This Privacy Policy explains how Treffio ApS, CVR 42 02 16 79, Niels Ebbesens Vej 16, 1911 Frederiksberg C, Denmark (“Treffio”, “we”, “us” or “our”) processes Personal Data in connection with the Treffio platform — the website at treffio.com, the admin dashboard at admin.treffio.com, public event registration sites hosted on *.treffio.com, the mobile application at app.treffio.com and on iOS / Android, and any related services (together, the “Service”).
It applies to:
For some processing we are the controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (“GDPR”); for other processing we act as a processor for our Customers (Article 4(8) GDPR).
| Processing | Controller | Processor |
|---|---|---|
| Marketing website analytics, contact-form submissions, demo requests | Treffio | — |
| Administrator account data (admin user identity, settings, billing) | Treffio | — |
| Guest data uploaded or generated by Customers in connection with their events | The Customer | Treffio |
| Operational metadata of the Service (logs, error reports, security events) | Treffio | — |
Where we act as processor, our processing is governed by the Data Processing Agreement and the Customer is the controller. Guests should consult the privacy notice of the Customer running the event for information about that processing.
We want to be specific about practices we have deliberately chosen not to engage in, because they are widespread in our industry but, in our view, unnecessary for our Service:
If we ever change any of these practices, we will update this Privacy Policy first and provide notice in line with Section 14.
When you visit treffio.com, we collect:
The website itself does not set cookies. Fonts are currently loaded from fonts.googleapis.com and fonts.gstatic.com (Google), which transmits your IP address to Google in the United States. We are working on self-hosting fonts to remove this dependency.
When you sign in as an Administrator, we collect:
localStorage (not in cookies); see the Cookie Policy.Legal bases: contract performance (Article 6(1)(b) GDPR) for account creation, authentication, and provision of the Service; legitimate interests (Article 6(1)(f) GDPR) for security, abuse prevention, and product improvement; legal obligation (Article 6(1)(c) GDPR) for billing and bookkeeping records.
When a Customer uses the admin dashboard to manage an event, that Customer is the controller of all guest-related Personal Data, and Treffio processes it solely on the Customer’s instructions under the Data Processing Agreement.
Categories typically include:
Guests should consult the privacy notice of the Customer running their event for the purposes, lawful bases, and specific retention applicable to that processing.
The admin dashboard offers an optional AI-powered text-translation feature backed by OpenAI. The feature is off by default and only sends data to OpenAI when an Administrator explicitly invokes it (for example, to translate an event title or description into another language).
When the feature is used:
If the feature is not used, no data is shared with OpenAI. Administrators should not paste identifiable guest data into translation prompts; the feature is intended for static event content.
The Treffio mobile applications (iOS, Android, and app.treffio.com) deliberately use a minimal SDK stack:
A complete description is in the Cookie Policy. In short:
localStorage rather than in cookies.__stripe_mid, __stripe_sid) to detect fraud during a payment session. These cookies are required to use the payment functionality and are not used for advertising.We share Personal Data with the following categories of recipients, only as necessary:
We rely on a small set of trusted subprocessors to operate the Service. The current list is published in the Subprocessor List, with each entry’s name, purpose, location, and applicable transfer mechanism. Subprocessors are bound by data-protection terms no less protective than those that apply to us, and we remain responsible for their performance.
Where Treffio is a processor, the relevant data is accessible to the Customer (via the admin dashboard) and is shared at the Customer’s instruction.
We may disclose Personal Data where required by law, court order, or a valid request from a competent authority, or where we believe disclosure is necessary to:
We push back on overbroad or unlawful requests where we have a reasonable basis to do so. Where lawful, we notify the affected Controller before disclosing data they have entrusted to us.
If Treffio is involved in a merger, acquisition, financing, reorganization, or sale of assets, Personal Data may be transferred as part of that transaction, subject to standard confidentiality and data-protection commitments.
Most of our processing takes place inside the European Economic Area (EEA). For transparency, the following subprocessors process some or all data outside the EEA — primarily in the United States:
fonts.googleapis.com, fonts.gstatic.com) — United States. We are migrating to self-hosted fonts to remove this transfer.treffio.com) — global CDN. We are migrating to bundle this library locally.All other subprocessors listed in the Subprocessor List process data within the EEA.
For every transfer outside the EEA to a country that is not subject to a European Commission adequacy decision, we rely on:
Specific retention periods per category are set out in Sections 3 to 6 above. As a general rule:
If a longer retention is required by law (for example, for the establishment, exercise, or defense of legal claims), we will retain the relevant data only for that purpose and only for as long as needed.
Subject to applicable law and reasonable verification of identity, you have the following rights regarding your Personal Data:
To exercise any of these rights, contact us at [email protected].
If you are a Guest of an event managed by a Customer of Treffio, please direct your request to the Customer in the first instance, since they are the controller of that data. We will assist them in fulfilling your request.
We send marketing communications about Treffio (for example product updates, event newsletters, invitations to webinars) only to people who have given prior consent or who have an existing customer relationship with us under applicable opt-in rules. Every marketing email contains a clear unsubscribe link. Unsubscribing from marketing does not affect operational and transactional communications.
If you are a Guest, the operational communications you receive about your event (invitations, confirmations, reminders, ticketing, post-event materials) are sent on behalf of, and at the instruction of, the Customer who is running the event. Opt-out and unsubscribe requests for those communications are handled within the Service and apply to that event.
After an event has ended, you may continue to receive strictly transactional service messages related to that event for a reasonable period — for example, evaluation surveys, certificates, photos, materials from speakers, or operational follow-ups requested by the event organizer. These are not marketing and do not require separate marketing consent. Each such message contains a clear way to opt out of further post-event communications.
We implement and maintain technical and organizational measures appropriate to the risk of the processing, including encryption in transit (TLS 1.2 or higher) and at rest, role-based access control with least-privilege defaults, multi-factor authentication for personnel with production access, periodic backups, monitoring and alerting, and a documented incident-response process. A summary is provided in Annex II of the Data Processing Agreement.
In the event of a Personal Data Breach affecting your data, we will:
The Service is not directed to children under 16. We do not knowingly collect Personal Data from children under 16 without parental consent. If you believe we have collected such data, please contact us at [email protected] and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be notified through the admin dashboard, by email to Customers, and (where appropriate) by a banner on treffio.com. The version and effective date are shown at the top of this document. Continued use of the Service after the effective date constitutes acceptance of the updated Privacy Policy.
For privacy-related questions, requests, or complaints:
Treffio ApS — Data Protection Niels Ebbesens Vej 16 1911 Frederiksberg C Denmark Email: [email protected] CVR: 42 02 16 79
You also have the right to lodge a complaint with the Danish Data Protection Agency:
Datatilsynet Carl Jacobsens Vej 35 2500 Valby Denmark www.datatilsynet.dk