Privacy notice for users of the EAA Commercial Hub

1. Who is responsible

The Hub is the shared commercial platform of the ten independent agencies that form European Activation Agencies (EAA): A10 (Spain & Portugal), Highjam (United Kingdom & Ireland), Up! (Italy), St-Promotions (Germany & Austria), Jïz Marketing (France), Monsterscore (Netherlands & Belgium), Fieldstar (Romania & South-East Europe), Promokant (Switzerland), Rider Eventmarketing (Nordics) and Touch Events (Turkey). EAA itself is not a company.

The agencies decide together why and how the Hub processes data, which makes them joint controllers. The arrangement that sets out their respective responsibilities (Article 26 GDPR) is being prepared; its essence will be published here.

A10 (MABERT ID MÁS E SL, Spain) operates the Hub for the network and is the single point of contact for this notice: privacy@activation-agencies.eu. You may also contact your own agency.

2. What data about you

Your account

Name, work email address, agency, role (user, admin, superadmin), language, whether you are your agency's Commercial Champion, whether your account is active.

Signing in

Your password (only as a one-way hash, held by the authentication service), the one-time codes sent to you (only as a salted hash), the IP address that requested a code, the date of your last sign-in.

Security

A log of changes made in the Hub (who changed what and when). Short-lived, hashed records used to limit repeated password-reset and invitation attempts.

What you enter

Anything you type or upload: projects, case studies, rates, quotes, referrals, client and contact records, photos and videos.

Votes

The topics you are invited to vote on and the vote you cast. In a public vote the invitees see each person's vote once voting closes; in a secret vote they see totals only, and the superadmin can open individual votes if needed, which is itself logged.

3. Why, and on what legal basis

Giving you access and running the platform

Legitimate interest of the member agencies in cooperating commercially across Europe (Article 6(1)(f)). Your agency gives you access as part of your work.

Keeping the Hub and its data secure

Legitimate interest in protecting the platform and the agencies' information (Article 6(1)(f)), and the duty to secure personal data (Article 32).

Keeping commercial records

Legal obligations to keep commercial documents such as quotes and referral fees (Article 6(1)(c)).

4. Who can see it

People in your own agency see your name and role. The whole network sees the name and work email address of each agency's Commercial Champion. The superadmin at A10 sees all accounts in order to operate the Hub. Your changes are recorded in the log, which only the operator of the Hub can consult.

Service providers process the data only on the network's instructions: Supabase (database, sign-in and file storage, hosted in the EU, Ireland), Vercel (hosting of the web application, run in the EU, Dublin) and Resend (delivery of sign-in codes and invitations).

5. Transfers outside the EU

Resend stores the details of the emails it sends (recipient, date, delivery status) in the United States; it is certified under the EU–US Data Privacy Framework. Supabase and Vercel are United States companies hosting this data in the EU; their data processing agreements include the EU standard contractual clauses.

Users at member agencies outside the EU access the Hub from their country: the United Kingdom and Switzerland are covered by EU adequacy decisions; for Turkey, standard contractual clauses are being put in place.

6. How long it is kept

Sign-in codes and the IP that requested them

7 days

Records of a session having passed the code

1 day after the session ends

Reset and invitation rate limits (hashed)

1 day

Invitations

30 days after they are accepted or expire

Change log

24 months

Your account

While you work with the Hub. An account deactivated for 12 months is deleted.

Quotes and referral fees

6 years (commercial records)

Votes

Kept as the network's record of its decisions. If your account is erased, your vote stays in the count without your name.

7. Your rights

You can ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format, and you can object to processing based on legitimate interest. Write to the contact above or to your agency; you will receive an answer within one month. Your language setting and name can be changed at any time in Settings.

You may complain to a data protection authority, in particular in the country where you live or work — in Spain, the Agencia Española de Protección de Datos (aepd.es).

8. Cookies and browser translation

The Hub uses only the cookies it needs to keep you signed in. There are no analytics, advertising or tracking cookies, and the pages load nothing from third parties.

Your browser's "translate this page" feature may send the page text to the translation provider. Tables with client names, contacts and prices are marked not to be translated; please do not use browser translation on the Hub — choose your language in Settings instead.