Data connections to external services implemented in Invitario

Data connections to external services implemented in Invitario

To provide selected functions and ensure service quality, Invitario's event websites and mailings – generally referred to as "guest communication" – implement the following data connections to external services. Please consider these in your privacy policy if necessary.

Mailings

When sending mailings by the customer, the recipient's name and email address are transmitted in an encrypted manner to our email service provider Mailjet. The opening of the email and the clicking of links within it are tracked by our email service provider (ESP). The former only occurs if the recipient allows images in the message to be loaded by their mail client.

Cookies on Event Websites

Invitario uses only functional and technically necessary cookies on event websites, which are required for language settings and identifying the type of user device (e.g., mobile phone, desktop computer) to ensure the proper technical display of the event website. These cookies are not used for user behavior measurement, profiling, or advertising purposes, and they are not provided to third parties. Consent according to Art 6 Abs 1 lit a GDPR is not necessary, as these are technically necessary cookies.
  1. PHPSESSID: Application session cookie
  2. hl: Cookie to store the user language
  3. device_view: Cookie to identify the type of user device (e.g., mobile phone, desktop computer) for proper technical display of the event website
Justification for technical necessity: The legality for setting or reading cookies is generally regulated in Art. 5 Abs. 3 of Directive 2002/58/EC, which is implemented at the national level in Germany in § 25 TTDSG and in Austria in § 165 Abs. 3 TKG 2021. In summary, cookies can only be set or read without consent when it is absolutely necessary to provide the service requested by the user or subscriber ("technically necessary cookies").

Neither Directive 2002/58/EC, nor TKG 2021, nor TTDSG contain a list of what exactly constitutes "technically necessary cookies". However, the Opinion 04/2012 on Cookie Consent Exemption, WP 194, 00879/12/EN of the former Art. 29 Working Party provides criteria to assess whether cookies are technically necessary according to Art. 5 Abs. 3 of Directive 2002/58/EC.

According to information from the Austrian supervisory authority, cookies are not technically necessary (and therefore require consent) if they track user behavior on the respective website or across multiple websites or devices. This includes social media plugins or advertising networks, which result in the transmission of personal data to third parties.

The "hl" and "device_view" cookies are technically unable to directly or indirectly associate with a natural person, and no data is transmitted to third parties.

The supervisory authority in Luxembourg specifies for technically necessary cookies that "user-input cookies" or "session-id cookies" (when a user fills out a form or a shopping cart), "multimedia player session cookies" (storing technical data to play video and audio content), and "user interface customization cookies" (storing preferences like language settings) are explicitly included in the exemptions.

The "hl" and "device_view" cookies fall into the category of "user interface customization cookies" and are therefore not subject to consent requirements according to § 165 Abs. 3 TKG 2021 or § 25 Abs. 2 Nr. 2 TTDSG. The legal basis for this processing is in the legitimate interest of the controller according to Art 6 Abs 1 lit f GDPR, where the legitimate interest lies in the correct and readable display of the registration form for event participation on the user's device.

Server Log Files

  1. Access time
  2. IP address of access
  3. Accessed page
  4. Used browser ("User Agent")
  5. HTTP referrer (if the user is linked from another page)

Further Information on Data Connections

  1. Google Analytics: Used only in the admin interface, not on the event website or in guest communication. Demographic features such as age and gender are recorded (see https://support.google.com/analytics/answer/2799357).
  2. Google Web Fonts: Fonts from Google Web Fonts are hosted directly on our servers. This means that no connection to Google is established when loading. These fonts can only be used on event websites or in guest communication by selecting an appropriate font in the design settings.
  3. Google Maps: Optionally used on the event website or in guest communication. When embedding a "Google Map" content block in mailings, we create a static map using the Google Static Maps API, which is then delivered through our own servers. You have the option to disable the function entirely or in all areas.
  4. User Registration: Depending on the application's use by the user, particularly when using the software for open events.
  5. SSL Encryption of Event Website: Yes.
  6. Data Transmission Service Providers for Online Contracts (without goods shipment): When using the optional payment function, session data is transmitted to payment service providers (PSPs) "Sofort" and "Stripe". Only non-personalized transaction status information is stored on Invitario's servers. In case of successful payment, additional data is recorded: for "Stripe", the credit card brand, the last 4 digits of the credit card number, and the credit card's expiration date; for "Sofort", the bank details (BIC and IBAN) of the sender and recipient of the payment are stored.
  7. Encrypted Payment Transactions: Yes, handled through the PSPs implemented in Invitario.