
| Occasional updates about our services or research | To keep in touch with business contacts. Every message has an unsubscribe link. | Your consent, or our legitimate interest where the law allows |
| Job applications: resume, cover letter and contact details | To review your application and contact you about the role | Steps you asked us to take before a contract, and our legitimate interest in hiring |
| Basic technical information: IP address, browser type and pages requested | To keep the website working and secure | Our legitimate interest in running a safe website |
| Website usage: pages viewed, forms completed, the campaign or link that brought you, and an identifier kept in your browser | To understand how our website is used and to measure whether our advertising works | Your consent where the law requires it, otherwise our legitimate interest in improving our website and marketing |
We never sell this information either
We do not sell personal information. We have not done so in the past 12 months, and we will not do so in the future. We do not hand lists of people to other companies for advertising. The one advertising tool on our website is described under “Cookies and similar tools” below, and you can turn it off. We do not use personal information to make automated decisions that have legal or similarly significant effects on people.
Who we share it with
We share this information only with:
- providers who help us run our business, such as hosting, email, scheduling, analytics and payment services, under contracts that require them to protect it;
- professional advisors such as lawyers and accountants, when needed;
- authorities, when the law requires it; and
- a successor company, if our business is ever merged or sold. This policy will keep applying to your information.
Cookies and similar tools
Our website uses a small number of cookies and similar browser storage. A banner on your first visit lets you choose “All cookies”, “Necessary only” or “Reject all”. You can change your answer at any time with the “Cookie settings” link at the bottom of every page.
- Necessary: a cookie set when you send a form, which limits how many forms one sender can submit and cannot be turned off because it protects the website. A note of your cookie choice. A note that you already filled in a report form, so that you are not asked twice. “Reject all” removes that last note.
- Analytics: PostHog, HubSpot, and in some cases our own platform, record page views and completed forms so we can see how the website is used. HubSpot is also a system we use for marketing and sales, so it may keep the details you enter in a form and connect your visits to them.
- Advertising measurement: the LinkedIn Insight Tag tells LinkedIn that a visit, a report request or a booked consultation happened on our website. We use this to measure our LinkedIn advertising, and LinkedIn may use it to show our ads to people who visited. LinkedIn may connect it to your LinkedIn account under its own privacy policy. Google Tag Manager loads tags like this one and collects nothing for itself.
- Campaign history: if you arrive from a link that names a campaign, we keep that in your browser and attach it to a form you send, so we know which campaign led to your enquiry.
If your device is set to a European time zone, or your browser sends a Global Privacy Control signal, analytics, advertising measurement and campaign history stay off unless you choose “All cookies”. Otherwise they are on until you choose “Necessary only” or “Reject all”, either of which turns them off.
How long we keep it
We keep this information only as long as we need it for the purposes above. Enquiries and business contact details are kept while we have an active relationship and for up to three years after our last contact. Job applications are kept for up to one year. Billing records are kept for as long as tax and accounting laws require. You can ask us to delete your information sooner.
5. Sending data between countries
We are based in the United States and have a team in Canada. Information may be handled in those countries and in others where our providers operate.
When personal information from the European Economic Area, the United Kingdom or Switzerland is sent to a country that has not been recognized as offering the same level of protection, we rely on approved legal safeguards, such as the European Commission’s standard contractual clauses and the UK’s equivalent terms. You can ask us for a copy of the safeguards that apply.
6. Your privacy rights
We honor the requests below from anyone, wherever they live. Depending on where you live, the law may also guarantee them to you.
| Where you live | Your rights |
|---|---|
| European Economic Area, United Kingdom and Switzerland (GDPR and UK GDPR) | See a copy of your information. Correct it. Delete it. Limit or object to how we use it. Receive it in a portable format. Withdraw consent at any time. Complain to your local data protection authority. |
| California (CCPA, as amended by the CPRA) | Know what we collect, use and disclose. Get a copy. Correct it. Delete it. Opt out of the sale or sharing of personal information (we do not sell it; to opt out of the advertising tag on our website, choose “Necessary only” or “Reject all” in “Cookie settings”). Limit the use of sensitive personal information (we do not use it for extra purposes). Not be treated differently for using your rights. |
| Other US states with privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) | Confirm whether we hold your information. Get a copy. Correct it. Delete it. Opt out of sale, targeted advertising and profiling (we do not sell or profile; to opt out of the advertising tag on our website, use “Cookie settings”). Appeal if we decline your request. |
| Canada (PIPEDA and provincial laws) | See your information. Correct it. Withdraw consent. Complain to the Office of the Privacy Commissioner of Canada or your provincial regulator. |
| Everywhere else | We apply the same approach: you can ask to see, correct or delete your information, and we will respond. |
How to make a request
Email contact@eventdata.pro and tell us what you would like. We may ask for a little information to confirm who you are, so that we do not give your information to someone else. You can also ask someone you trust to make the request for you, with your written permission.
We respond within 30 days. If a request is complex and we need more time, we will tell you why. Making a request is free, and we will never treat you differently for making one.
If we decline your request, we will explain why, and you can appeal by replying to our decision. If you are not satisfied with the result of an appeal, you can contact your state attorney general or your local data protection authority.
If your information is in a client’s system, please see the note at the end of section 3.
7. Children
Our services and website are meant for businesses and the professionals who work for them. They are not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.
8. Changes to this policy
We may update this policy from time to time. When we do, we will change the effective date at the top and post the new version on our website. If a change is significant, we will tell our clients directly before it takes effect. The promises in “The short version” are central to how we work. We will not weaken them quietly.
9. How to contact us
If you have a question about this policy or about your information, we are glad to help.
| Company | Summit Stone Innovations LLC, doing business as Event Data Pro |
|---|---|
| contact@eventdata.pro | |
| Phone | +1 (516) 418-3079 |
| United States | 224 W 35th St Ste 500, New York, NY 10001, USA |
| Canada | 17 Peter St #202, Toronto, ON M5V 1X1, Canada |