- 1. Who is responsible
- 2. What we collect
- 3. Why we use it, and on what legal basis
- 4. Who we share it with
- 5. Transfers outside the EU/EEA
- 6. How long we keep it
- 7. Security
- 8. Your rights
- 9. Cookies
- 10. Changes
- 11. Contact
This policy explains how Ofski, MB collects and uses personal data when you visit opero.events, sign up for OPERO, sign in, and pay for it.
1. Who is responsible
The controller is Ofski, MB:
- Company code: 304215619
- Address: Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania
- Email: info@ofski.dev (privacy questions too)
Data inside your Workspace. Workspaces hold data such as events, artists, contacts and finances. For that data the OPERO customer who owns the Workspace is the controller. We process it only on the customer’s behalf, under our Data Processing Agreement (opero.events/dpa). If your data is in someone’s Workspace, contact that company first.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | First and last name, email address, password (stored only as a secure hash), language, profile photo if you add one | You |
| Workspace and membership | Company or workspace name, workspace address, country, time zone, which workspaces you belong to and your role | You, your Account admin |
| Billing | Billing name and address, VAT number if any, plan, invoices, payment status. Card or bank details are handled by Stripe; we only see the type and last four digits. | You, Stripe |
| Communications | Emails and support requests you send us | You |
| Technical and security | IP address, browser type, sign-in times, request logs, security events, bot-check result (Cloudflare Turnstile) | Automatically |
We do not intentionally collect special categories of personal data. The Service is not intended for anyone under 18.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your Account and Workspaces, sign you in, send emails you need (confirmation, invitations, sign-in links, password reset) | Contract (Art. 6(1)(b)) |
| Billing, invoices, tax and accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Security, preventing fraud and abuse (bot checks, logs, rate limits) | Legitimate interests (Art. 6(1)(f)) |
| Support and service messages (for example changes to terms, incidents) | Contract; legitimate interests |
| Improving the Service using aggregated usage information | Legitimate interests |
| Marketing emails, only if you opt in | Consent (Art. 6(1)(a)), which you can withdraw at any time |
4. Who we share it with
We use the following service providers (processors), only to provide the Service:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting servers | EU (Germany/Finland) |
| Amazon Web Services EMEA SARL | Encrypted offsite backups | EU (Paris) |
| Stripe Payments Europe Ltd. | Payments, invoices, tax calculation | EU; transfers to the US under safeguards |
| Cloudflare, Inc. | Bot protection on sign-up (Turnstile) | Global; transfers under safeguards |
| Hostinger International Ltd | Sending emails | EU (Lithuania) |
| Anthropic, PBC | AI features (only content you use in AI features) | US; transfers under safeguards |
We may also disclose data to authorities when required by law, to professional advisers (for example our accountant) and to a successor if our business is transferred. We do not sell personal data.
5. Transfers outside the EU/EEA
Some providers process data outside the EU/EEA, mainly in the United States. In that case we rely on an adequacy decision (for example the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses.
6. How long we keep it
- Account data: while your Account exists, and up to 60 days after it is closed.
- Workspace data: as described in our Terms. Trial Workspaces are deleted 30 days after the trial ends. Cancelled Workspaces are deleted 30 days after the subscription ends. Workspaces locked for non-payment are deleted 60 days after locking.
- Backups: deleted data may remain in encrypted backups until those backups expire. Active Workspaces may have yearly backup copies kept for up to 10 years; backups of deleted Workspaces are removed within about 12 months.
- Billing and accounting records: 10 years, as required by Lithuanian law.
- Security logs: up to 14 days, unless needed longer to investigate an incident.
- Unconfirmed sign-ups: deleted after 7 days.
7. Security
- Data is encrypted in transit (HTTPS).
- Each Workspace has its own separate database.
- Access is limited to staff who need it.
- Passwords are stored only as hashes.
- Logs are kept free of passwords and session tokens.
- Backups are encrypted and stored offsite in the EU.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- correct it;
- have it deleted;
- restrict its processing;
- object to processing based on legitimate interests;
- data portability;
- withdraw consent at any time.
To use these rights, email info@ofski.dev. We will reply within one month. You can also complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the authority in your country.
9. Cookies
We use only cookies that are strictly necessary for the Service to work:
- the sign-in session cookie;
- a security token that protects forms;
- a cookie that remembers your preferences, such as theme;
- Cloudflare Turnstile, on the sign-up page, to tell people from bots.
These do not need consent. The opero.events website itself does not use analytics or marketing cookies, so no cookie consent banner is shown.
10. Changes
We may update this policy. We will post the new version here with a new effective date, and tell Account owners by email about material changes.
11. Contact
Ofski, MB · Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania · info@ofski.dev