LaunchKEYL launch pricingPlans for occasional organizers and regular production teams.
View plans →
Legal information

Privacy policy

This policy distinguishes processing needed for the relationship with the publisher from event data managed on behalf of organizations.

1. Controllers and contacts

SASU DEVHAPPY (SIREN 878 766 690), 97231 Le Robert, Martinique, publisher of KEYL, determines processing for account management, contracts, billing, security and commercial relationships. The client organization determines the purposes of processing data about its teams, artists, contributors, suppliers and events; KEYL acts as a processor for this data under contractual instructions.

For event data, first contact the organization that entered it. For KEYL's own processing and requests concerning your data, contact contact@devhappy.fr. The full postal address must be confirmed before final publication.

2. Data and sources

Data may include identity, contact details, account, organization, roles and permissions, subscription, billing and payment references, support requests, activity records and technical connection information. It comes from individuals themselves, organization administrators and providers needed to operate the service.

Depending on the modules, the organization enters contacts, availability, schedules, assignments, documents, transport and hospitality information, incidents, suppliers, inventory, sales and reports. It must inform individuals and collect only what is necessary. This policy alone does not authorize the storage of sensitive data.

Data needed to create an account, secure access or place an order is required for the relevant service. Optional fields and consent to non-essential trackers are not required to access essential features.

3. Purposes and legal bases

  • Account, access, subscription and support: performance of the contract for the contracting individual; legitimate interest in providing the service to the organization for its authorized users.
  • Billing: performance of the contract and statutory accounting obligations.
  • Security, permissions, diagnostics and defense of legal rights: legitimate interest in protecting the service and its users, subject to individuals' rights and freedoms.
  • Direct marketing: consent where required; legitimate interest in permitted cases of relevant professional marketing, with a simple opt-out.
  • Optional analytics and marketing trackers: prior consent, unless a legally applicable exemption has been verified.
  • Event data: legal bases determined and documented by the controller organization; processing by KEYL on its instructions.

Event content is not used for the publisher's own advertising without a specific legal basis and notice. No solely automated decision-making producing legal or similarly significant effects is planned in this version of the service.

4. Recipients and providers

Authorized organization members and publisher personnel who need data for their duties may access it. Shared running orders are accessible to link holders according to the organization's choices.

Stripe processes payments and may act as a separate controller for its own obligations. OneSignal handles push notifications when enabled; browser permission can be revoked in its settings. Hosting and email providers process information needed for their duties. HubSpot is intended to manage cookie consent and, depending on configuration and the individual's choices, analytics or commercial relationship features.

External resources loaded by the browser, including Google Fonts and library distribution networks, may receive the IP address and other technical information. They must appear in the final inventory. Data is disclosed to authorities only under a legal obligation or legally justified request.

5. Location and transfers

Hosting location, the list of subprocessors and countries of access must be confirmed. International providers may process data outside the European Economic Area. Transfers must be covered by an applicable adequacy decision or appropriate safeguards, including standard contractual clauses and necessary supplementary measures. The final version will specify the safeguards actually adopted and how to obtain a copy. This version does not guarantee exclusively European hosting.

6. Retention

Account and organization data is retained during the relationship and necessary end-of-contract operations. Event data follows client instructions and the agreed return and deletion terms. Cancellation may leave read-only access and does not automatically trigger erasure.

Accounting documents are retained for statutory periods, generally ten years. Data needed to defend a legal right is archived with restricted access for the applicable limitation period or duration of the dispute.

Proportionate retention periods for security logs, support exchanges, prospects, backups and data after closure must be set and communicated before final publication. Backups follow their rotation cycle; erasure from the live database does not mean immediate disappearance of all copies. No technical purge timeframe is promised in this version.

8. Your rights

Under the conditions of the GDPR, you have rights of access, rectification, erasure, restriction, portability and objection. You may object to direct marketing at any time and withdraw consent without affecting the lawfulness of prior processing. Under French law, you may give instructions about your data after your death.

Send your request to the controller identified in section 1. Proportionate identity verification may be requested in cases of reasonable doubt. A response is normally provided within one month, extendable by two months for complex or numerous requests, with reasons provided within the first month.

You may complain to the CNIL or the competent authority. Certain rights are limited by legal obligations, third-party rights or the defense of legal rights.

9. Security and updates

Access is organized by accounts, organizations and permissions. The publisher and client implement risk-appropriate measures, protect credentials and limit sharing. Absolute security is not guaranteed. Breaches are handled and notified to controllers, authorities or individuals when required by law.

The policy evolves with processing activities. Material changes are communicated; new consent is obtained where necessary.