Privacy policy

1. Controller

The controller of personal data in connection with the use of the Standbook service (standbook.app) is Progrise Szymon Konieczny, VAT ID PL6342611135, ul. Marcina Radockiego 156/1, 40-645 Katowice, Poland, REGON 243479052. Contact for data protection matters: support@standbook.app. The controller has not appointed a data protection officer; all matters can be raised directly at the address above.

2. Who and what this policy covers

• Account users (venue owners, administrators and assistants) and people who contact us – Progrise is the controller of their data.
• Exhibitors and applicants on venue sites (markets, halls, fairs) – the controller of their data is the venue organiser; Progrise processes it on the organiser’s behalf as a processor under the Data Processing Agreement (Annex 1 to the Terms). Requests concerning this data should be addressed to the organiser, whose contact details are in the footer of the venue site; we assist organisers in responding to data subject requests.
• Visitors of standbook.app and of the demo instance.

3. What data we process, why and on what basis

• User account: e-mail address, name, language, terms acceptance timestamp, password hash (if a password was set), session identifiers (stored as hashes), last activity date, browser name. Purpose: concluding and performing the agreement, login, account security. Basis: Article 6(1)(b) GDPR (contract) and (f) (legitimate interest – security).
• Venue and billing data: organiser name and contact details, invoicing data (name, address, VAT ID), payment and invoice history. Card payments are processed by Stripe – we do not receive or store full card numbers. Purpose: settlement of the service and tax/accounting obligations. Basis: Article 6(1)(b) and (c) GDPR.
• Audit log and server logs: who performed which operation in the panel and when, IP address (in server logs and as a shortened identifier attached to requests), login events, rate limits. Purpose: accountability, abuse detection, security. Basis: Article 6(1)(f) GDPR.
• Correspondence and support: e-mail content and sender details. Purpose: handling requests and complaints. Basis: Article 6(1)(b) and (f) GDPR.
• Product information: we may send customers messages about material changes to the service and new features (Article 6(1)(f) GDPR); you can object at any time by replying to the message. We do not send third-party advertising.
• Messages to market and fair organisers: we keep the organiser's name, the general e-mail address published on its website (and, where the website names a specific person as the contact for exhibitors, that person's name and address) and the correspondence exchanged in our CRM, in order to ask for consent to send information about Standbook or, where the law allows it, to present an offer. Replies in other languages may be summarised automatically in Polish using a model by Anthropic, so that we can answer them faster. Basis: Article 6(1)(f) GDPR (legitimate interest, i.e. direct marketing to businesses and institutions). You can object at any time by replying "stop"; we keep the address of a person who objected only to make sure we do not write to them again.
• Contact with organisers who asked for information: if an organiser replied with consent to our request to send information about Standbook, the links in the message we send them contain an identifier of that message. When clicked, we record that the recipient of that message opened the demo or the pricing page (no cookies, no IP address). Purpose: gauging interest and avoiding unnecessary follow-ups. Basis: Article 6(1)(f) GDPR (legitimate interest); you can object at any time by replying "stop". Identifiers are deleted after 90 days; click counts without identifiers remain.
• Demo instance (demo.standbook.app): data entered in the demo is publicly visible and deleted daily; please do not enter real personal data there.

Providing account and billing data is voluntary but necessary to use the service. We do not make decisions based solely on automated processing and do not profile users.

4. Exhibitor data processed on behalf of organisers

On behalf of organisers we store request data: company name, contact person, e-mail, phone, assortment, request content, language, date of acceptance of the organiser’s terms and a shortened IP address identifier, as well as stall line-ups, attendance and payment status. This data is used solely to handle bookings and the organiser’s communication with the exhibitor (confirmations, decisions, reminders). The organiser decides how long it is kept; deleting an exhibitor in the panel anonymises their data while keeping the attendance history without identifying details.

5. Recipients of data (sub-processors)

We use providers that process data on our behalf under data processing agreements:

• Railway Corp. (USA) – application and database hosting; data stored in the European Union region (Amsterdam, Netherlands).
• Cloudflare, Inc. (USA) – domain registry, DNS and network traffic protection.
• Stripe Payments Europe Ltd. (Ireland) – payment and invoice processing; Stripe is an independent controller of payment data to the extent described in its privacy policy.
• FXL Sp. z o.o. (Bielsko-Biała, Poland) – provider of the FakturaXL invoicing software: issuing invoices for Plans and Editions from the details given at payment (name, address, VAT or tax ID, e-mail).
• Resend, Inc. (USA) – sending transactional messages from no-reply@standbook.app: login links, confirmations, invoices and messages to exhibitors sent by organisers who have not connected their own mail server.
• Google Ireland Limited (Ireland) – e-mail in Google Workspace: correspondence with customers, support and messages to organisers as part of our sales.
• Anthropic, PBC (USA) – recognising a hall plan from an uploaded photo, PDF or spreadsheet (the file may contain exhibitor names entered by the organiser) and summarising organisers' replies to our messages; under the provider's commercial terms, the data sent is not used to train models.

Data may also be disclosed to public authorities where required by law and to advisers (accounting, legal) to the extent necessary. We do not sell personal data and do not share it for third-party marketing.

6. Transfers outside the European Economic Area

Data is stored on servers in the European Union. Some providers are established in the USA; transfers take place on the basis of the European Commission’s adequacy decision for entities certified under the EU-U.S. Data Privacy Framework or standard contractual clauses approved by the European Commission, with additional safeguards (encryption, access restriction). A copy of the safeguards can be obtained by writing to support@standbook.app.

7. Retention

• Account and venue data – for the term of the agreement (including on the free plan), then 30 days for data export, after which it is deleted or anonymised.
• Accounting documents and invoicing data – 5 years from the end of the tax year in which the document was issued (legal obligation).
• Server logs and security events – up to 12 months.
• Venue audit log – for the term of the agreement.
• Correspondence – up to 3 years after the matter is closed (limitation of claims).
• Contact details of organisers from our sales campaign – until they object or the campaign ends; addresses of people who objected are kept only on a suppression list.
• Demo instance data – up to 24 hours.

8. Data subject rights

Everyone has the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal). Requests can be sent to support@standbook.app; we respond without undue delay and no later than within one month. Requests concerning exhibitor data are forwarded to the venue organiser or handled on its instructions.

You also have the right to lodge a complaint with a supervisory authority: in Poland this is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl); persons in other EEA countries may contact their national supervisory authority.

9. Data security

We apply technical and organisational measures appropriate to the risk, in line with Article 32 GDPR and – to the extent appropriate to the scale of the service – with the cybersecurity risk-management requirements described in Article 21 of the NIS 2 Directive (Progrise is not an essential or important entity within the meaning of that Directive but applies these principles to support customers who are subject to such requirements):

• Encryption: all traffic is encrypted (TLS, HTTPS enforced with HSTS); database connections are encrypted; backups are stored encrypted by the hosting provider.
• Authentication and access: login via one-time e-mail links or a password stored only as a hash (scrypt); session tokens stored in the database as SHA-256 hashes; roles with least privilege; immediate session invalidation when access is removed; request rate limits.
• Data separation: each venue’s data is logically separated and every database query is automatically restricted to the current venue.
• Accountability: a panel audit log (who, what, when) and security event logs.
• Business continuity: daily backups with 30-day retention, a recovery procedure, infrastructure in an EU data centre with the provider’s independent security certifications.
• Supply-chain security: sub-processors selected with regard to their certifications and data processing agreements; software dependencies kept up to date; security patches deployed without delay.
• Incident handling: risk analysis, an incident response procedure; personal data breaches are reported to the supervisory authority within 72 hours and to organisers whose data has been entrusted to us without undue delay, no later than 48 hours after becoming aware of the breach; data subjects are informed where required by law.
• Minimisation: we collect only necessary data; deleting an exhibitor anonymises their data.

10. Cookies and browser storage

Strictly necessary files (no consent required): the user session cookie (stalls_auth), the venue panel session cookie (stalls_session), the language cookie (locale, 12 months) and the cookie that remembers your cookie decision (sb_consent, 12 months). A venue site stores the identifiers of submitted applications and the contact details typed into the form in the browser (localStorage) to make the next application easier; this data stays on the user's device only.

Analytics and marketing files (only with consent): on standbook.app and in the demo instance we use Google Analytics 4 (loaded directly or through Google Tag Manager) (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). These tools start only after consent is given in the banner (Art. 6(1)(a) GDPR and the ePrivacy rules); before that they are not loaded and set no files. Google Analytics sets, among others, the _ga (2 years) and _ga_* (2 years) cookies used to distinguish visitors and sessions; IP addresses are not stored. Consent can be withdrawn or changed at any time in “Cookie settings” in the page footer; withdrawal does not affect the lawfulness of processing before it. We do not embed analytics or marketing tools on customers' venue sites (other than the demo).

11. Changes to this policy

We update the policy when the scope of the service, the law or the list of sub-processors changes. The current version is always available at standbook.app/legal/privacy with the date of the last change; account users are informed of material changes by e-mail.