Privacy policy

Updated: 23 October 2026

UA Events is an events listing for the Ukrainian community in the Netherlands. We respect your privacy and process personal data in accordance with the GDPR (AVG) and Dutch law. This policy describes what data we collect, why, and what you can do about it.

1. Who is responsible

The UA Events project. Contact for questions about your data: via the contact form.

2. What data, why and on what legal basis

• Telegram subscription: your Telegram chat_id, chosen cities and categories, and your public Telegram profile (name, @username and avatar if present) that we request from Telegram to recognise you in the admin panel. We store the conversation history with the bot (your messages and the bot's replies, including files or photos you send) to provide support and understand errors. If you press «Remind me the day before» under an event, we store that choice in order to send you a reminder. We also store the label of the link you used to come to the bot (for example from a poster or post), to understand where subscribers come from. Links in the bot's buttons contain a signed label of your chat, so we can count how many people click through to an event. Purpose — sending announcements via Telegram. Legal basis — your consent (you press Start yourself).
• Email subscription: email address, chosen city and categories, a technical confirmation token and the site language in which you receive emails. Purpose — an events digest. Legal basis — consent with address confirmation (double opt-in).
• «Add an event» form: title, description, date, city, address, price, registration link and source/organiser, optionally a photo. Purpose — publication after moderation. Legal basis — legitimate interest (maintaining the listings) and the submitter's consent.
• «Add a business» form: name, category, city, address, website, description. Purpose — display on the map of Ukrainian businesses. Legal basis — legitimate interest / consent.
• Organiser account: organisation name, email, password (stored only as a hash), optionally a contact detail, and the details of the public page (logo, description, social media). For ticket sales: the Stripe account ID and, if needed, KVK/BTW details. Purpose — the portal, publishing events on behalf of the organiser and payouts. Legal basis — performance of a contract.
• Contact form and support chat: name, email (optional), the text of your message and the support chat (in the organiser portal or the bot). Purpose — to reply and help. Legal basis — legitimate interest.
• Book reviews and book suggestions: name, rating and text. To protect against spam we store an anonymised hash of the IP address, not the address itself. After moderation the review is published with the name you gave. Legal basis — your consent.
• Buying tickets: your name, email address and (optionally) phone number, plus the order details. Purpose — creating the ticket, sending it by email and checking entry. We share your name and email address with the event organiser (the seller) for entry control and their records. Payment is handled by Stripe; we do not store payment card details. Legal basis — performance of a contract.
• Registration for free events and the waiting list: your name, email address and answers to the organiser's questions. Purpose — issuing the QR ticket, checking entry, letting you know a place has become available, sending important updates about the event (only after we have checked them) and one short feedback survey afterwards. This data is received by the event organiser — solely to organise their events (attendee list, attendance history of their events, their own tags and notes). You can cancel or leave the waiting list via the link in the email. Legal basis — performance of a contract (participation) and legitimate interest.
• Technical server logs: IP address, browser (user agent), time and address of the request. Purpose — security, stability and protection against automated copying of content. Legal basis — legitimate interest.
• Anonymised visit statistics: page path, time and an anonymous daily hash of the visitor to count unique visitors. The IP and browser are only used to calculate that hash and are not stored; the «salt» changes daily, so you cannot be tracked or identified across days. For this we use our own site statistics, Umami (hosted on our own server, data is not shared) and Cloudflare Web Analytics — both without cookies and without profiling. Legal basis — legitimate interest.

3. How the mailings and reminders work

After subscribing you receive automatic messages about events. This is how it works:

• Announcements of new events: new events matching your cities and categories are sent once a day — around 18:00, up to 5 events (not at night); events far ahead are announced about a month before they start. Right after subscribing we send 3–5 upcoming events in your city, so you do not start with an empty list.
• Email digest: for the email subscription, announcements are bundled into a weekly digest, so as not to overload your inbox.
• Reminders (optional): in Telegram there is a «Remind me the day before» button under an announcement, and a matching link in the email. If you press it, we send one reminder about a day before the event starts. Without that action there are no reminders.
• Unsubscribing: at any time — the /stop command in the bot or «Unsubscribe» in an email. In the bot you can also view and delete the reminders you have set.

4. Spam protection

Our forms (adding an event or business, contact, book reviews and suggestions, event registration, buying tickets and the waiting list) use Google reCAPTCHA to protect against bots. Google processes technical browser data in accordance with the Google Privacy Policy. Legal basis — legitimate interest (security).

5. Processors (whom we share data with)

We do not sell your data. To run the service, these parties process data:

• Hostinger — hosting (servers in the EU, Germany).
• Cloudflare — content delivery network and attack protection: requests to the site pass through Cloudflare, which sees the IP address and technical details of the request, plus anonymous cookieless visit statistics (Web Analytics).
• Telegram — delivery of bot messages to subscribers.
• Resend — email delivery (provider in the US; standard contractual clauses apply).
• Stripe — processing of ticket payments (payment card details go directly to Stripe; we do not receive or store them). See the Stripe Privacy Policy.
• Event organiser — when you register or buy a ticket, receives your name, email address and form answers for entry control and organising their events (for ticket sales the organiser is the seller).
• Anthropic (Claude) — artificial intelligence: structures texts of public event announcements, helps with descriptions and automatically translates titles and descriptions of events, businesses, books and reviews into English and Dutch. We only share these texts, without your contact details. Provider in the US; standard contractual clauses apply and API data is not used to train models.
• OpenFreeMap, OpenStreetMap, Esri, unpkg — background maps and libraries on the events and business maps: your browser loads map tiles from their servers.
• Google reCAPTCHA — spam protection.
• OpenStreetMap / Nominatim — converting an address into a point on the map.

6. Retention period

• Subscription data — until you unsubscribe. After /stop we delete the subscription but keep only your chat_id and filters to notify you once (no sooner than 14 days later) about matching new events. To prevent this, block the bot or contact us. After unsubscribing by email, the data is deleted.
• Conversation history with the bot — we keep it until you ask us to delete it (for support and troubleshooting).
• Published events and businesses — as long as they are relevant or until you request removal.
• Registrations, tickets and form answers — we keep them until you ask us to delete them (the organiser's records and attendance history), except what the law requires us to keep (for example sales records).
• Organiser account — as long as it is active. After the account is deleted we erase the data, except what the law requires us to keep (for example sales records).
• Technical logs — a limited period needed for security; the log of protection against automated copying — 14 days.

7. Your rights

You have the right of access, rectification, erasure and portability, to object to processing and to withdraw consent. The easiest way:

• Telegram: send /stop to the bot — the subscription is deleted (see the retention periods above).
• Email: click «Unsubscribe» in an email — the data is deleted.
• Organisers: to delete your account, write to support in the portal or via the contact form.
• Everything else (removing an event/business or questions about your data) — via the contact form.

8. Cookies

We only use a technically necessary session cookie (login and form protection). Your theme choice is stored in your browser (localStorage), not in a cookie. Statistics (Umami, Cloudflare Web Analytics) work without cookies. reCAPTCHA may set its own cookie on pages with forms. There are no advertising or tracking cookies, so a consent banner is not needed. More on the Cookies page.

9. Changes

We may update this policy. The current version is always on this page with the date at the top.