Privacy Policy

1. Who we are (Controller)

The GLOBAL contour of ExpoLocator.com (the “Service”) is operated by [OPERATOR TO BE CONFIRMED — placeholder, no fictitious data is published]. For privacy matters: privacy@expolocator.com. Support: support@expolocator.com.

This policy applies to expolocator.com/en/ and other international language versions. The Russian-language contour at /ru/ is operated by a separate legal entity under Russian law and has its own privacy policy. The two documents do not cover each other.

2. A primarily B2B service (data minimisation by design)

ExpoLocator is a business-to-business service focused on organisations, trade fairs and event organisers. We deliberately minimise the processing of personal data. Our public catalog predominantly contains: legal entities and trade names, corporate websites, general corporate e-mail addresses (e.g. info@company.com), corporate phone numbers, business addresses, products, fairs, organisers and business activities.

We do not claim that no personal data is ever processed. Where personal data does arise, it is described honestly below and processed on the legal bases listed.

3. Personal data that may arise and why

• Account data (for companies/organisers/partners using the Service): name, work e-mail, login. Purpose: providing the account and claimed catalog pages. Basis: performance of a contract.
• Claim requests (“Manage this page”): submitted messages and identity of the requester. Purpose: verifying the authorised representative before linking an account to a catalog card. Basis: contract; legitimate interests (protecting catalog integrity).
• Commercial communications (orders, invoices): company name, billing details, work e-mail. Purpose: issuing invoices, subscriptions, partner settlements. Basis: contract; legal obligation (accounting records).
• Partner records: partner account, referral attribution, reward balances. Basis: contract.
• Security logs: IP address, user-agent, timestamps in outbound-click logs (/go/) and security logs. Purpose: counting valid outbound clicks, excluding automated traffic, preventing abuse. Basis: legitimate interests (security and fraud prevention).
• Cookies and similar identifiers: see the Cookie Policy. A non-essential referral cookie (expo_ref) is set only with your consent and only to attribute partner referrals.
• Support / privacy requests: contact details you give us and the content of your message. Basis: contract; legitimate interests.

4. Legal bases

Under the EU GDPR we use the following bases, chosen per operation: (a) performance of a contract; (b) legitimate interests — catalog integrity, security, fraud prevention, B2B communication about our own similar services; (c) consent — non-essential cookies and, where required, direct marketing e-mail; (d) compliance with legal obligations — accounting and tax records. We do not use a universal consent checkbox for processing that in fact rests on another basis.

5. Direct marketing and B2B e-mail

Corporate e-mail addresses published by companies themselves may be used for business-to-business communications about ExpoLocator services. Where required by applicable electronic communications law (including § 103¹ of the Estonian Electronic Communications Act for corporate contacts), every marketing message carries a free, simple way to opt out electronically, and opted-out addresses are added to a suppression list that prevents further sends. Marketing is a separate function from service notifications (e.g. payment confirmations). See the Marketing Communications Policy.

6. Recipients and processors

We keep an internal register of processors. As of the date of this version the Service runs self-hosted on infrastructure operated by us; the categories of recipients that may process data on our behalf are: hosting/infrastructure provider, e-mail delivery provider, backup storage, payment/accounting providers of the relevant commercial contour, error/security monitoring. We do not sell personal data. The public catalog itself is public by design: it contains business information about organisations, not personal profiles of individuals.

7. International transfers

This version of the document does not assert that data never leaves the EEA. Where a processor is located outside the EEA, transfers are based on applicable safeguards (such as the European Commission’s standard contractual clauses) and are documented in our internal processor register. A dedicated section with per-country detail will be added once the production infrastructure audit is complete.

8. Retention

Cookie consent records: 12 months. Open privacy requests: up to 24 months; resolved requests: 24 months, then deleted or anonymised. Suppression-list entries: kept indefinitely, solely to honour opt-outs. Security/audit logs: up to 12 months. Invoices and accounting records: as long as required by applicable accounting law. Account data: for the life of the account and as required afterwards by legal obligations. Abandoned (unconfirmed) claim or order drafts are purged automatically after 12 months.

9. Your rights

You may contact us at privacy@expolocator.com to request access, correction, deletion, restriction, objection, portability (where applicable) or withdrawal of consent, and to opt out of marketing. We respond within one month. We do not promise automatic fulfilment of every request: some data may be retained where a legal obligation or another applicable basis requires it, and catalog business information about organisations is handled under our Data & Content Policy, which distinguishes organisation data from personal data.

10. Children

The Service is a B2B catalog and is not directed to children. We do not knowingly collect personal information from children under 13 (COPPA) and do not design features for collecting such data.

11. United States

The Service is architecturally ready to display regional supplements for U.S. state privacy requirements. We do not claim blanket compliance with “all U.S. laws”: applicable requirements depend on federal and state law and on the category of data. Where a state-specific supplement applies to you, it will be published as a regional annex to this policy.

12. Security

We apply technical and organisational measures proportionate to the risk: HTTPS, secure/HttpOnly/SameSite cookies, CSRF protection (nonces), prepared statements against SQL injection, output escaping against XSS, password hashing, role-based access, an administrative action log, backups, and keeping secrets out of public repositories.

13. Changes to this policy

Material changes are published as a new version of this document with a new effective date; earlier versions remain available on request.