Privacy & Cookie Policy
How EcomExpo handles your personal data, which cookies we use, and how to change your mind. Last updated 2 October 2026.
In short. We only collect what we need to run the conference: your details when you buy a ticket, apply to speak, enter the Awards or join the newsletter, the profile you create if you use the attendee app, and anonymous-by-default website statistics. Analytics and marketing cookies are set only after you click Accept in the cookie banner. You can withdraw that consent at any time with the button below.
1. Who is responsible
The data controller for ecomexpo.eu and for EcomExpo events is UAB APG MEDIA, Žalgirio g. 94, LT-09300 Vilnius, Lithuania, trading as APG Media, the organizer of EcomExpo since 2013.
Privacy questions and requests: [email protected]. Awards-specific requests: [email protected].
This policy covers ecomexpo.eu and its language versions (/lt/, /lv/, /ee/, /pl/) and the EcomExpo conference itself. Ticket purchases happen on Fienta and hotel bookings with the hotels directly; those services have their own privacy notices.
2. What we collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You buy a ticket | Name, email, company, invoice details, ticket type, order number (received from Fienta) | Registration, badge, check-in, event communications, invoicing, InvoHub trial access | Contract |
| You apply to speak | Name, email, company, role, LinkedIn, talk proposal, headshot if supplied | Reviewing proposals, programme planning, contacting you about this or the next edition | Steps before a contract; legitimate interest |
| You enter the Awards | Contact and company details, VAT ID, Fienta order number, entry content and links | Judging, shortlist and winner announcements, ceremony | Contract (see the Awards Terms) |
| You join the newsletter | Email address, optional name, opens and clicks | Sending EcomExpo news; every email has an unsubscribe link | Consent |
| You email us or ask about sponsoring | Whatever you include, typically name, company, role, email | Replying, preparing a proposal | Legitimate interest; contract |
| You use the attendee app (ecomexpo.eu/app) | Your ticket e-mail; name, company, LinkedIn and shop link pre-filled from your Fienta ticket; the photo, job title, bio, role and topics you add; sessions you save; meeting requests and chat messages; your notification settings; blocks and reports | Signing you in with a one-time code, suggesting people to meet, showing your profile to other ticket holders only while you keep it visible, delivering meeting requests and messages, e-mail notifications you can switch off, keeping the app safe. Your e-mail is shown only to people whose meeting request you accept. | Contract (the app is part of your ticket); consent for a visible profile; legitimate interest for safety (blocks, reports, rate limits) |
| You answer the attendee survey (ecomexpo.eu/survey) | The sessions you saw and your ratings and comments; your overall answers; the personal link from our invitation e-mail (tied to your ticket e-mail) or the ticket e-mail you type in for the prize draw; a hashed IP address for abuse limits | Improving the programme and the event, giving speakers aggregated ratings and comments without your name, running the prize draw and contacting its winners, sending one reminder only to invitees who have not answered | Legitimate interest (event feedback); consent for the prize draw |
| You visit the site | IP address, browser, pages viewed, referrer (server and CDN logs); analytics and ad cookies only after consent | Security, keeping the site up, measuring what content works, measuring ad campaigns | Legitimate interest (logs); consent (cookies) |
| You attend the event | Photos and video recorded in public areas and on stage | Documenting the conference, promoting future editions, publishing talks on YouTube | Legitimate interest; tell staff on the day or email us if you prefer not to appear |
3. Cookies and similar technologies
The site works without any marketing or analytics cookies. When you first visit, a banner asks for your choice. Nothing from the list below is loaded until you click Accept. If you click Decline or ignore the banner, only the strictly necessary storage is used.
| Category | Provider and typical cookies | Purpose | Lifetime |
|---|---|---|---|
| Strictly necessary | ecomexpo.eu: cookie_consent (browser local storage) | Remembers whether you accepted or declined | Until you clear it or click Manage cookie preferences |
| Analytics | Google Analytics 4 via Google Tag Manager: _ga, _ga_* | Aggregate statistics on visits, pages and traffic sources. IP addresses are not stored by GA4. | Up to 2 years |
| Marketing | Google Ads: _gcl_au; Meta Pixel: _fbp, _fbc; LinkedIn Insight Tag: li_fat_id, bcookie, lidc | Measuring whether our ads led to ticket sales and showing EcomExpo ads to people who visited the site | 1 day to 1 year, set by each provider |
We also use Google Consent Mode, which tells Google tags whether you consented. When consent is declined, no Google cookies are set and no identifiable data is sent.
4. Who else sees your data
We do not sell personal data. We share it only with service providers who process it for us under contract, and with partners where you would expect it:
- Fienta (Estonia): ticket sales, payments and attendee list.
- MailerLite (Lithuania): newsletter delivery.
- Supabase (servers in Ireland and Sweden): attendee app database, sign-in and profile photos; attendee survey answers.
- Resend (sending from Ireland): attendee app sign-in codes and notification e-mails; attendee survey invitations.
- Make.com (Celonis, EU hosting): routes website form submissions to our tools.
- Google (Ireland): Tag Manager, Analytics, Ads. Meta (Ireland) and LinkedIn (Ireland): advertising measurement, only after consent.
- Cloudflare and our web hosting provider: serving and protecting the site; server logs.
- InvoHub: activating the 90-day trial included with every ticket, if you choose to use it.
- Awards jury members: see entry content, not personal contact details beyond company and entrant name.
- Sponsors: receive your details only if you hand them your badge, scan a code at their stand, or opt in to a sponsor session that says so.
Some providers process data outside the European Economic Area, mainly in the United States. Those transfers rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Ticket and invoice records: 10 years, as required by Lithuanian accounting law.
- Speaker applications: until the next edition's programme is closed, then deleted or anonymised unless you spoke.
- Awards entries: as set out in the Awards Terms.
- Newsletter subscription: until you unsubscribe.
- Attendee app profile, saved sessions, meeting requests and messages: until you delete your account in the app, and in any case no later than 31 December 2026.
- Attendee survey answers: until 31 March 2027, then only aggregated results are kept; prize-draw e-mails are deleted after the winners are notified.
- Server logs: up to 30 days. Analytics data: as configured in GA4, 14 months.
- Event photos and recordings: indefinitely as part of the EcomExpo archive, unless you ask us to remove one you appear in.
6. Your rights
Under the GDPR you can ask us for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interest or withdraw consent at any time. Email [email protected]; we answer within one month. You can also complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).
7. Changes
We update this page when our tools or practices change and show the date at the top. Substantive changes are announced in the newsletter.