Privacy Policy

The controller for Bandaa’s own processing is Jason Suárez, micro-entrepreneur. Address: 20 rue de la République, Paris, France.

For a question or to exercise a right: jason.h.suarez@gmail.com or 06 32 79 42 65.

Depending on the features used, Bandaa processes a pseudonymous session identifier, the event code and members, nickname, role and language, photos and useful metadata, reports and removal requests, support exchanges, and data needed for notifications and the Organiser Pass.

Location is optional and used only when you allow it for the relevant capture. Bandaa does not create a public profile and does not use facial recognition in V1.

This data is used to create or join an event, secure access, show photos to authorised members, produce the Book, handle removals and reports, prevent abuse, measure the service’s technical cost, send requested notifications and manage an in-app purchase.

The legal basis depends on the processing: providing the requested service, legitimate interest for security, a legal obligation or consent for an optional choice when required. Refusing optional data does not prevent essential event use, but may prevent the related feature.

Photos are visible to authorised participants in their event and may appear in its memory Book. They are not intended for open publication.

Service providers may receive data matching their role: application hosting, photo storage, notifications and in-app purchase. Bandaa does not sell data or add behavioural advertising.

Some providers may process data outside the European Economic Area, with applicable safeguards for international transfers.

Unselected original photos expire at the end of the event plus 7 days. Confirmed photos remain stored while the event exists, unless explicitly removed.

When a photo is removed, its visibility is immediately cut off in new views and the object is kept privately for audit and moderation, then physically purged within 90 days. Logical retention, visibility and physical purge are distinct. Minimal logs needed for security, moderation or proof of a request may be retained separately.

Deleting an organiser account deletes its events and associated media. Deleting a participant account anonymises participation, but photos already shared may remain in the event. Copies exported or saved in a phone gallery are not deleted by Bandaa.

Under the GDPR and applicable rules, you may request access, correction, erasure or restriction, object to certain processing and request portability where that right applies. You may withdraw consent where processing is based on it.

Write to jason.h.suarez@gmail.com, stating the event, photo or account concerned. Bandaa may request only the information strictly needed to verify the request. You may also contact the CNIL or the competent authority.

The site may use the language-preference cookie NEXT_LOCALE. This policy therefore does not claim that no cookies exist. These pages add no advertising or behavioural tracking.

Version 1.0, effective August 20, 2026. Privacy contact: jason.h.suarez@gmail.com.