Privacy Policy

Before you read any further

This is the first version of our privacy notice, published on 19 September 2026, and this is version 1.3. It was read against Belgian and EU law on 24 September 2026 by our own legal function -- we have no outside counsel -- and this version makes every change that reading required. The passages that name Bicyr Cangor were added in version 1.2, on 25 September 2026, after that reading, and have not yet been read against the law in the same way. Section 5, on Google account data, was added in version 1.3, which takes effect on 30 October 2026, and has not yet been read against the law in the same way either. Where something is not yet decided or not yet built, this notice says so rather than describing something we do not do.

1. Who is responsible for your data

The platform is operated by Pilarres EOOD ("ПИЛАРРЕС" ЕООД), a single-member limited liability company entered in the Bulgarian Commercial Register under ЕИК (UIC) 208702712, VAT number BG208702712, with its registered office at гр. Пловдив 4000, р-н Централен, ул. 6-ти Септември № 152, Легис център, офис 3-8Б (ul. 6-ti Septemvri No. 152, Legis tsentar, ofis 3-8B, 4000 Plovdiv, Bulgaria). Telephone +32 485 02 94 23. E-mail info@bicyr.com.

We have not yet determined whether a Bulgarian company selling to Belgian consumers also needs an establishment or a representative in Belgium. If it does, we will publish a new version of this document and say what changed.

Who is responsible depends on what you are doing. When you hold a Bicyr account, and for the security and operation of the platform itself, we are the controller of your data. When you take part in an event -- you follow an invitation, you are on a guest list, you buy a ticket -- the organiser of that event is the controller of the data you give and of what is recorded about your attendance, and we handle it on the organiser’s instructions.

That division is our reading of the law, recorded on 24 September 2026. The written agreement with organisers that must accompany it is, on Bicyr Cangor, part of the organiser terms, which an organiser accepts before taking payments or publishing its first paid event. For an organiser who has not accepted them, that agreement is not yet in place, and we are telling you so rather than presenting it as settled.

We have not appointed a Data Protection Officer, and our reading of 24 September 2026 is that the law does not require one today: we are not a public body, we do not carry out large-scale regular and systematic monitoring of people, and we do not collect special categories of data (see section 2). We will make that determination again before we start collecting any such data, and if a Data Protection Officer is appointed we will publish the contact details here. Until then, use the contact details above.

2. What we collect

If you hold a Bicyr account: your e-mail address, which is how you sign in -- there is no password -- and, if you give them, your name, an avatar and your preferences. We store the one-time codes and sign-in links we send you as irreversible digests rather than as themselves, together with your two-factor secret and backup codes if you set them up. For each session we record the network address it came from and the browser it used, and we keep a log of security events on your account, such as signing in or changing a factor.

If you take part in an event: the invitation link you followed, stored only as a digest; a short-lived cookie that opens the participation record the link points at and carries no name or address inside it; and, if you order, your e-mail address and mobile number, what you bought, the price you were shown and paid, and the version of the terms that applied.

If you buy a ticket through Bicyr Cangor, you buy as a guest: your purchase is recorded against the e-mail address and mobile number you give, not against a Bicyr account. What is processed about that purchase, why, who receives it, how long it is kept and how to use your rights are set out in full in the privacy notice for ticket purchases at cangor.bicyr.com/legal/ticket-privacy, which names the organiser of the event as responsible for it. The companies that process it for us are listed at cangor.bicyr.com/legal/sub-processors.

Not everything comes from you. If someone invites you, or puts you on a guest list, we receive your name and the contact details they give from that person, or from the organiser of the event.

Some of this is required. We need your e-mail address to create an account, and your e-mail address and mobile number to take an order and deliver your tickets. Without them we cannot provide the account or the order. Everything else is optional.

Data about your health, your beliefs or your access needs -- a dietary requirement, an allergy, a concession such as a companion or an accessible position -- is special under the law and needs your explicit consent, separately given and freely withdrawable. We are not collecting it. The place to record it exists in our systems and the consent step that must come first does not, so nothing writes to it, and no event on this platform may ask you for it until that step is built.

Your card or bank details go straight to our payment provider and never reach us. We hold a reference to the payment, its amount and what happened to it.

We use no analytics and no error-tracking script of any kind, on any of our sites. We do not use facial recognition or any other biometric identification, at a door or anywhere else.

3. Why we use it

To create and secure your account, to sign you in and to let you recover it: because you asked us to provide the account, and because we and you have an interest in it being secure. To sell and deliver a ticket and keep the record of the payment: because it is needed for the contract, and because bookkeeping and tax law require the record. To let an organiser run an event you were invited to, including invitations and reminders: because the organiser has a legitimate interest in doing so, and you may object.

We send no marketing. There is no newsletter, no marketing consent and no pre-ticked box anywhere in our systems. If that ever changes we will ask you first.

We never sell attendee data, and we do not build profiles of people across different organisers.

We make no decision about you by automated means alone that has a legal or similarly significant effect on you.

4. Who else sees it

Besides the organiser of the event you are attending:

We share nothing with advertisers or data brokers. Within an organiser’s own team, a buyer’s contact details are visible to the person who runs the workspace rather than to everyone in it.

5. Google account data, if you connect a Google account

When you connect a Google account to Bicyr Cangor, we ask for read-only access to the list of your calendars and their events, and to the individual Google Sheets files you choose in the Google file picker. We never see the rest of your Google Drive, and we never create, change or delete anything in your Google account.

We use this data only to show you items to import, and to import the events or rows you select into your Bicyr Cangor workspace. We do not use it for advertising, we do not sell it, and we do not transfer it to others except as needed to provide this feature, to comply with the law, or with your consent. People at Bicyr do not read it, except with your consent, for security, or to comply with the law. We do not use it to develop, improve or train generalised artificial intelligence or machine-learning models.

We use it because you asked us to: connecting the account and choosing what to import is the service you request, which is our legal basis. The access we store for your Google account is kept until you disconnect. The events and rows you import become part of your Bicyr Cangor workspace, stay there after you disconnect, and are kept and deleted like the rest of your workspace (section 7).

You can disconnect at any time in your Bicyr Cangor workspace, or at myaccount.google.com/permissions. Disconnecting erases the access we stored for your account, and we ask Google to end the access too.

Bicyr Cangor’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Where it is kept, and where it goes

Our services run in the European Union: the containers and workers that serve this platform are pinned to the EU, and the database requires an encrypted connection and is reachable by a single restricted account.

Some processing happens outside the EU, and we say so rather than making a blanket promise we would have to break. Our transactional e-mail is not EU-resident: a message may be held by our e-mail provider for about a week, outside the EU, which is why our e-mails carry only your address and a link and never the details behind it. Payment processing and map tiles also involve companies in the United States. For each of those we rely on the European Commission’s standard contractual clauses, and, where the recipient is certified, on the EU-US Data Privacy Framework. You may ask us for a copy of these safeguards using the contact details in section 1.

7. How long we keep it

We keep your data only as long as we need it, by these criteria. Your account data, for as long as your account exists: an account that has not been used for 36 months is erased, and we write to you 30 days before that happens. The security records of your account, only as long as they are needed to protect it. Order and payment records, for as long as bookkeeping and tax law require. What is recorded about your attendance at an event, on the organiser's instructions and no longer than the organiser needs it. Where a period has been set, our systems now apply it automatically; where it has not yet been set, nothing deletes that data on a schedule yet, and we will publish the period here when it is.

A ticket bought through Bicyr Cangor is the exception to the sentence above about periods applied automatically. Its periods have been set, and are stated in the privacy notice for ticket purchases at cangor.bicyr.com/legal/ticket-privacy, but nothing in that part of the platform yet deletes the data when they end.

8. Your rights, and what we can actually do today

You have the right to see the data we hold about you, to have it corrected, to have it erased, to restrict what we do with it, to receive a copy in a portable form, to object to processing we base on a legitimate interest, and to withdraw any consent you have given without that affecting what was done beforehand.

Here is what happens today when you ask. Our systems can record your request, and they cannot yet carry it out: there is no automatic export, and nothing in the platform deletes an account or an order. Every request is therefore handled by a person, by hand, within the month the law allows, and we will tell you what was done and what, if anything, we had to keep and why. We are building the automatic route, and until it exists we would rather tell you this than let you assume a button does it.

To ask, use the contact details in section 1, or, for data an organiser holds about your attendance, ask the organiser; you may also ask us and we will pass it on.

You may also complain to a data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Rue de la Presse 35, 1000 Brussels. In Bulgaria, where our company is established, it is the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia. You may also complain to the authority of the country you live in.

9. Children

This platform is not directed at children. A guest list may contain a child entered by the person inviting them, and the organiser is responsible for that. We do not knowingly collect a child’s data for our own purposes, and we collect no date of birth anywhere. The minimum age at which someone may hold an account of their own differs between Belgium and Bulgaria, and we have not yet settled which rule we apply; we will state it here when we have.

10. Security

Card details never touch our systems. Signing in is by a one-time code or a link, with optional two-factor authentication, and the codes and links are stored as digests. Our services run in the EU, the database requires an encrypted connection and is audited, and uploaded media is copied to a second European location. If a breach is likely to put you at high risk, we will tell you without undue delay.

11. Changes

We publish changes here with the version and the date. Where a change affects the basis on which we use your data, we will tell you before it takes effect.