1. Who is responsible
The controller of the personal data described in this policy is АФТЪРГРУП ЕООД (Aftergroup Ltd.), UIC 203675688, registered office: Sofia, Bulgaria, 251A Sveti Kiprian St., entrance 1, floor 1 ("Aftergroup", "we"). For anything about your data, write to privacy@aftergroup.org.
2. What this policy covers
This policy covers aftergroup.org, the Aftergroup account (auth.aftergroup.org) and our products Afterbook, Aftermenu and Aftercash, including the sites they run on.
3. Our two roles
We are the controller for data about visitors to our websites, people who contact us, people who create an Aftergroup account, and the contact and billing details of the businesses we work with.
We are a processor for the data venues and other businesses put into our products, for example their guests' reservations, guest lists, deposits and messages, their staff accounts and their sales figures. For that data the business is the controller, its own privacy notice applies, and we process the data only on its instructions under a data processing agreement (DPA). If you are a guest of a venue, please send requests about your booking to the venue. If you write to us, we will pass your request on.
4. What we collect, why, and on what legal basis
| Data | Why we use it | Legal basis (GDPR) |
|---|---|---|
| Account: name, email, profile picture, and the ID of the provider you sign in with (Google, Apple or Facebook) | To create your account, sign you in across our products and keep the account secure | Contract, Art. 6(1)(b) |
| Contact form: name, email, company, topic and message | To answer you | Our legitimate interest in replying to enquiries, Art. 6(1)(f) |
| Product updates form: name, email and the products you pick | To tell you when those products open | Your consent, Art. 6(1)(a), which you can withdraw at any time |
| Business customers: contact persons, company details, invoices and payments | To provide and bill the service and keep accounting records | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Technical data: IP address, browser, device and request logs | To run, protect and troubleshoot the Services | Our legitimate interest in secure, working services, Art. 6(1)(f) |
If you sign in with Apple and choose to hide your email, we receive a private relay address from Apple and use only that.
No law requires you to give us personal data. Without an email address, though, we cannot create your account or reply to you, and a business cannot use our products without the details its contract needs.
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.
5. Where the data comes from
From you, when you fill in a form or create an account; from Google, Apple or Facebook, if you sign in with them, limited to what you allow them to share; and, in our processor role, from the businesses that use our products.
6. Who helps us
We use the following providers to run the Services. Each one processes data only for us, under a contract with data protection terms.
| Provider | What it does for us | Where |
|---|---|---|
| Contabo GmbH | Servers and the databases behind Afterbook, Aftermenu and Aftercash | Germany (EU) |
| Netlify, Inc. | Hosting of our websites and their server functions | USA |
| Okta, Inc. (Auth0) | Aftergroup accounts and sign-in (auth.aftergroup.org) | USA |
| Namecheap, Inc. | Our mailboxes and the transactional email we send | USA |
| Stripe Payments Europe, Ltd. | Card payments and deposits | Ireland (EU) |
| Cloudinary Ltd. | Storage and delivery of images | USA / Israel |
| Cloudflare, Inc. | File storage | USA |
| Omnilinx | Delivery of Viber and SMS messages | Bulgaria (EU) |
| Meta Platforms Ireland Ltd. | WhatsApp messages, where a venue uses WhatsApp | Ireland (EU) |
Google, Apple and Facebook act as separate controllers when you sign in with them, under their own privacy policies. Our websites also load fonts from Google Fonts, which means your browser sends your IP address to Google.
Where data goes outside the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or otherwise on the European Commission's Standard Contractual Clauses.
We may also disclose data when the law requires it, for example to a court or a public authority.
7. How long we keep it
- Account data: while your account exists. When you delete it, we delete your data within 30 days, except what we must keep by law.
- Enquiries: up to 2 years after our last contact, unless they lead to a business relationship.
- Product updates: until you unsubscribe or ask us to delete it.
- Invoices and accounting records: for the periods required by Bulgarian accounting and tax law.
- Technical logs: only as long as needed for security and troubleshooting.
- Data we process for businesses: as the business instructs, and deleted when the service ends, as set out in the DPA.
8. Your rights
You can ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to privacy@aftergroup.org. We answer within one month and may ask you to confirm your identity first.
You may also complain to the Bulgarian data protection authority, the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, cpdp.bg, or to the authority in your own EU country.
9. Security
All traffic to the Services is encrypted (HTTPS). The databases behind our products run on servers in Germany. Access is limited to authorised people with individual accounts, and our systems are monitored.
10. Children
The Services are meant for adults and businesses. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.
11. Changes
We update this policy when our services or the law change. The date at the top shows the current version; for material changes we will give notice on our website.