Mapiks — Privacy Policy

Last updated: 17 September 2026

DRAFT — NOT YET IN FORCE. No operating entity has been decided, so the

controller is unnamed and the supervisory authority follows from that choice.

What this document describes about collection is accurate today — it is

written against the code — but it takes effect as a policy only once an entity

is named and it is published on the site.

1. Who is responsible

[OPERATING ENTITY], registered in [JURISDICTION] under company number

[COMPANY NUMBER], at [REGISTERED ADDRESS], is the controller of the

personal data described here.

Questions, or any request under section 7: [CONTACT EMAIL].

The Service is aimed at people in North Macedonia, so the **Law on Personal Data

Protection of the Republic of North Macedonia** applies to them. Whatever regime

also applies to the operating entity once it is chosen, we hold ourselves to the

standard of the European Union General Data Protection Regulation, which both

follow closely; where they differ we apply whichever is more protective of you.

2. The short version

Mapiks is an events listing site. Most of what we store is about **events and

venues**, not about people.

• If you just browse the site, we do not ask for your name, we do not set

advertising cookies, and we do not build a profile of you. We count events

viewed, as daily totals.

• If you hold a venue account, we store the details you give us and what you

publish.

• We do not sell personal data to anyone.

3. What we collect from visitors

3.1 Usage counts

When you open an event page, tap a reservation number, or click through to an

event, we add one to a daily total for that event.

What is stored is a row like: *event X, 16 September 2026, 412 views, 38 clicks.*

That is the whole record. We do not store your internet protocol address

against it, we do not set an identifier that follows you between pages, and we

cannot reconstruct what any individual person looked at. There is no per-visitor

history to request, export, or delete, because none is kept.

Legal basis: legitimate interest — knowing which events draw interest is how we

run the service and report reach to venues. Because the record is a daily total

with nothing linking it to you, the effect on your privacy is minimal, which is

what makes that basis appropriate here.

3.2 Things stored in your own browser

The site remembers small preferences — your language, and whether you are signed

in — using your browser's own storage. This stays on your device. It is not sent

to us as a profile and it is not shared.

3.3 Server logs

Our servers keep ordinary technical logs, which include internet protocol

addresses, for security and fault diagnosis. These are kept for **[RETENTION

PERIOD, e.g. 30 days]** and are not used to build profiles.

4. What we collect from venue accounts

If you register a venue we store:

• Account details — name, email address, hashed password. Passwords are stored

hashed and are never readable by us.

• Venue details — name, address, contact number, social media handles, images.
• Content you publish — events, posters, descriptions.
• Billing records — plan, subscription status, invoices, promotion purchases.

Card details never reach our servers; payment is handled by our payment

provider, who acts as a separate controller.

• Sign-in timestamps.

Legal basis: performance of our contract with you, and legal obligation for

invoicing and tax records.

5. Event information from public sources

Some listings are built from material published publicly about public events —

including posters published by a venue. Where such material identifies a person,

for example a performer named on a poster, we process it in our legitimate

interest of informing the public about a public event.

To have something removed, email [CONTACT EMAIL] with a link to the page.

We will remove it within 5 working days. You do not need to give a reason and

you do not need a lawyer.

6. Automated processing

We use Anthropic's Claude to read event posters and extract details such as

the date, time, and price. Poster images and captions are sent to Anthropic for

that purpose.

This produces a draft event listing, not a decision about any person. It has

no legal or similarly significant effect on anyone, and a person reviews low

confidence results before they are published.

7. Your rights

You may ask us to:

• tell you what personal data we hold about you,
• correct anything inaccurate,
• delete it,
• give you a copy in a portable format,
• stop processing it, or object to processing based on legitimate interest.

Write to [CONTACT EMAIL]. We answer within one month.

Note that for ordinary browsing there is usually nothing to return, because the

analytics described in section 3.1 are aggregate counts with nothing linking them

to you. We will tell you that plainly rather than sending an empty file.

If you are unhappy with how we handle a request you may complain to the **Agency

for Personal Data Protection of the Republic of North Macedonia**, or to the

supervisory authority for the operating entity once one is named here.

8. Who we share data with

Each acts under a contract limiting them to our instructions, except the payment

provider, which is a separate controller for payment data.

We may disclose data where the law requires it.

9. Where data is processed

Our infrastructure is hosted in the European Union. Some processors, including

Anthropic, process data outside it.

Where a transfer leaves the country the data was collected in, we rely on an

adequacy decision covering the destination where one exists, and otherwise on

standard contractual clauses together with whatever additional safeguards the

transfer calls for. **The exact instrument follows from where the operating entity

is established**, which is not yet decided.

10. How long we keep things

11. Children

Mapiks is not aimed at children under 16 and we do not knowingly collect their

personal data. Some listed events carry age restrictions set by the venue.

12. Changes

We will post any update here and change the date at the top. For a material

change affecting account holders we give at least 30 days' notice by email.

13. Contact

[OPERATING ENTITY]

[REGISTERED ADDRESS]

[CONTACT EMAIL]