Privacy policy
Last updated: 17 September 2026
Who we are
This policy explains how Grevit SK s. r. o., Vyšehradská 6, 851 06 Bratislava - mestská časť Petržalka, Slovakia, VAT ID SK2122002388 ("we") handles personal data in the Zalaway mobile app and the related web portal. Questions about privacy can be sent to info@zalaway.com.
Who is responsible for which data
For accounts of organisers and door staff, we are the data controller. For guest lists, the event organiser decides which guest data is collected and why. The organiser is the controller of that data and we process it on the organiser's behalf.
Data we process
- Account data: name, e-mail address and sign-in details of organisers, and the name and contact details of door staff invited to an event.
- Guest data entered by organisers: name, e-mail address, phone number, group, ticket, photo and any custom fields the organiser adds, for example a food preference.
- Check-in records: which ticket was checked in or out, when, and by which staff member and device.
- Device and diagnostic data: device model, operating system version, app version and crash reports.
The camera is used only to read QR codes. Images from the camera are processed on the device and are not stored or sent to us.
Why we process it
- To provide the service: signing in, syncing guest lists and recording check-ins.
- To send service messages such as staff invitations and tickets.
- To keep the service secure and to fix errors.
- To meet legal duties, such as accounting rules.
Under the GDPR, the legal bases are performance of a contract, our legitimate interest in a secure and working service, and legal obligations. We do not sell personal data and we do not use it for advertising.
Who we share it with
We use service providers for hosting, sending e-mail and SMS, payment processing (Stripe) and crash reporting. They process data only on our instructions. If data is transferred outside the European Economic Area, we rely on the safeguards the GDPR requires, such as standard contractual clauses.
How long we keep it
Account data is kept until the account is deleted. Event and guest data is kept until the organiser deletes the event or the account. When door staff access is revoked, the event data is removed from that device. Invoices are kept for the period the law requires.
Your rights
You can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing. Guests should contact the organiser of their event first; we help organisers answer these requests. You can also complain to your data protection authority. To delete your account, see Delete account.
Children
The app is intended for event professionals and is not directed at children.
Changes
If we change this policy, we publish the new version on this page and update the date above.