Privacy Policy
How BizSource collects, uses, and protects your personal data.
Last updated: 18 October 2026.
1. Who we are
BizSource User Group ("BizSource," "we," "us") is a free, volunteer-run, non-profit community for people working with Microsoft Dynamics 365 and Power Platform, operating monthly meetups and one annual event across Serbia, Croatia, and Africa.
This policy covers the BizSource website (bizsourceug.com) and the BizSource mobile app for iOS and Android ("the app").
BizSource is an informal, unincorporated community group, not a registered legal entity. Under GDPR, the data controller is the BizSourceUG organizing team, contactable at info@bizsourceug.com.
Contact for privacy questions: info@bizsourceug.com.
We have not appointed a formal Data Protection Officer, as BizSource's scale does not currently require one under GDPR Article 37.
2. What data we collect
We only collect what we need to run events, forms, and the community platform itself:
- We do not collect payment information. BizSource events are free and the platform does not process payments today. If that changes in the future, this section will be updated to reflect what payment data we collect and how.
| Category | What | Collected when |
|---|---|---|
| Account data | Name, email, password (hashed, never stored in plain text), optional company, job title, LinkedIn, bio, photo, user-group preference, and notification/marketing preferences | You register an account, or sign in with Google, Microsoft, or Apple |
| Sign-in provider identity | Your provider account ID and, for Sign in with Apple, the name and email address Apple shares with us (this can be a private relay address if you choose "Hide My Email"). If you sign in with Apple, we also store a token Apple gives us, used only to revoke our access if you delete your account. We never see your password with Google, Microsoft or Apple. | You sign in with Google, Microsoft, or Apple |
| Mobile app: device and notifications | A push notification token for your device, and the notifications we send you (stored in your in-app notification inbox) | You turn on notifications in the app |
| Mobile app: data kept on your phone | Your sign-in session (in your phone's secure storage), a copy of your ticket and QR code so it works offline, and your saved sessions and followed speakers. This stays on your device and is removed when you sign out or delete your account. | You use the app |
| Event registration | Which events you registered for, your ticket/QR code, and your check-in status and time | You register for or attend an event |
| Check-in (staff only) | When staff scan your ticket, they see your name, company, job title and registration status. If badge printing is on, your name and company are printed on a sticker. The app uses the camera only for scanning tickets; it does not record audio. | You attend an event and are scanned |
| Form submissions | Whatever a specific form asks for (for example, a speaker proposal, sponsor interest, or feedback survey), plus any file you upload to it | You submit a form |
| Session feedback | Your ratings and comments for a session, linked to your name and visible to organisers; organisers may export feedback with your full name. Your feedback is not anonymous. | You submit session feedback |
| Link-click and attribution data | A hashed (not raw) IP address, approximate country and city, device type, browser, operating system, referring page, and which tracked link or channel you came from | You click a BizSource tracked link, or register or submit a form shortly after |
| Usage / product analytics data | Pages viewed, general navigation patterns, device and browser type, and which features you use — pseudonymous, not tied to your name or account | You accept the analytics cookie banner, and continue browsing |
| Support and contact messages | Whatever you send us via the Contact form or email | You contact us |
| Event photos and video | Photos and, in some cases, video of sessions, which may include you if you're visible or audible — see our Terms of Service, section 5, for the full practice and how to opt out | You attend an in-person BizSource event |
3. Cookies
We use a small number of cookies, described in full in our separate Cookie Policy page, linked in the site footer: a session cookie to keep you signed in, a cookie that remembers which link or channel brought you to the site for 30 days (so we can credit the right channel for a registration), and — only if you accept our cookie banner — a privacy-focused analytics cookie that helps us understand overall usage. We do not use third-party advertising cookies. The app does not use cookies. The website cookies described here apply to the website only.
4. Why we process your data, and on what legal basis
Under GDPR, every use of your data needs a lawful basis. Here's ours:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of a contract (our Terms of Service) |
| Sign-in with Google, Microsoft or Apple | Performance of a contract |
| Registering you for events, sending tickets/QR codes, check-in | Performance of a contract |
| Showing check-in staff your name and company at the door, and printing a badge | Performance of a contract (attending the event you registered for) |
| Sending account-related email (verification, password reset, registration confirmation) | Performance of a contract |
| Sending push notifications you have allowed (reminders, schedule changes, registration updates) | Consent (you choose to allow notifications in your device settings and can turn them off there at any time) |
| Sending optional community updates | Consent (you opt in separately from registration) |
| Measuring which social channels drive registrations (link attribution) | Legitimate interest (understanding what promotion works) |
| Preventing spam and bot form submissions (Cloudflare Turnstile) | Legitimate interest (security) |
| Speaker proposals, sponsor interest, feedback forms | Consent (you choose to submit the form) |
| Collecting session feedback attributed to you, so organisers can follow up and improve sessions | Consent (you choose to submit feedback, knowing your name is attached) |
| Server error monitoring (technical diagnostics sent to PostHog) | Legitimate interest (keeping the platform running and secure) |
| Syncing event, attendance, and form data to our internal CRM | Legitimate interest (community relationship management, entirely internal — not shared with third parties beyond our processors, see section 6) |
| Understanding how the platform is used, to improve it (product analytics) | Consent (you accept the cookie banner before any analytics data is collected) |
5. How long we keep your data
Most of this is deleted by hand or on request today. Automated deletion after these periods is not yet built in, so this table states our intended practice.
| Data type | Retention |
|---|---|
| Click and attribution logs | 12 months |
| Form submissions | 24 months, or a shorter period set for that specific form |
| Registration data | For as long as you're an active community member, plus 12 months |
| Account data | Until you ask us to delete it, or after 36 months of account inactivity |
| Notification inbox | 12 months, or until you delete your account |
| Push notification token | Until you sign out of the app, turn notifications off, or delete your account |
| Sign in with Apple token | Until you delete your account (we then ask Apple to revoke it) |
| Session feedback | Same as form submissions (24 months), or until you delete your account |
| Email delivery logs | 6 months |
| Analytics event data (pages viewed, feature usage) | 365 days (PostHog's default retention; not separately configured in our setup) |
| Aggregated/anonymized analytics | Indefinitely (no longer personal data once aggregated) |
| Backups | Our database provider keeps short-term backups, so deleted data can remain in them for a short period after deletion, then disappears automatically |
6. Who we share data with
We never sell your data. We share it only with the service providers that make BizSource run, and only for the purposes above:
- None of these providers may use your data for their own purposes — they process it only on our instructions, under each provider's own standard terms of service. We have not separately negotiated or signed bespoke Data Processing Agreements with any of them beyond what their standard terms already provide.
| Provider | Purpose | Location |
|---|---|---|
| Neon (Postgres database) | Stores all platform data | EU (Frankfurt) |
| Render | Hosts our backend API | EU region |
| Cloudflare | Hosts our website (Workers), stores uploaded files (R2), and provides bot protection (Turnstile) on public forms | R2 storage is EU-region; Cloudflare's edge network is global by design, so a request may be routed through a data center outside the EU on its way to our EU-hosted backend |
| Sign-in with Google, only if you choose that option | Google operates globally; where data leaves the EU/EEA, Google relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | |
| Apple | Sign in with Apple, only if you choose that option; also delivers push notifications to iPhones (APNs) | Apple operates globally; where data leaves the EU/EEA, Apple handles it under its own standard terms and transfer safeguards. |
| Expo (Expo Push Service) | Delivers push notifications to the app. It receives your push token and the notification text (event and registration details, for example "Your event starts tomorrow"). | United States; Expo processes this data under its standard data processing terms. |
| Google (Firebase Cloud Messaging) | Delivers push notifications to Android phones | Google operates globally; EU-U.S. Data Privacy Framework and standard contractual clauses |
| Microsoft | Sign-in with Microsoft, transactional email delivery, and our internal CRM, used to keep a record of event registrations, attendance, form submissions, and speaker/sponsor relationships | Europe (our Microsoft 365/Dataverse tenant is configured in the EU region) |
| Sessionize | We import publicly-available speaker/session information you've already submitted directly to Sessionize as part of our call-for-speakers process — we don't send Sessionize any of your BizSource account data | Sessionize does not publish an exact hosting location; its own privacy policy states data may be processed outside the EEA under safeguards it describes as adequate |
| PostHog | Product analytics, only after you accept the cookie banner. Separately, PostHog receives technical error reports from our servers (which can include technical details of a request that failed) and staff check-in activity, regardless of the cookie banner; these do not track pages you view. | EU (PostHog's EU Cloud, eu.posthog.com) |
7. Your rights
Under GDPR (and equivalent laws where you're based), you can:
- Access the personal data we hold about you
- Correct inaccurate data, or just edit your profile directly
- Delete your account and associated data ("right to erasure"), in the app or by asking us
- Restrict or object to certain processing, including our legitimate-interest uses in section 4
- Port your data to another service in a machine-readable format
- Withdraw consent at any time for anything based on consent, without affecting processing done before you withdrew it
- Complain to your local data protection supervisory authority if you think we've gotten this wrong
8. Exercising your rights
Delete your account in the app. In the app, go to Profile, then Settings, then Delete account. If you signed up with a password you confirm it with your password; if you signed in with Google, Microsoft or Apple you type DELETE. Deletion is permanent and immediate.
What is deleted: your profile; your event registrations, tickets and check-in records; your form and session-feedback submissions and any files you uploaded; your notification inbox and push token; your sign-in links to Google, Microsoft and Apple; and the link-click records tied to your account. We also ask our internal CRM (Dataverse) to delete your contact, registration, check-in and feedback records, and we ask Apple to revoke the token used for Sign in with Apple. Where a provider cannot be reached at that moment, we finish the clean-up by hand within one month.
What we may keep: if you were also a speaker at one of our events, your public speaker profile (name, bio, photo, company) stays on the event pages as a historical record of the event; we remove your email address from it. Records of privacy requests are kept without personal data. Short-term database backups, mail-delivery history in our email provider, and cached copies on a content network can still contain your data for a limited time (see section 5).
Staff and organisers: if your account has an organiser or staff role, or you created events or other content, you cannot delete it in the app. Contact us and we will change your role and transfer the content first.
Other rights and web users: you can also ask us to delete your account, give you a copy of your data, or exercise any right in section 7 from your profile on the website, or by emailing info@bizsourceug.com. We reply within one month, as GDPR requires. Account export is handled by us on request; it is not yet a button in the app.
9. International data transfers
Our core infrastructure (database, backend) is EU-hosted specifically to keep your data in the EU. Some of our processors (Cloudflare's edge network, Google, Microsoft) operate globally and may process data outside the EU as part of their normal service delivery. Where that happens, it's covered by those providers' own Standard Contractual Clauses or equivalent GDPR-approved transfer mechanisms — see the provider table in section 6 for what we've confirmed about each one specifically. Push notifications to iPhones travel through Apple's and Expo's systems, and Expo is based in the United States; the safeguards we rely on are in section 6.
10. Security
We hash passwords and IP addresses (we never store a raw IP address from a link click), use HTTPS everywhere, and host our database and backend in the EU. The app keeps your sign-in session in your phone's secure storage and sends everything over HTTPS. The token Apple gives us when you sign in with Apple is stored only so we can revoke it, and is deleted with your account.
11. Children
BizSource is intended for working professionals and is not directed at children. You must be at least 16 years old to create a BizSource account.
12. Changes to this policy
We'll update the "last updated" date at the top of this page when we make changes. For significant changes we'll tell active members in the app or by email.
13. Contact
Questions about this policy, or to exercise any of the rights in section 7: info@bizsourceug.com.