Privacy Policy

The data controller is BC Planning & Rentals (trading as BCPlanning Events). Identification: BC Planning & Rentals · trading as BCPlanning Events · legal@bcplanning.events.

Contact for privacy requests: legal@bcplanning.events.

This Privacy Policy explains how we process personal data when you use the BCPlanning Events website and account services (the “Service”). It should be read with our Terms and Conditions (/legal/terms) and Cookie Policy (/legal/cookies).

We primarily process personal data of Account holders (customers and planners who register or sign in).

Event records may include guest-related numbers you provide (for example adults, children, infants, or wheelchair-accessible guest counts). Those figures are event planning metadata you submit about attendees; we do not create Accounts for guests or contact guests from those counts alone.

The Service is directed at adults. Accounts require a minimum age of 18, consistent with our Terms. Guest age-band counts are not children’s Accounts and are not used to market to children.

Account and identity data from our authentication provider (Clerk), such as user id, name, and email associated with your Account.

Contact and billing data you submit: contact person and phone, billing name, billing email, billing phone, VAT/NIF number, venue address, and billing address.

Location assistance data when you use address tools: address components and geocoded coordinates (latitude/longitude) and related map/autocomplete interactions via Google Maps / Places.

Event and planning data: event name and type, dates, notes, guest counts (including accessibility-related counts you enter), cart lines, showroom layouts, order snapshots, fulfillment choices, and workflow status.

Payment-related data: payment amounts, currency, status, Stripe session or payment references, and commercial/ops metadata needed to reconcile checkout. Payment card or bank details are typically processed by Stripe as described in section 6; we store payment status and identifiers needed to operate the Service.

Technical and security data: audit trails of Account and event actions, application logs (including when Better Stack log shipping is enabled), IP and device/browser signals as provided by hosting and auth infrastructure, cookie/consent records, locale preference, and Terms-acceptance metadata.

Device storage: the Service uses a local-first model. Event drafts, showroom projects, sync outbox queues, and similar planning data may be stored in your browser (for example localStorage) and synchronised to our database when you are signed in.

Search queries: when AI-assisted catalog search is enabled in an environment, search text you submit may be sent to our search service to return catalog results.

You provide most planning and billing data directly in the Service.

Clerk provides authentication identity and session data when you sign up or sign in.

Stripe provides payment and checkout status updates (including via webhooks) for payments you initiate.

Google Maps / Places may return address suggestions and geocoding results when you use venue address features.

Our operators may update event status, logistics, commercial terms, or payment records through authenticated backoffice integrations that act on events you created.

We process personal data only for specified purposes and on a GDPR lawful basis:

Account creation, authentication, event planning, showroom/cart sync, availability workflows, and customer support needed to provide the Service — Art. 6(1)(b) (contract / steps prior to contract).

Payments, invoicing, VAT records, and related accounting — Art. 6(1)(b) and, where tax or bookkeeping rules require retention or disclosure, Art. 6(1)(c) (legal obligation).

Security, fraud prevention, abuse detection, debugging, and service integrity (including logs and audit trails) — Art. 6(1)(f) (legitimate interests). Our interests are protecting the Service, users, and business against misuse; these interests are balanced against your rights.

Essential cookies, session security, Terms-acceptance records, and (after you accept the cookie banner) locale preference storage — as described in the Cookie Policy; typically Art. 6(1)(f) and/or consent where ePrivacy rules require consent for non-essential storage.

Compliance with lawful requests and establishment, exercise, or defence of legal claims — Art. 6(1)(c) and/or Art. 6(1)(f).

Visitor country/city analytics: if you choose Accept all on the cookie banner, we process approximate geolocation derived from IP (country, city, region), page path, locale, a hashed IP, visitor id, and optional Account id — Art. 6(1)(a) (consent). See the Cookie Policy.

We do not use personal data for third-party advertising. We do not sell personal data. We do not send marketing emails unless you give a separate consent or another lawful basis clearly applies; transactional messages about your Account or events are not marketing.

We share personal data with service providers that process data on our instructions (processors), under data-processing terms where required:

Clerk — authentication and Account identity.

Bunny — database hosting and related infrastructure for events, carts, payments metadata, and catalogs.

Google — Maps / Places for address autocomplete, map pin, and geocoding on event address flows.

Better Stack — application log shipping when BETTER_STACK credentials are configured in that environment.

Search infrastructure — when AI catalog search is enabled, query text may be processed by our search service to return results.

Stripe — payment processing. Stripe may act as an independent controller for payment-method data it collects directly from you, and as a processor for merchant metadata we send to create and reconcile Checkout Sessions. See Stripe’s own privacy notice for card/bank instrument processing.

Internal recipients: authorised personnel and contractors who operate customer support and backoffice workflows (status, logistics, commercial terms, payments) under confidentiality and access controls.

Visitor geo analytics storage: Bunny database table for consented visit location events (see Cookie Policy).

We maintain processor arrangements (including DPAs) with providers as required. A current list of core providers is stated above; material changes will be reflected in an updated Privacy Policy version.

We are established in Portugal (EEA). Some providers (including Clerk, Stripe, Google, and Better Stack) may process personal data in the United States or other countries outside the EEA/UK.

Where personal data is transferred outside the EEA/UK, we rely on appropriate safeguards, typically the provider’s Data Processing Addendum and EU Standard Contractual Clauses (SCCs), and/or an adequacy decision where one applies.

Hosting and database regions depend on our Bunny and infrastructure configuration for each environment. You may ask us for more detail about the transfer tools applicable to your data.

We keep personal data only as long as needed for the purposes above, including legal retention duties:

Account and authentication data — for the life of the Account, then deleted or anonymised within a reasonable period after closure unless a longer period is required for security, disputes, or law.

Event, cart, showroom, order snapshot, and audit data — for the life of the related planning/commercial relationship and thereafter as needed for support, disputes, and legal claims (typically up to the applicable limitation periods).

Payment and invoicing-related records — for the periods required by Portuguese tax and accounting rules (commonly up to 10 years for certain accounting records), even if you request erasure of other data.

Application logs — retained for a short operational window needed for security and debugging (generally weeks to a few months, depending on log configuration), unless needed longer for an incident investigation.

Browser local storage — remains on your device until you clear site data or the application removes it; server copies follow the retention rules above once synchronised.

Cookie consent and Terms-acceptance records — retained as evidence of compliance for as long as reasonably necessary.

Visitor geo analytics events — retained for internal traffic analysis, typically up to 24 months, then deleted or aggregated, unless needed longer for security or legal claims.

Details of essential cookies and local storage are in our Cookie Policy (/legal/cookies).

In short: we use essential authentication/session storage, consent and Terms version records, locale preference after you accept essential cookies, and signed-in planning data in local storage required for the workspace. Google Maps scripts load on authenticated address flows (or after essential consent as described in the Cookie Policy).

We apply technical and organisational measures appropriate to the risk, including HTTPS encryption in transit, authenticated access to Account APIs, separation of backoffice machine credentials from customer sessions, and least-privilege access for operators.

No method of transmission or storage is completely secure. Please protect your Account credentials and contact us promptly if you suspect unauthorised access.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Art. 22.

Workflow automations (for example payment status updates from Stripe webhooks or stock/availability status changes) support human-operated commercial processes and do not replace a creditworthiness-style automated refusal about you as a person.

Subject to Portuguese and EU data-protection law, you may request access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Erasure may be refused or delayed where we must retain data for legal obligations (for example invoicing) or for the establishment, exercise, or defence of legal claims.

To exercise your rights, email legal@bcplanning.events from the address associated with your Account (or otherwise prove your identity). We will respond within one month of receipt, or inform you if we need more time as permitted by Art. 12 GDPR.

You may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s supervisory authority, or with your local EEA supervisory authority if you live in another Member State.

We may update this Privacy Policy from time to time. The version identifier (2026-08-05.2) and “last updated” date appear at the top of this page.

Material changes will be posted on this page. Where required, we may also notify you through the Service or by email. Continued use of the Service after an update means you should review the new text; Account Terms acceptance remains governed by the Terms version gate where applicable.

Privacy contact: legal@bcplanning.events.

Controller identification: BC Planning & Rentals · trading as BCPlanning Events · legal@bcplanning.events.