Privacy notice
How Kyuro handles personal data on the Evemos website and in the platform: what we collect, why, how long we keep it, and how to use your rights.
Last updated 21 October 2026
1. Who we are
Evemos is a product built and run by Kyuro. In this notice, "we" and "us" mean Kyuro, the business below.
- Business
- Kyuro, obrt za promidžbu i ostale usluge, vl. Daniel Vazdar
- Trading as
- Kyuro
- Owner
- Daniel Vazdar
- Registered address
- Zadarska 2431000 OsijekCroatia
- OIB
- 65753088499
- Register
- Croatian craft register (Obrtni registar), MBO 99323605
- Privacy questions
- [email protected]
- Other questions
- [email protected]
We have not appointed a data protection officer, as the law does not require one for the processing we do (GDPR Art. 37). Write to [email protected] about anything in this notice.
2. What this notice covers
This notice covers the Evemos website, requests for a demo, email you send us, and the accounts people use to sign in to Evemos.
Organisers also run event pages on Evemos. For the data you give on those pages, see section 4.
3. What we collect, why, and for how long
For each kind of personal data we hold, the table shows the law that lets us hold it and when we delete it.
| What | Data | Why we may (lawful basis) | How long |
|---|---|---|---|
| Demo requests | Your name, work email, company, show name, show size, when your show is, your message if you write one, the date you sent the request and the version of this notice you saw. | To take the steps you asked for before a possible contract: arranging and giving the demo (GDPR Art. 6(1)(b)). | Reviewed 24 months after the request, then deleted unless we are still talking or a contract followed. |
| Emails about your demo request | Your name, your email address and the details of your request. Our email service (Resend) sends you an acknowledgement and tells our own inbox about the request. | The same as your request (Art. 6(1)(b)). | As for the demo request. |
| Email you send us | Your email address, your name and what you write. | Our legitimate interest in answering you (Art. 6(1)(f)). | 24 months after the conversation ends. |
| Do-not-contact list | Your email address and the reason. If you ask us never to contact you again, we keep the address on this list so that we keep to it. | Our legitimate interest, and our duty to respect your objection (Art. 6(1)(f) and Art. 21). | For as long as the list exists. Deleting your address from it would let it be contacted again. |
| Sign-in accounts | Name, email address, a hashed password and your sign-in session. | Needed to provide the account (Art. 6(1)(b)). | While the account exists. |
| Security | Your IP address and request details, such as the page and the time, seen by our network provider and our server. We use them for rate limits and to stop automated form spam. | Our legitimate interest in keeping the service safe (Art. 6(1)(f)). | 14 days |
| Contracts and invoices, for organisers who subscribe | The organiser's contact and billing details, the order form and the invoices. | To perform the contract (Art. 6(1)(b)) and to meet our duties under Croatian accounting and tax law (Art. 6(1)(c)). | As long as Croatian accounting and tax law requires. |
We do not ask for special categories of data, such as health or religious beliefs. Please do not put any in the message field.
4. Event pages run on Evemos
When you register for an event, send an enquiry or apply for accreditation on an organiser's event page, the organiser decides what is collected and why. The organiser is the controller of that data, and its own privacy policy is linked on every form.
We are the organiser's processor. We store and process that data only on the organiser's instructions and do not use it for our own purposes. The data processing terms in our terms for organisers set this out (GDPR Art. 28).
To see, correct or delete that data, write to the organiser first. If you write to us, we pass your request to the organiser.
Event pages remember your cookie choice in your browser (section 7).
5. Who receives your data
We do not sell or rent personal data. These companies process it on our behalf, to run the website and the platform:
| Provider | What they do for us | Data | Where | Safeguard for transfers |
|---|---|---|---|---|
| Hostinger (HOSTINGER operations, UAB) | Runs the server that hosts the website, the platform and its database. | Everything in sections 3 and 4. | EU | None needed: the data stays in the EU. |
| Cloudflare, Inc. | DNS, network and attack protection, the Turnstile check on our forms, and forwarding the email you send to our addresses. | IP address and request details. For forwarded email, the message and its addresses. | United States company, global network | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Resend, Inc. | Sends the emails the website and the platform send. | Name, email address and what the email says. | United States | Standard Contractual Clauses |
| Google Cloud EMEA Limited (Google Workspace) | Holds the inbox where we read the email you send us, after Cloudflare forwards it. | Your email address, your name and your message. | Ireland-based company, global data centres | EU-US Data Privacy Framework and Standard Contractual Clauses |
Mail to our addresses on the Evemos domain is received by Cloudflare Email Routing and forwarded to Kyuro's own inbox.
We may have to disclose data to a court, the tax authority or the police when Croatian or EU law requires it.
Not used: we run no analytics on this website, no advertising pixels and no third-party trackers.
6. Transfers outside the EU
Cloudflare and Resend are companies in the United States, so data they process may leave the EU.
Cloudflare is certified under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection. Its data processing terms also include the Standard Contractual Clauses.
Resend's data processing terms include the Standard Contractual Clauses approved by the European Commission.
Write to [email protected] for a copy of the safeguards.
8. Your rights
- Access: you can ask for a copy of the data we hold about you (Art. 15).
- Correction: you can ask us to correct data that is wrong (Art. 16).
- Erasure: you can ask us to delete your data (Art. 17).
- Restriction: you can ask us to stop using your data while a question about it is settled (Art. 18).
- Portability: you can ask for the data you gave us in a common, machine-readable format (Art. 20).
- Objection: you can object to processing based on our legitimate interest. An objection to direct marketing always stands (Art. 21).
- Withdrawing consent: where we rely on your consent, you can withdraw it at any time (Art. 7(3)). Today we rely on consent for nothing.
- Automated decisions: you have the right not to be subject to a decision made only by automated means (Art. 22). We make none.
If you ask us to delete your data and never to contact you again, we keep only your email address, on the do-not-contact list (section 3).
9. How to use your rights
Email [email protected]. Say which right you want to use and the email address we hold for you. We may ask you to confirm that the address is yours.
We reply within 1 month. For a complex request we may take up to 2 more months, and if so we tell you why within the first month (Art. 12(3)).
Using your rights is free, unless a request is clearly unfounded or excessive (Art. 12(5)).
10. Complaints
You can complain to the Croatian data protection authority:
Agencija za zaštitu osobnih podataka (AZOP), the Croatian data protection authorityUlica Metela Ožegovića 1610000 ZagrebCroatiaWebsite: azop.hrEmail: [email protected]You can also complain in the EU country where you live or work, or where you think the problem happened (Art. 77).
11. How we protect data
- Every page is served over HTTPS.
- Passwords are stored only as hashes, never as the password itself.
- After 5 failed sign-in attempts, the account is locked for 10 minutes.
- Only Kyuro staff can read demo requests.
- Our public forms check for automated submissions and limit how often they can be sent.
- Our server and database are in the EU.
12. If something goes wrong
If a personal data breach happens, we report it to AZOP within 72 hours of finding out, where the law requires it (Art. 33). If it is likely to put your rights at high risk, we also tell you directly (Art. 34).
13. Children
This website and our demo form are not aimed at anyone under 16. If we learn that a child sent us their data, we delete it.
14. Changes to this notice
When we change this notice, we post the new version on this page with its date and list the change below. Every demo request records the version its sender saw.
| Date | What changed |
|---|---|
| 21 October 2026 | The product is now called Evemos, and our email addresses are on evemos.events. Nothing else changed. |
| 19 October 2026 | First version. |