Privacy Notice of EveLin
1. Who is responsible?
EveLin GbR, Lukasstraße 12A, 50823 Cologne, Germany, email: info@evelin-ai.com, is responsible for the processing described in this Privacy Notice where EveLin acts in its own capacity. EveLin is a digital networking system for events. Guests can voluntarily create a short profile via an event link or QR code and receive suggested conversation contacts.
For privacy questions or to exercise your rights, contact info@evelin-ai.com. We are currently not required to appoint a data protection officer.
2. Two different roles for event data
The respective organizer decides whether and for which event it uses EveLin, whom it invites, and which information is required in the event context. For the event-specific processing, the organizer named in the event notice is generally the controller. EveLin processes those data on the organizer’s documented instructions as a processor under Article 28 GDPR.
Separately, EveLin processes the pseudonymous profile and usage data described in section 6 in its own capacity in order to improve the matching product in the long term. The event-specific processing and EveLin’s own processing are kept separate.
3. Visiting our website and apps
When you visit our website, organizer app or participant app, our hosting provider processes technically necessary connection data. This includes, in particular, IP address, date and time of access, requested address, browser and device information, operating system, referrer information, and technical error and security information.
This processing is necessary to provide our services securely and technically reliably, to defend against attacks and to analyse errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and abuse-free operation of our services. Server and security logs are generally deleted or anonymised within 30 days, unless longer storage is required to investigate a security incident.
For delivery of the Flutter web application, the technical CanvasKit runtime is loaded through Google’s global gstatic CDN. Google thereby receives technically necessary connection data, including IP address, timestamp, browser and header information. We currently do not use analytics or marketing cookies for this purpose. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the reliable display of the web app. Because this is a global CDN, processing outside the EEA cannot be ruled out. Further information is available in Google’s Privacy Policy: https://policies.google.com/privacy.
4. Organizer account, contract and support
If you create or use an organizer account for a company or association, we process, in particular, your name, business contact details, company, billing and contract data, hashed access credentials, permission role, account and security events, event configurations and communications with us.
We process these data to provide the account, perform the contract, secure access, provide support, prevent misuse, handle legal claims and fulfil legal obligations. The legal bases are Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) GDPR for statutory retention and evidence obligations, and Article 6(1)(f) GDPR for IT security, fraud and abuse prevention, and the establishment, exercise or defence of legal claims.
Organizer account data are deleted or anonymised after the end of the contract once no longer required for these purposes. Contract, billing and booking records are retained for the applicable statutory periods. Security and support data are generally deleted or anonymised within 90 days after the case is closed, unless they are required to investigate a security incident or to establish, exercise or defend legal claims.
5. Event profiles and matching on behalf of the organizer
When you create an event profile, we process, depending on the event configuration, your name, an optional profile photo, an optional recognition hint, your company, categories and your Need and Offer entries. An email address is not required from event guests and is not requested in the guest profile.
EveLin uses these data to create matching recommendations, match reasons and conversation prompts for the event and to show the matches to the relevant participants. These are networking suggestions; EveLin does not make an automated decision that produces legal effects concerning you or similarly significantly affects you.
For this event-specific purpose, EveLin processes data on the organizer’s documented instructions. The organizer’s event privacy notice explains its legal basis and further processing. For questions about a specific event, please contact the organizer named there first.
A photo is voluntary. We ask for separate consent before photo upload. You may use the profile and matching function without a photo. You may withdraw your consent at any time for the future by deleting the photo or contacting info@evelin-ai.com.
Name, photo, company, recognition hint and other general free-text fields, except Need and Offer, are deleted no later than 24 hours after the end of the event. If deletion is requested earlier, they are deleted without undue delay within the legal requirements. The organizer may instruct an earlier deletion.
6. Long-term product improvement and objection
After the event, EveLin also processes the following data to improve the quality, fairness, safety and usefulness of the matching function: a technical profile or guest ID, Need, Offer, categories, match-reason score and feedback. EveLin does not retain names, photos, companies, recognition hints or other general free-text fields, except Need and Offer, for this purpose.
EveLin processes these data in its own capacity on the basis of Article 6(1)(f) GDPR. Our legitimate interest is to measure and improve the quality and safety of an AI-supported networking product, understand recurring patterns, detect errors and improve matching recommendations. For this purpose, data are processed as sparingly as possible and by using a technical ID instead of directly identifying details.
You may object to this processing at any time with effect for the future, either in the profile flow or by emailing info@evelin-ai.com. Following a valid objection, EveLin deletes the complete related profile record, including Need, Offer, categories, match-reason score and feedback, unless a legal obligation requires retention. You can participate in the event and use matching without consenting to this long-term product improvement.
7. AI providers and recipients
EveLin may use an AI API provider for the matching product. Production use of OpenAI with personal data will only be enabled once the technical and contractual requirements defined in the privacy sprint have been fulfilled and documented, including correct contractual attribution to EveLin GbR, appropriate data controls and a configuration without stored responses.
Once this service is used in production, only the necessary and, where possible, pseudonymous content data are sent for matching purposes, including technical profile ID, Need, Offer, categories and matching context. Profile photos, names, recognition hints and event-guest email addresses are not sent. Such use may involve processing outside the EEA. We will use it only with a transfer basis permitted under Articles 44 et seq. GDPR and documented technical safeguards.
Other recipients and processors may include Hetzner Online GmbH for hosting, database, private object storage and backups in Germany; doppelt.digital GmbH for managed infrastructure, deployment and technical operation in Germany; Railsware Products Studio LLC (Mailtrap) for transactional emails and email logs; and Google Cloud EMEA Limited for internal business communication and collaboration where support or contract communication is handled through Google Workspace. We select providers carefully and enter into Article 28 GDPR agreements where required. An up-to-date list of subprocessors forms part of the DPA annexes for organizers.
8. International transfers
Where we transfer data to countries outside the EEA or access may occur there, this takes place only where the conditions of Articles 44 et seq. GDPR are met. Depending on the recipient, we rely in particular on an adequacy decision, the EU-US Data Privacy Framework or EU Standard Contractual Clauses together with supplementary measures.
9. Your rights
Subject to the legal conditions, you have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Article 6(1)(e) or (f) GDPR. You may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with a supervisory authority. The authority generally competent for EveLin is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.
For rights concerning a specific event, the organizer is normally the first responsible contact. For EveLin’s own processing, or if you are unsure whom to contact, write to info@evelin-ai.com. We do not routinely require a copy of an identity document; we ask for additional information only where strictly necessary to prevent unauthorised disclosure.
10. Whether data must be provided
Data required for an organizer account are necessary to create and use that account. Event-profile information is generally voluntary; without information required for a particular profile, individual matching functions may not be available.
11. No automated decision under Article 22 GDPR
The matching function produces automated recommendations based on the content you provide. It supports conversations and networking and does not make a decision that produces legal effects or similarly significantly affects you. Under the Terms, organizers must not use these recommendations as the sole basis for such decisions.
12. Changes to this Privacy Notice
We update this Privacy Notice if our processing, service providers or the law changes. The current version is available in our services. The version date above applies.
Version: 22 August 2026