Privacy Policy

01Who we are

iEvent ("iEvent", "we", "us") is a platform for discovering events and booking tickets in Iraq. It is operated by Hillool OÜ, a company registered in Estonia under registry code 16212483, at Pärnu mnt. 139B (3rd floor), 11317 Tallinn, Estonia (the "Company").

This policy explains how we handle your personal data when you use the iEvent website and app (together, the "Platform"). Because the Company is established in the EU, we apply the standards of the EU General Data Protection Regulation (GDPR) in addition to applicable Iraqi law. Hillool OÜ is the data controller.

02Information we collect

Account

Name, email, phone number (optional), and password, or your Google account if you sign in with Google.

Tickets & bookings

Tickets you buy, QR codes, order history, and events you've saved or followed.

Payment data

Payments are processed by ZainCash, FIB/FastPay, Qi Card, or Visa/Mastercard, or paid in cash directly to the organizer at the door. We do not receive or store your full card details.

Organizer data

For organizers, in addition to the above: business or event details, and the payout details used to receive your earnings.

Device & usage

Device type, browser, language, approximate city, and how you interact with the Platform.

03Payments & tickets

iEvent is a platform connecting attendees with organizers. We do not collect ticket payments and do not hold your funds. When you buy a ticket, payment goes to the organizer, through a third-party payment provider, or in cash at the door, and iEvent only charges a service fee to the organizer (currently waived during our beta period).

As a result, refunds and cancellations are handled by the organizer under their own policy (see our Terms of Use). We keep a record of your tickets and orders so you can access them and show your entry code.

04How we use your information

• Create and manage your account, and sign you in securely
• Show events, issue tickets and QR codes, and enable entry at the door
• Let organizers publish events, manage attendance, and receive their earnings
• Send order confirmations, tickets, and the notifications you've opted into
• Provide support, prevent fraud and abuse, and keep the Platform secure
• Improve the Platform using aggregated, anonymized data
• Comply with legal obligations

We do not use your data for advertising, and we never sell or rent it to anyone.

05Legal bases (GDPR)

• Contract, to provide the Platform, your account, and ticket issuance.
• Legitimate interests, to secure the Platform, prevent fraud, and improve the service.
• Consent, for optional marketing, such as our newsletter, which you can withdraw anytime.
• Legal obligation, where we must retain or disclose data.

Local Iraqi rules on data protection and electronic transactions may also apply; these aspects are subject to review by local legal counsel.

06Who we share your data with

We share data only with the service providers ("sub-processors") needed to run iEvent, each bound to protect your data and use it only on our instructions:

ZainCash, FIB/FastPay, Qi Card, Visa/Mastercard

Payment processing

Hosting

Website and database hosting (DigitalOcean)

Analytics

Aggregated usage analytics (Google Analytics)

Organizers

When you buy a ticket, we share the details needed to fulfil your attendance (e.g. your name, ticket type), see Section 7.

This list covers our main providers and is not necessarily exhaustive. We may add or replace providers as the Platform evolves, and will update this policy on any significant change. We will never sell your data, and may disclose it if required by law or to protect our rights and users' safety.

07Organizers & attendees

iEvent is a two-sided platform. When you attend an event, the organizer acts as an independent data controller for the attendance information they receive from you to run their event (e.g. guest lists and check-in). As an organizer, you are responsible for handling attendee data lawfully.

iEvent does not control how organizers use that data outside the Platform, we recommend reviewing an organizer's own privacy notice where relevant. Your iEvent account data always remains governed by this policy.

08International data transfers

The Platform is operated by a European company and serves users in Iraq, so your data may be transferred between Iraq, the EU, and the locations of our service providers. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as Standard Contractual Clauses.

The specifics of transfers to and from Iraq are subject to review by local legal counsel.

09How long we keep your data

We keep your data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within 30 days, except where certain records (such as transaction and invoicing records) must be retained to meet legal or accounting obligations. Aggregated, anonymized data may be kept indefinitely.

10Your rights

You may have the right to access, correct, delete, and export your data, to restrict or object to processing, and to withdraw marketing consent. To exercise these rights, contact us at the email below.

EU users may also lodge a complaint with the competent data-protection authority (in Estonia: Andmekaitse Inspektsioon). Users in Iraq may also turn to the competent local authorities where available.

11Security

We use technical and organizational safeguards, including encryption in transit and access controls, to protect your data, and we never receive your full card details, as these are handled by our payment providers. No method is perfectly secure, but we work continuously to protect your information and will notify you of any breach as required by law.

12Age

iEvent is intended for people aged 18 or older, because the Platform involves buying tickets and may list age-restricted events. We do not knowingly collect data from anyone under 18. If you become aware of this, contact us and we will delete it.

13Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date and, for significant changes, notify you via the Platform. Continued use after an update means you accept the revised policy.