Privacy and Data Protection

1. Controller and contact

The data controller is:

No Data Protection Officer has been appointed. Privacy requests can be sent to contact@m8hub.ro.

2. Personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

We may receive this information through our website and checkout, forms, email, telephone, SMS, WhatsApp or other messaging services, social-media messages, events, in-person conversations, or from an organizer or other person who is authorized to provide it. The source does not, by itself, give us permission to use the information for every purpose or contact channel.

2.1 Identity and contact data

• Name;
• Company name;
• Job title;
• Email address;
• Phone number;
• Billing details;
• Address;
• CUI or other company identification details, where applicable.

2.2 Booking and event data

• Booking date and time;
• Event type;
• Number of participants;
• Requested services;
• Venue setup preferences;
• Catering preferences;
• Special requirements;
• Communication history;
• Guest or participant information, if provided.

2.3 Payment and transaction data

• Payment status;
• Amount paid;
• Invoice details;
• Transaction references;
• Payment method.

Card data is processed by payment processors such as NETOPIA Payments, where applicable. m8 hub does not store full card details on its own servers.

2.4 Website and technical data

• IP address;
• Browser type;
• Device information;
• For an order, the referring page, non-sensitive URL campaign parameters (such as UTM tags), browser language and time zone, request language, IP address, and browser/device headers;
• Pages visited;
• Cookies and analytics data;
• Website usage data;
• Security logs.

2.5 Marketing and communication data

• Newsletter preferences;
• Future-event signup details, including your name, email address, optional phone number, signup page, and consent record;
• Event invitations;
• Consent records;
• Responses to campaigns or forms.
• Campaign delivery and engagement data, including open signals, link destinations and click timestamps.

2.6 Media data

When an event or venue activity is photographed, filmed, recorded, or livestreamed, we may process:

• Photos, video recordings, audio recordings, and livestream footage;
• Your image, voice, name, role, or other information visible or audible in that material;
• Testimonials, interviews, and event images;
• Information needed to record and act on a media preference, objection, consent, or request.

3. Purposes and legal bases of processing

We process personal data for the following purposes:

• Handling booking requests and venue reservations — contract performance or steps before entering into a contract;
• Providing venue, event, hospitality, and logistics services — contract performance;
• Payment processing and invoicing — contract performance and legal obligation;
• Accounting and tax records — legal obligation;
• Responding to inquiries, preparing offers, managing bookings and events, sending payment or service notices, and providing support — steps before a contract, contract performance, or our legitimate interests in answering and administering requests; we may use the contact channels you provide or use to reach us, including email, telephone, SMS, WhatsApp, or comparable messaging services, where appropriate and lawful;
• Website security and fraud prevention — legitimate interest;
• Improving services and website functionality — legitimate interest;
• Recording the page and campaign source of an order, supporting checkout, and preventing payment abuse — contract performance and our legitimate interests in understanding order sources and protecting the checkout; order source and technical request details are saved with the payment record and are not cookies;
• Sending newsletters, offers, invitations, and future-event updates by email and, where a phone number was supplied for this purpose, by SMS, WhatsApp, or telephone — your specific consent or another exception expressly allowed by applicable communications law; a booking, inquiry, event attendance, or provision of contact details alone is not marketing consent;
• Measuring email campaign delivery and engagement for active marketing subscribers and for transactional event messages sent to paid purchasers through remote-image load signals and campaign-specific links. When an email image loads or a tracked link is clicked, we may receive the recipient’s campaign identifier, IP address, browser/device information, timestamp, and (for a click) the destination. We use these signals to understand which messages and links are useful, improve future campaigns, and measure campaign performance. Open signals are approximate and may be triggered by privacy features or automated image loading;
• Emailing existing customers about our own similar services where the narrow customer exception applies, only if the address was obtained directly during a sale and a simple, free opt-out was offered when it was collected and in every message;
• Documenting our events, venue, community, and services — our legitimate interests in operating, documenting, and promoting m8 hub, provided those interests are not overridden by your rights and freedoms;
• Publishing contextual event photos, video, audio, or livestream material to promote m8 hub and future events — our legitimate interests where applicable, subject to a balancing assessment and your right to object;
• Using a testimonial, interview, or a prominent identifiable portrait or feature for marketing — consent where required, or another valid lawful basis where applicable;
• Handling legal claims or disputes — legitimate interest and legal obligation.

4. Recipients and processors

We may share personal data with trusted recipients and processors, including:

• Payment processors, including NETOPIA Payments where applicable;
• Website hosting providers;
• Email service providers;
• Booking, CRM, analytics, and form tools;
• Accounting and invoicing service providers;
• Catering or event vendors, where required for service delivery;
• IT, security, and technical support providers;
• Photographers, videographers, production teams, designers, and media-storage providers engaged for an event or campaign;
• Social-media, video-hosting, press, and advertising platforms when we publish event content;
• Legal, accounting, or professional advisors;
• Public authorities, courts, or regulators where required by law.

We do not sell personal data.

5. Transfers outside the EEA

Some service providers may process data outside the European Economic Area.

Where this happens, we aim to ensure appropriate safeguards are in place, such as Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms under GDPR.

6. Retention periods

We keep personal data only as long as necessary for the purposes described in this Policy.

Typical retention periods include:

• Booking and communication data: for the duration needed to provide the service and handle follow-up, claims, or disputes;
• Accounting and invoice records: according to Romanian legal and tax requirements;
• Payment records and the checkout source/technical details saved with them: retained with the related payment record for the periods needed for contract administration, accounting, fraud prevention, and legal claims;
• Active marketing subscriptions: while the permission remains valid and the information is needed for the subscribed purpose, including until you withdraw consent or object, subject to periodic review; withdrawal or objection stops marketing use but does not automatically erase records needed for another lawful purpose;
• Suppression and consent records: the minimum information and history reasonably needed to honor a withdrawal or objection, avoid sending further marketing, demonstrate the basis for earlier messages, or address a legal claim, retained only as long as necessary for those purposes;
• Recipient-level email campaign identity and engagement events, including IP addresses and browser/device information: for up to 12 months after a campaign send; after that, the recipient mapping and engagement events are deleted, while anonymous campaign totals may remain;
• Website analytics data: according to cookie settings and analytics tool retention periods;
• Security logs: for a limited period necessary for security and fraud prevention;
• Event media and the records supporting its lawful use: while the material remains relevant to documenting or promoting m8 hub, subject to any valid objection, withdrawal of consent, legal obligation, or request that requires deletion, restriction, or another response under applicable law.

Where a longer retention period is required by law or necessary for legal claims, we may retain the relevant data for that period.

A marketing withdrawal does not cancel an existing booking or prevent service, payment, safety, or legally required communications. We do not keep every item ever received until a person asks us to delete it: each category remains subject to its purpose, necessity, applicable retention duties, and your rights.

7. Your rights

Under GDPR, you may have the following rights:

• Right of access;
• Right to rectification;
• Right to erasure;
• Right to restriction of processing;
• Right to data portability;
• Right to object;
• Right to withdraw consent where processing is based on consent;
• Right to lodge a complaint with a supervisory authority.

To exercise your rights, contact:

We may need to verify your identity before responding.

Where we rely on legitimate interests for media processing, you may object at any time on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or we need the material for legal claims. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing that was lawful before it was withdrawn.

You may withdraw consent to direct marketing or object to direct marketing at any time, without giving a reason, by using an unsubscribe method provided in a message or emailing contact@m8hub.ro. We will stop marketing covered by your request across the relevant channels. If you later make a new, affirmative signup with a clear notice of the purpose and channels, that new permission replaces the earlier withdrawal only for the subscription and channels you choose. A later purchase or inquiry alone does not reverse your choice. We keep a record of both choices and do not treat the earlier marketing as retrospectively authorized.

8. Cookies

m8hub.ro may use cookies and similar technologies, including:

• Essential cookies required for website functionality;
• Analytics cookies;
• Marketing or remarketing cookies;
• Preference cookies.

Where required by law, non-essential cookies will only be used with your consent through a cookie banner or consent management tool.

You can manage cookies through the website banner, browser settings, or other available controls.

9. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

These may include:

• HTTPS/TLS encryption;
• Access controls;
• Secure payment processing;
• Limited access to personal data;
• Backups and security monitoring;
• Use of reputable service providers.

No online system is completely secure, but we take data protection seriously and aim to reduce risk appropriately.

10. Minors

m8 hub is primarily intended for adults, companies, professionals, and business users.

If a booking or event involves minors, the client is responsible for obtaining all required parental, guardian, school, or organizational permissions and for supervising minors appropriately.

11. Photos, video, and media at events

Unless an event is expressly identified as no-capture, m8 hub events and venue activities may be photographed, filmed, audio recorded, or livestreamed. We give notice through the applicable event information, these Terms and this Policy, and may also use venue signage or staff announcements. Media may show attendees incidentally in a crowd, activity, or venue scene, or may capture a participant’s image or voice more directly.

For event documentation and contextual coverage, including reasonable promotional use of wide-angle or activity-based material, we may rely on our legitimate interests after considering the nature of the event, the reasonable expectations created by advance notice, the prominence of the individual, and the impact on their rights and freedoms. For uses that require consent, including where an individual is the prominent subject of a marketing feature or testimonial, we will seek consent from that individual. We do not treat a ticket purchaser’s acceptance of the Terms as consent on behalf of another adult attendee.

A person who wishes not to be identifiable should contact contact@m8hub.ro before the event or speak to a member of staff on arrival. We will consider reasonable, proportionate measures, such as avoiding a close-up or offering a practical alternative where available. Because live events and crowd scenes are dynamic, we cannot guarantee that a person will not appear incidentally in background footage or photographs.

You may object to processing based on legitimate interests, or withdraw consent where consent is the basis, by emailing contact@m8hub.ro. We will assess the request under applicable law. A withdrawal of consent does not affect the lawfulness of prior use, and an objection or withdrawal does not automatically require retrospective editing of every group image, archived record, printed item, or publication; however, we will take the action required by law after considering the request, technical feasibility, publication context, retention duties, and any compelling legitimate grounds or legal claims.

For private, company, school, or third-party-organized events, the organizer is responsible for giving its attendees appropriate notice of the organizer’s own recording or publication. If the organizer supplies attendee information to us, it confirms that it is entitled to do so and has provided this Policy to the relevant people. Each party is responsible for its own purposes and legal obligations unless a written data-processing agreement states otherwise.

12. Changes to this Policy

We may update this Privacy Policy from time to time.

The latest version will be published on m8hub.ro with the “Last updated” date.

13. Contact and supervisory authority

For privacy questions or requests:

You may also lodge a complaint with the Romanian data protection authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP

Current contact details are available on the ANSPDCP website.