Privacy

Expo Radar Pro is made by Festival Radar BV, 's Hertogenlaan 107, 3000 Leuven, Belgium, company number BE 0805.882.829. If you have a question about this policy or about your data, mail us at [email protected].

We play two different roles, depending on where your data comes from:

• On our website, and when you contact us or book a demo, we decide what happens with your data. We are the controller.
• In the Expo Radar Pro app, the festival or organisation that invited you decides what happens with the data. They are the controller and we process the data on their behalf, under a data processing agreement. If you're crew at a festival, your organiser is your first point of contact for questions about your data, and we'll help them answer.

Visits. We measure how people use the website with PostHog, hosted in the EU, and with Cloudflare Web Analytics. Until you accept cookies in the cookie banner, PostHog works without cookies and without a profile of you: it sees technical data such as the pages you visit, your browser and device type, the site that referred you and an approximate location derived from your IP address. If you accept, PostHog also sets a cookie to recognise your browser on a later visit and may record how you move through the pages, so we can see where the website is unclear. If something on a page breaks, PostHog also receives the error message and where in our code it happened, so we can fix it. You can withdraw that at any time via "Cookie settings" in the footer. We use all of this to improve the website; for the cookieless part we rely on our legitimate interest, for the rest on your consent.

Contact form. When you send us a message, we receive your name, email address, festival or organisation, your message and anything you attach. The form is protected by Cloudflare Turnstile, which checks that you're a person and not a bot. We use your details only to answer you and, if it leads somewhere, to prepare a quote or an agreement.

Demo bookings. Booking a call goes through Google Calendar. We receive your name, your email address and anything you add to the booking, and we use it to hold the call.

Email. If you mail us directly, we keep that conversation in our mailbox (Google Workspace).

For the contact form, bookings and email, our legal basis is taking steps at your request before a possible agreement, and our legitimate interest in answering business questions. We never sell your data.

To make Expo Radar Pro work, we process:

• Account details: your name, phone number, role and team, as entered by your organiser.
• What you add: tasks and incidents with their description, category, location on the map and status history, photos, voice messages and chat messages.
• Location: the spots you pin on the map, and, only if you allow it on your phone, your current location so the map can show where you are.
• Technical data: device and app information, the token we need to send you push notifications, IP address and log data, used to keep the app running, secure and to fix bugs.
• Usage data: which parts of the app are used and how, measured with PostHog, so we can improve the product. We also use PostHog to switch new features on for some users before everyone gets them.
• Error reports: when something goes wrong in the app, PostHog receives the error message, where in our code it happened, and your device and app version, so we can fix it. Phone numbers are removed from these reports before they are sent.

Signing in with your phone number goes through Firebase Authentication, which sends the code by SMS and uses Google reCAPTCHA to stop abuse. Map tiles may be loaded from OpenStreetMap.

Incidents can contain sensitive information, for example when a care team logs a first-aid call. The organiser decides what is recorded and is responsible for having a legal basis for it. We only process it to provide the service.

When someone shares a task or incident through a public link, anyone with that link can see that task or incident, including its map, photos, status and chat. The link can be revoked at any time and expires automatically. Viewing a shared link sets no cookies; if the page breaks, an error report without any profile of the viewer is sent to PostHog so we can fix it.

We only share data with service providers who help us run Expo Radar Pro, and with the people in your own organisation who need it to do their job. Our main providers today are:

Provider	What for	Where
Google Cloud / Firebase	Hosting, database, file storage, sign-in, SMS and push notifications	EU (Belgium, europe-west1)
Google Workspace	Email and calendar	EU and elsewhere, with EU safeguards
PostHog	Website and product analytics, error tracking and gradual feature rollout	EU
Cloudflare	Website hosting, security, bot protection and analytics	Global network
Apple and Google	Delivering push notifications to iOS and Android phones	Global

This list can change as our service evolves. Customers find the sub-processors that apply to them in their data processing agreement. We don't sell personal data, and we only hand it to the authorities when the law requires it.

Festival data in the app is stored in the EU, in Google Cloud's europe-west1 region in Belgium. Some providers, such as the push services of Apple and Google or Cloudflare's network, may process data outside the European Economic Area. When that happens, we rely on the safeguards the GDPR allows, such as the EU's standard contractual clauses or an adequacy decision.

We keep personal data only as long as we need it for the purpose we collected it for.

• Website analytics: as long as it's useful for improving the website.
• Messages, bookings and email: as long as needed to follow up on your question, and longer if it leads to an agreement.
• Festival data in the app: as agreed with the organiser in their agreement and data processing agreement. When that agreement ends, we return or delete the data as agreed there.
• Your account: you can ask us to delete it (see below). The tasks and incidents you reported stay in the festival's log, because the organiser needs a complete record.

Where the law requires us to keep something longer, for example invoices, we do.

The website sets analytics cookies only after you accept them in the cookie banner. Until you choose, or if you choose "Only necessary", we measure visits without cookies. A few things are always stored because the website needs them: your cookie choice itself (a cookie and browser storage named c15t), your language if you pick one (a cookie for a year, so we don't switch you back), and the technical storage our security and bot protection may need. Booking a demo opens Google Calendar inside the page; Google sets its own cookies there, under Google's privacy policy. The app stores a small amount of data on your device to keep you signed in.

You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing and to receive it in a portable format. For data in the app, your organiser handles these requests first, and we help them. You can always mail us at [email protected] and we'll make sure your request reaches the right place.

To delete your app account, mail [email protected] from the email address you joined with, or tell us the phone number you joined with.

If you think we handle your data wrongly, please tell us first. You also have the right to file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

We take appropriate technical and organisational measures to protect your data, such as encrypted connections and role-based access in the app. If a data breach affects festival data, we inform the organiser as set out in their data processing agreement.

When we change this policy, we'll post the new version here and update the date at the top.

Festival Radar BV, 's Hertogenlaan 107, 3000 Leuven, Belgium. Questions about privacy go to [email protected].