Privacy Policy

This policy explains how Cuemark (“we”, “us”) handles personal data on cuemarkevent.com, app.cuemarkevent.com and in the Cuemark service. It is written to meet the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK).

1. Who is responsible

For the website, the sign-up and demo forms and customer accounts, the controller is Haldun Tolan, trading as Cuemark, Şişli, Istanbul, Türkiye, support@cuemarkevent.com.

For attendee data that event organisers collect through Cuemark (registrations, tickets, check-ins), the organiser is the controller and Cuemark processes the data only on the organiser’s instructions, as a processor. Attendees should contact the organiser of their event first; we will help organisers answer such requests. A data processing agreement (DPA) is available to customers on request.

2. What we collect and why

• Website visits. We use our own cookieless analytics: pages viewed, referring site, approximate country (from the browser time zone), device and browser type. We do not store IP addresses in analytics; visitors are counted with a hash that changes every day. “Do Not Track” and Global Privacy Control are respected. Our web server keeps technical logs (including IP address) for up to 14 days for security. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Sign-up, demo and pilot requests. Name, company, work email, country and what you tell us, to create your account or answer your request. Legal basis: contract or steps before a contract (Art. 6(1)(b)).
• Customer accounts. Name, email, role, password (stored only as a secure hash), sign-in times and an audit log of important actions, to provide and secure the service. Legal basis: contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)).
• Purchases. Payments for Cuemark packages are processed by our reseller Lemon Squeezy, who acts as merchant of record. We receive the order, package, amount and billing email, but never your card details.
• Support emails. Messages you send to support@cuemarkevent.com and our replies, to help you. Replies may be drafted with the help of AI tools under our supervision.
• Attendee data (processor). Data organisers ask for in their registration form — typically name, email, mobile phone, company, job title, answers to the organiser’s questions, ticket and payment status, hotel requests and check-in times — processed only to run the organiser’s event.

3. Cookies

The marketing site sets no cookies. The app uses one strictly necessary session cookie when you sign in. The demo video is loaded from YouTube’s privacy-enhanced domain only after you click play.

4. Service providers

• Hetzner Online GmbH, Germany — hosting; all Cuemark data is stored on servers in Germany (EU).
• Resend, USA — sending emails such as tickets and password links.
• Lemon Squeezy (Stripe group), USA — payment processing and invoicing for package purchases.
• Google (Gmail / YouTube) — our support mailbox; the demo video if you choose to play it.

Transfers outside the EU/UK are protected by the European Commission’s Standard Contractual Clauses or an adequacy decision.

5. How long we keep data

Account data: for as long as the account exists; we delete it within 90 days after an account is closed. Event and attendee data: for as long as the organiser keeps the event in their account — organisers can delete attendees at any time, and we delete event data within 90 days after the account is closed. Analytics: 13 months. Server logs: 14 days. Invoices: as required by tax law.

6. Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of your data in a portable format. Where we rely on consent you can withdraw it at any time. Write to support@cuemarkevent.com. You also have the right to complain to a data protection authority, for example in the EU country where you live, or in Türkiye to the Personal Data Protection Authority (KVKK).

7. Security

Connections are encrypted (HTTPS). Passwords are hashed, payment secrets are encrypted, access is limited by role, and staff station links show only the data each role needs and can be revoked at any time.

8. Changes

We will update this page when our practices change and show the date of the latest version below.

Last updated: 2 November 2026