Streavent

GDPR overview

Implementation is concrete and specific rather than declarative. The privacy policy, effective 5 June 2025, names its legal bases (Art. 6(1)(a), (b), (c), (f) and Art. 7) and lists data subject rights article by article: 15, 16, 17, 18, 19, 20, 21, 7(3) and 77. Streavent states its dual role, controller for its own website and customer data, processor under Art. 28 for event data, and the terms confirm a data processing agreement is concluded with each customer. BDSG and TMG are cited alongside the GDPR. Third-country transfers are covered by EU standard contractual clauses under Art. 44 et seq., with an explicit admission that protection may be weaker abroad. A consent banner pre-activates only strictly necessary cookies. No Article 27 representative is named, which is correct for a German-established controller, and no DPO is appointed; privacy contact is a dedicated address.

Who owns the data?

Ownership is split. All intellectual property in the platform stays with Streavent, which grants only a non-exclusive, non-transferable, non-sublicensable right of use limited to the contract term; the source code is never handed over. The content and attendee data the customer uploads remain the customer's: Streavent neither monitors nor takes responsibility for it. For event data Streavent acts purely as a processor under Article 28 GDPR and processes it only on the customer's documented instructions, flagging any instruction it believes unlawful. The customer is the controller and carries the data protection obligations. Streavent is controller only for its own website and for customer account and billing data.

Reuse rights

The customer may use and reuse the data it collects through the platform without asking Streavent for permission, since that data belongs to the customer and Streavent only processes it on instruction. Practically, the constraint is time rather than licence: uploaded data stays available for download for four weeks after the contract ends and is then deleted in full, and access to the platform itself stops when the event finishes or the monthly package expires. Exporting before that deadline is the customer's responsibility. The GDPR right to data portability under Article 20 is explicitly restated. What is prohibited is passing the platform or the access credentials to third parties, whether by copying, selling, lending or renting; the customer's own employees do not count as third parties.

Data retention & training

Hosting summary

The event platform is hosted with Amazon Web Services EMEA SARL, based in Luxembourg, with the server location in Frankfurt am Main, Germany. The privacy policy presents this as ensuring data is not transferred to the United States, and states as a general rule that processing happens at the German headquarters or with providers inside the European Union. Transfers to third countries are covered by EU standard contractual clauses under Article 44 et seq. GDPR, with an explicit acknowledgement that protection abroad may be weaker. Two caveats matter. First, the ISO 27001, SOC and PCI DSS certifications cited belong to AWS rather than to Streavent. Second, several named subprocessors are outside the EU, including Padlet, Jotform, Miro, Pastel Labs, SpatialChat and LogRocket, the last storing anonymised website analytics in the United States, so the actual footprint depends on which modules are enabled. The marketing site itself is served through a Cloudflare anycast CDN, which is a delivery layer and not a storage location.