1. Introduction
Welcome to Sway. This Privacy Policy explains how Sway ("we", "our", or "us") collects, uses, discloses, and protects your personal data when you use our mobile application, website, and related services (collectively, the "Platform"). By accessing or using Sway, you agree to the terms of this Privacy Policy. If you do not agree, please do not use our Platform.
Sway SRL is a company based in Belgium, under enterprise number BE1037531992, Clos des Colombes 23, 1342 Limelette, Belgium.
2. Definitions
| Term | Definition |
|---|---|
| Personal Data | Any information relating to an identified or identifiable natural person. |
| User | Any individual who accesses or uses the Platform, including event attendees, page holders, Artists, and Venues. |
| Page holder | Any natural or legal person using the Platform to organize an Event and sell Tickets, or to manage a page. |
| Client / Attendee | Any natural person purchasing a Ticket on the Platform for private, non-professional purposes. |
| Platform | The Sway mobile application, website, and any related services. |
| Account | The personalized digital environment provided by Sway to registered Users. |
| Legal Basis | The basis on which we process personal data under the GDPR (consent, contract performance, legal obligation, or legitimate interest). |
| Data Processor | A third-party company processing personal data on behalf of Sway. |
3. Data We Collect and How We Process It
3.1 Types of data we collect
We may collect and process the following categories of personal data:
- Account information: name, email address, date of birth, username, profile picture, biography, contact details provided during registration.
- Event data: events browsed, attended, or organized; ticket purchase history; event preferences; interest and attendance status.
- Payment data: payment method details (processed by Stripe), billing information, transaction history. We never store card numbers.
- Usage data: IP address, device information, browser type, session data, browsing behavior on the Platform, collected via cookies and similar technologies.
- Location data (GPS / shared location): approximate device location collected only when you explicitly grant permission via your device settings (iOS or Android), to enable the interactive map and proximity search. If you turn on location sharing, an approximate location point (and its source) is stored server-side so that nearby and social features can show your approximate area to other Users. You can disable location sharing at any time via the in-app toggle ("ghost mode"), which stops sharing and removes the stored point. See section 3.3.
- Location data (IP): we derive your approximate country and city from your IP address via ipinfo.io, in order to display nearby events and venues and personalize the interface. This data is stored server-side for a rolling period of 30 days, then automatically deleted. See section 3.3 for the legal basis.
- Chat data: content of private, group, and community messages; sender and recipient identity; timestamps.
- Content uploaded: images, visuals, and other media uploaded by Users to their profile or pages, which are screened for inappropriate content via SightEngine.
- AI feature data (page holders only): when a page holder uses the AI-powered page analytics feature, selected page data is transmitted to the Google Gemini API for processing. See section 3.5 for details.
- Social-boundary relationships: when a User blocks, restricts, hides, or mutes another User, we store that relationship to enforce the chosen boundary.
- Privacy and visibility settings: your account privacy mode (public or private), the audience chosen for each profile section (profile, statistics, attended and upcoming events, followed artists/venues/promoters/genres, followers list, XP league), your who-can-message preference, follow requests and message requests, and your leaderboard / attendee-list opt-outs.
- Gamification data: experience points (XP) derived from your activity, your level and league, streaks and check-ins, used to operate leaderboards and engagement features.
- Personalization data: in-app activity (events browsed, pages followed, attendance) used to tailor event, artist, and venue recommendations.
- Support data: any information you provide when contacting our support team.
3.2 Purposes and legal bases for processing
| # | Processing | Purpose | Legal Basis |
|---|---|---|---|
| 1 | Account creation and management | Create and maintain your Account | Performance of the contract (art. 6(1)(b)) |
| 2 | User authentication | Identify Users when they log in | Performance of the contract (art. 6(1)(b)) |
| 3 | Ticketing and payment processing | Process ticket purchases, issue tickets, manage orders | Performance of the contract (art. 6(1)(b)) |
| 4 | Sharing attendee data with page holders | Enable access control, event management, and, with your consent, page holder marketing | Contract performance + joint controllership (art. 26 GDPR) |
| 5 | IP-based location personalization | Derive approximate country and city from IP to display nearby events and personalize the interface | Legitimate interest (art. 6(1)(f)) |
| 6 | GPS-based location | Enable interactive map and proximity search | Consent (art. 6(1)(a)) |
| 7 | Product analytics (PostHog) | Analyze Platform usage to improve features and user experience | Consent (art. 6(1)(a)) |
| 8 | Error monitoring (Sentry) | Detect and resolve technical bugs | Legitimate interest (art. 6(1)(f)) |
| 9 | Content moderation (SightEngine) | Automatically detect illegal or inappropriate images upon upload | Legal obligation / Legitimate interest (art. 6(1)(f)) |
| 10 | Chat and messaging | Enable private, group, and community messaging between Users | Performance of the contract (art. 6(1)(b)) |
| 11 | AI page analytics (Google Gemini) | Enable page holders to query their page data through a conversational AI interface | Contract performance (art. 6(1)(b)) for the page holder using it, and legitimate interest (art. 6(1)(f)) in providing the feature |
| 12 | Sway marketing communications | Send updates, newsletters, and promotional content about the Platform | Consent (art. 6(1)(a)) |
| 13 | Accounting and tax compliance | Fulfill accounting and tax obligations; archive transaction records | Legal obligation (art. 6(1)(c)) |
| 14 | Fraud prevention | Detect and prevent fraudulent use of the Platform | Legitimate interest (art. 6(1)(f)) |
| 15 | Social boundaries (block, restrict, hide, mute) | Enforce the social boundaries a User chooses against another User | Legitimate interest (art. 6(1)(f)) |
| 16 | Platform security | Protect the Platform against unauthorized access and attacks | Legitimate interest (art. 6(1)(f)) |
| 17 | Legal defense | Organize Sway's defense in case of litigation or pre-litigation | Legitimate interest (art. 6(1)(f)) |
| 18 | Personalized recommendations | Tailor event, artist, and venue recommendations to your in-app activity | Consent (art. 6(1)(a)) |
| 19 | Gamification and engagement | Award XP and operate leagues, leaderboards, streaks, and check-ins | Legitimate interest (art. 6(1)(f)) |
| 20 | Privacy and visibility controls | Apply your account privacy mode, per-section visibility, messaging, and leaderboard preferences | Performance of the contract (art. 6(1)(b)) + consent where applicable |
3.3 Location data — details
GPS / shared location (consent-based):
When you use the map or proximity search features, Sway may request access to your GPS location via your device's permission system. This access is entirely optional and subject to your explicit authorization. You can withdraw this permission at any time in your device settings. Separately, if you turn on location sharing in the app, Sway stores an approximate location point (and its source) server-side so that nearby and social features can display your approximate area to other Users. You can disable location sharing at any time using the in-app toggle ("ghost mode"); disabling it stops further sharing and removes the stored point. Read access to these location fields is restricted server-side. Legal basis: consent (art. 6(1)(a)).
IP-based location (automatic):
We use your IP address to derive an approximate country and city via our service provider ipinfo.io. This allows us to display nearby events and venues and adapt the interface language and content. IP-based geolocation data is stored server-side for a rolling period of 30 days, then automatically deleted. It is never used for advertising purposes and is not shared with third parties beyond the processing necessary for this purpose. You may object to this processing at any time by contacting [email protected]. Legal basis: legitimate interest (art. 6(1)(f) GDPR) for service personalization and fraud prevention.
3.4 Chat and messaging — details
Sway offers messaging features between Users (private messages, group chats, and community discussions around pages and events). Data processed includes: message content, timestamps, and the identity of the sender and recipient(s). This data is hosted on our own infrastructure (Hetzner, Germany). Sway does not access the content of private messages except when required by law or in response to a validated report. Chat messages are retained for the lifetime of the conversation. When a user deletes a conversation, all related messages are permanently deleted within 30 days. You control who can message you (everyone, people you follow, or nobody); messages from senders you have not approved are quarantined as message requests until you accept them. See section 6 for retention periods.
3.5 AI-powered page analytics — details
Sway offers page holders a conversational analytics feature powered by the Google Gemini AI model (accessed via the Vercel AI SDK).
When it runs: only when a page holder actively opens the assistant and sends a message. Nothing is transmitted in the background, and it is never triggered by an attendee or a visitor.
What is transmitted: the question the page holder typed, plus the page data needed to answer it — sales and order statistics, audience and traffic figures, event performance, ticket and product configuration, email campaign statistics, and the shape of the booking pipeline (candidate names and their stage). Artist booking fees and agency names are deliberately excluded and are never sent.
What is not transmitted: attendee names, attendee email addresses, payment details and any other directly identifying information about individual buyers.
Legal basis: performance of the contract with the page holder (art. 6(1)(b)) for the page holder who chooses to use it, and our legitimate interest (art. 6(1)(f)) in offering analytics tooling. Because the assistant is only ever invoked by a deliberate action of the page holder, and the data concerns their own page, we do not rely on consent for this processing. A page holder who does not want it simply does not use it, and may ask us to disable it for their page at any time using the contact details in section 12.
Retention by Google: Google processes the data solely to generate the response, does not use it to train its models under the API terms, and does not retain it beyond the processing of the request.
Transfers to Google and Vercel servers located outside the EEA are governed by standard contractual clauses (see section 7).
3.6 Content moderation — details
When a User uploads an image (profile picture, event visual, page content), it is automatically submitted to SightEngine, a content moderation service, which returns a content safety score. SightEngine does not retain the image after analysis. This processing is necessary to comply with our obligations under the Digital Services Act and to protect Users from illegal or inappropriate content. Transfers to SightEngine servers located in the United States are governed by standard contractual clauses (see section 7).
3.7 Sharing attendee data with page holders — joint controllership
When you purchase a ticket, Sway shares the following information with the page holder of the event: your email address, order status, and, if you have given your consent, your marketing opt-in for that page holder's communications.
Sway and the page holder act as joint controllers within the meaning of article 26 GDPR for these processing operations. The page holder undertakes contractually to use this data solely for event management and, where applicable, marketing communications, and not to transfer it to any third party.
Stripe acts as a data processor for both Sway and the page holder for payment data. Sway does not store any payment card data.
3.8 Tracking pixels configured by organizers — joint controllership
Pages hosted on Sway may include third-party tracking pixels (Meta Pixel, Google Analytics 4, TikTok Pixel) configured by their respective page holders. These pixels send data to the page holder's own accounts on those platforms.
For the processing performed via these pixels on Sway, the page holder and Sway act as joint controllers within the meaning of article 26 GDPR. The respective responsibilities are as follows:
- Sway: provides the technical means for pixel integration, manages user consent via its cookie consent platform (CMP), ensures that pixels are not triggered without consent
- Page holder: configures the pixels with their own credentials, declares this processing in their own privacy policy, ensures the lawfulness of the data collected, responds to data subject requests concerning data sent to their accounts
The page holder is responsible for declaring these processing operations in their own privacy notice and for the lawfulness of the data collected via their pixels. User consent for page holder-configured pixels is managed through Sway's cookie consent platform. Users can refuse or withdraw their consent at any time via the cookie preferences interface.
3.9 Your privacy controls
Sway gives you granular control over your visibility and interactions:
- Private account: you can switch your account to private, so that following you requires your approval via follow requests.
- Per-section visibility: you can choose the audience (everyone / followers / nobody) for each section of your profile — profile details, statistics, attended and upcoming events, followed artists, venues, promoters and genres, your followers list, and your XP league.
- Messaging controls: you can choose who may message you (everyone / people you follow / nobody). Messages from senders you have not approved are placed in a separate message-requests area.
- Leaderboards and lists: you can opt out of appearing on public leaderboards and on event attendee lists.
- Social boundaries: you can block, restrict, hide, or mute other Users (see section 3.1).
3.10 Gamification — XP, leagues, and leaderboards
Your engagement on the Platform (such as attending events, check-ins, and streaks) generates experience points (XP), which determine your level and league and may appear on public leaderboards. This processing supports the Platform's engagement features. Legal basis: legitimate interest (art. 6(1)(f)). You can opt out of public leaderboards and hide your XP league at any time in your settings.
3.11 Personalized recommendations
When personalization is enabled, Sway uses your in-app activity (events you browse, pages you follow, events you attend) to tailor the event, artist, and venue recommendations shown to you. Personalization is enabled by default and recorded as a per-user preference. Legal basis: consent (art. 6(1)(a)).
3.12 Campaign attribution for ticket sales
When you open a Sway page, the address you arrived on may carry campaign labels added by
whoever shared the link (the utm_source, utm_medium, utm_campaign, utm_content andutm_term parameters), and your browser may report the website you came from. If you then
buy a ticket, we record those values alongside your order so that the page holder can see
which of their announcements, posts or advertisements actually led to ticket sales.
What is recorded: the campaign labels present in the address, the domain of the
referring website (for example instagram.com, never the full page you came from), and the
path of the page you landed on. These are attached to the order, not to your person: we do
not build a browsing profile from them, and they are not used to target advertising at you.
How it is held before purchase: these values are kept in your browser's memory for the
duration of your visit only. We do not write a cookie and do not use local storage
for this purpose. Closing the tab discards them.
Advertising click identifiers (such as fbclid from Meta, gclid from Google,ttclid from TikTok) are treated separately and more strictly, because they are minted by
an advertising network to single out one specific click. They are recorded only where
you have given consent for marketing purposes, and are never transmitted to an advertising
network without that consent.
Legal basis: legitimate interest (art. 6(1)(f)) for the campaign labels, the referring
domain and the landing path, our interest being to measure the effectiveness of the
promotion of an event you chose to attend. Consent (art. 6(1)(a)) for advertising click
identifiers and for any transmission to an advertising network.
Retention: attribution attached to a completed order is kept for the same period as the
order itself (see section 6). Attribution recorded for a checkout that was never completed
is deleted automatically after 30 days.
Your rights: you may object to this processing at any time (art. 21) using the contact
details in section 12. Objecting does not affect your ability to buy a ticket.
4. Data Sharing, Transfers, and Processors
We do not sell your personal data to third parties.
We share your personal data only with the following categories of recipients:
- Data Processors acting on our behalf (see section 5 for the full list)
- The page holder of an event you purchased a ticket for (see section 3.7)
- Legal authorities when required by law or necessary to protect our rights
- Acquirer or successor entity in the event of a merger, acquisition, or asset transfer, provided Users are informed in advance
5. Sub-processors and Third-party Service Providers
The following sub-processors may process personal data on behalf of Sway. All transfers outside the European Economic Area (EEA) are governed by standard contractual clauses (SCC) adopted by the European Commission.
| Provider | Role | Data Concerned | Location | EEA Transfer Safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication | All user data | EU (Frankfurt) | N/A |
| Hetzner | VPS hosting (website, self-hosted apps) | All hosted data | EU (Germany) | N/A |
| Cloudflare | CDN, reverse proxy, DDoS protection | IP addresses, HTTP requests | US / EU | SCC |
| Cloudflare R2 | File storage, media CDN | Uploaded images and assets | EU (per bucket) | N/A |
| Stripe | Subscription billing (Starter, Studio, Roster plans) | Billing data, payment method, invoicing | US / EU | SCC |
| Stripe Connect | Ticketing payment processing | Transaction data, page holder KYC | US / EU | SCC |
| RevenueCat | In-app purchase management (iOS/Android) | Purchase data, user identifier | US | SCC |
| PostHog | Product analytics | User behavior, events | EU or US (per config) | SCC if US |
| Sentry | Error monitoring | Technical logs, session traces | US | SCC |
| SightEngine | Image content moderation | User-uploaded images | US | SCC |
| ipinfo.io | IP geolocation | IP address, derived country and city | US | SCC |
| Google (Gemini API) | AI page analytics | Page data submitted by page holders | US / EU | SCC |
| Vercel | AI SDK (Gemini API proxy) | AI requests and submitted data | US | SCC |
| Notifuse | Email marketing platform (self-hosted) | Contact email, name, campaign engagement | EU (our own server) | N/A |
| Hyvor Relay | Outbound email delivery (self-hosted relay) | Recipient email, message content | EU (our own server) | N/A |
| Resend | Transactional and marketing email delivery | Recipient email, message content, delivery events | US / EU | SCC |
| Cloudflare Turnstile | Anti-bot verification on sign-up and forms | IP address, browser signals | US / EU | SCC |
| Google Firebase Cloud Messaging | Mobile push notifications | Device push token, notification content | US | SCC |
| Meta (Conversions API) | Advertising measurement, only where a page holder has configured a pixel and the visitor has consented to marketing | Hashed email, click and browser identifiers, IP address, user agent | US | SCC |
Page holders may additionally configure their own advertising pixels (Meta, Google Analytics 4, TikTok) on their pages. Where they do, that provider becomes a recipient of the data described in section 3.8, under the joint-controller arrangement set out there, and only with your marketing consent.
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Beyond the applicable period, data is either anonymized or permanently deleted.
| Category | Retention Period | Justification |
|---|---|---|
| Account data (profile, email, preferences) | Duration of account + 2 years of inactivity | Contract performance |
| Order data (tickets, purchases) | Duration of account + 3 years after last purchase | Legal obligation |
| Accounting and tax records | 10 years (pseudonymized after account deletion) | Art. III.86 Belgian Code of Economic Law + Art. 60 Belgian VAT Code |
| IP-based location (country/city) | 30 days rolling period, then automatically deleted | Legitimate interest |
| GPS location (device permission) | Session only (not stored server-side) | Consent |
| Shared location point | Stored while location sharing is on; deleted when sharing is turned off (ghost mode) or account deleted | Consent |
| Chat messages | Retained for the lifetime of the conversation; deleted within 30 days after conversation deletion | Contract performance |
| Sentry error logs | 90 days | Legitimate interest |
| Analytics data (PostHog) | 13 months | Consent |
| Images analyzed by SightEngine | Not retained by SightEngine after analysis | SightEngine contract |
| Data submitted to AI (Gemini) | Not used for training by Google under API terms | Google API contract |
| Social-boundary relationships (block, restrict, hide, mute) | Until removed or account deleted | Legitimate interest |
| Gamification data (XP, leagues, streaks, check-ins) | Duration of account | Legitimate interest |
| Personalization activity | Duration of account, or until personalization is disabled | Consent |
| Privacy and visibility settings | Duration of account | Contract performance |
| Marketing preferences (opt-in/out) | Until consent withdrawn | Consent |
| Fraud prevention data (IP, user-agent) | 5 years after case resolution | Legitimate interest |
| Campaign attribution attached to an order | Same period as the order it belongs to | Legitimate interest |
| Campaign attribution for an abandoned checkout | 30 days, then automatically deleted | Legitimate interest |
| Link-click records (vanity and short links) | 13 months, then the partition is dropped | Legitimate interest |
Account deletion: when you delete your Sway account, all personal data linked to your profile (follows, preferences, images, etc.) is permanently erased. However, European and Belgian accounting law (Belgian Code of Economic Law, art. III.86) requires us to retain transactional records for 10 years. To comply with both this obligation and article 17 §3(b) GDPR, we retain order records but pseudonymize all personal identifiers (your user ID and email are replaced with an irreversible hash). These records cannot be linked back to you.
7. International Data Transfers
Personal data processed by Sway is primarily hosted within the European Economic Area (EEA) on Supabase (Frankfurt) and Hetzner (Germany) infrastructure.
Certain sub-processors (Stripe, Cloudflare, PostHog, Sentry, SightEngine, ipinfo.io, Google Gemini, Vercel, RevenueCat) may process data on servers located in the United States or other countries outside the EEA. In each case, transfers are governed by standard contractual clauses (SCC) adopted by the European Commission under article 46(2)(c) GDPR, ensuring an adequate level of protection.
You may obtain more information about these transfer mechanisms by contacting us at [email protected].
8. Your Rights
Under applicable data protection law, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Rectification | Request correction of inaccurate or incomplete data. |
| Erasure | Request deletion of your personal data, subject to legal retention obligations. |
| Restriction | Request limitation of processing under certain conditions. |
| Data portability | Receive your data in a structured, commonly used, machine-readable format. |
| Objection | Object to processing based on legitimate interest, including IP geolocation. |
| Withdrawal of consent | Withdraw consent at any time for consent-based processing (GPS location, AI feature, marketing, organizer pixels). Withdrawal does not affect the lawfulness of prior processing. |
| Complaint | Lodge a complaint with the Belgian Data Protection Authority (APD/GBA): www.dataprotectionauthority.be. |
To exercise any of these rights, contact us at: [email protected]
We will respond within 30 days. We may ask you to verify your identity before processing your request.
Self-service tools: You can exercise some of these rights directly in the app. "Download my data" lets you export your personal data in a structured, machine-readable format (data portability), and "Deactivate account" temporarily disables your account and hides your profile. Deactivation is reversible — signing in again reactivates the account. Permanent account deletion is immediate (see section 6).
8.1 Is providing your data required?
(GDPR art. 13(2)(e))
Providing personal data to Sway is never a statutory requirement. Some of it is, however, necessary to enter into or perform a contract with us:
- To create an Account: an email address and a username. Without them we cannot create or secure the Account.
- To buy a Ticket: an email address, so the Ticket can be delivered and the order recovered. Payment details are collected directly by Stripe, not by us.
- To sell Tickets as a page holder: the identity and banking information required by Stripe for legal know-your-customer and anti-money-laundering checks. Without them, payouts cannot be made.
If you do not provide this data, we simply cannot provide the corresponding service. Everything else — profile picture, biography, location, marketing preferences — is entirely optional, and refusing it has no consequence beyond the related feature being unavailable.
8.2 Automated decision-making and profiling
(GDPR art. 13(2)(f))
Sway does not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you, within the meaning of art. 22 GDPR.
Two features involve automated processing, and neither takes a decision about you:
- Personalized recommendations (section 3.11) rank the events, artists and venues shown to you based on your in-app activity. The logic is a relevance score; the consequence is the order of a list. You can disable personalization at any time in your settings.
- Automated image moderation (SightEngine) screens uploaded images for illegal or prohibited content. Content may be removed automatically, but any account measure that follows is reviewed by a human, and you may contest it via the contact details in section 12.
8.3 Where we obtain data about you from others
(GDPR art. 14)
Most data we hold comes from you directly. In a few cases we receive it from someone else:
| Source | Data | Why |
|---|---|---|
| A page holder | Your email address and order details, where they issue you a guest-list or complimentary ticket | So the Ticket can be issued and scanned at the door |
| A page holder | Contact details imported into their CRM | So they can manage their own audience; they are the controller for that import and must have their own legal basis |
| Another User | Your identity as the recipient of a message, a follow, or a social boundary (block, mute) | To operate the corresponding feature |
| Stripe | Payment and payout status, KYC verification outcome | To complete a purchase or a payout |
| Cloudflare / ipinfo.io | Approximate country and city derived from your IP | See section 3.3 |
| An advertising platform | Campaign labels and click identifiers present in the link you followed | See section 3.12 |
Where we receive personal data about you from a third party, we inform you within one month at the latest, or at the first communication with you, unless you already have the information or providing it proves impossible or disproportionate.
9. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website and application.
Strictly necessary cookies (no consent required)
These cookies are essential for the Platform to function and cannot be disabled:
- Session cookies: maintain your authenticated session.
- Preference cookies: remember your language and display preferences.
- Cookie consent cookies: store your cookie preferences.
Analytics and performance cookies
On the website, these cookies are placed in accordance with your choice in the cookie banner. In the mobile app, product analytics and personalization are enabled by default and can be turned off at any time in your privacy settings. The website cookie banner and the in-app analytics setting are separate, independent mechanisms and are not linked: changing one does not change the other.
- PostHog: product analytics — tracks usage patterns and feature interactions to help us improve the Platform. Data is retained for 13 months.
Advertising and tracking pixels (consent required)
These pixels are only active if you have given your consent:
- Meta Pixel: conversion tracking for advertising campaigns on Meta platforms.
- Google Analytics 4 (GA4): audience analytics and campaign performance measurement.
- TikTok Pixel: conversion tracking for advertising campaigns on TikTok.
You can manage your cookie preferences at any time via the cookie banner on the Platform or through your browser settings. Disabling certain cookies may affect your experience.
10. Security
We implement appropriate technical, organizational, and physical measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encrypted connections (HTTPS/TLS) for all data in transit.
- Access controls and authentication for all systems containing personal data.
- Infrastructure hosted within the European Union (Supabase, Hetzner).
- Regular security monitoring via Sentry.
- Automatic image moderation via SightEngine to prevent illegal content.
Despite these measures, no method of transmission over the Internet is completely secure. We cannot guarantee absolute security. In the event of a personal data breach, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. If material changes are made, we will notify you via the Platform or by email at least 15 days before the changes take effect.
The current version is always available at: sway.events/privacy
12. Contact
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
Sway SRL
Enterprise number: BE1037531992
Clos des Colombes 23, 1342 Limelette, Belgium
[email protected]