Your account.
Your media. Different data flows.

1. Who operates FotoVent

REC Eventi di Andrea Matteo Bassi, sole trader, Via Zacchetti 31, 42124 Reggio Emilia (RE), Italy; VAT number IT02472790357. Service and privacy contact: info@receventi.it. Further business information is available in the REC Eventi imprint.

2. Visiting this website

The public website has no data collection forms, advertising tools, remote fonts or third-party embedded content. Google Analytics loads only after consent. An email link opens your email application; no message is sent unless you send it. External services have their own notices.

The website is hosted by Aruba S.p.A. on Linux hosting in Italy. Technical data, including IP address, date and time, requested resource and browser or error information, are processed to deliver and protect the site, on the basis of the controller’s legitimate interests. These data are necessary to deliver requested pages and are not used by REC Eventi for advertising or profiling. They are kept as needed for operation, security and incident investigation under the hosting service rules and applicable obligations. REC Eventi does not keep an additional named record of visitors. See Aruba’s data protection information.

2a. Optional Google Analytics statistics

With consent, REC Eventi uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It measures page visits, generic interactions such as download, contact and portal-link clicks, traffic sources and technical browser/device information. Cookie identifiers distinguish browsers and sessions: these data are not described as anonymous. Google processes connection data, including the IP address needed for communication; Google states that GA4 does not log or store individual IP addresses for EU, Swiss and UK users.

Consent is optional and can be withdrawn. The Google tag does not load before acceptance or after refusal. Google Signals, advertising personalisation, User-ID and user-provided data collection are not enabled. Website code does not send names, emails, form content or URL queries/fragments; only the referring domain is sent. A download event measures a click, not completion or installation. A portal click is not evidence of a registration or sale.

Analytics runs only on the public website, not in the portal, local control panel or player pages. Event photos and videos are not sent to Analytics. Statistical cookies have a maximum 180-day lifetime without renewal on every visit. Analytics user/event-level retention is two months; standard aggregate reports may remain available longer under the service’s operation.

Change your choice using “Cookie preferences”. Withdrawal prevents subsequent collection and removes Analytics cookies accessible to the site. It does not invalidate previous lawful processing or automatically erase data already received by Google. Google may process data outside the EEA through its infrastructure and suppliers, subject to the safeguards in its processing terms, including standard contractual clauses where applicable. See Google privacy, processing terms and Analytics data retention.

3. Contacts, accounts and support

If you contact REC Eventi, your email address, name and message are used to answer your request, based on requested pre-contractual measures or legitimate interests in professional communications. Messages are retained to handle the request and any resulting relationship; contractual and tax documents follow applicable legal retention periods. Do not send unnecessary guest images or identity documents.

Registration on app.fotovent.it requires a name or organisation, email, password and acknowledgement of the privacy information. Creation and acknowledgement dates are recorded; IP addresses are used temporarily in memory to limit registration abuse. An account does not automatically include licences. Email confirmation links are single-use and valid for 24 hours. Password recovery links are single-use and valid for 30 minutes; a password change disconnects account sessions. Tokens are stored as hashes and removed on expiry. Service emails are sent from noreply@fotovent.it through Aruba, with replies to support@fotovent.it. These are not newsletter subscriptions.

The portal processes names, email addresses, hashed credentials, roles, customer associations, licences, player identifiers, connection status and administrative requests. An activity log records operations such as user and licence changes. Customer owners manage their colleagues. The REC Eventi superuser administers customers, licences and commercial data; the portal does not allow that user to list or open other customers’ player controls. This application restriction is not a claim that authorised infrastructure personnel have no technical access; such access remains subject to confidentiality and service need.

Account and contractual processing relies on contract performance or requested pre-contractual measures where applicable. Tax obligations rely on law. Security and access management may rely on documented, balanced legitimate interests. The basis for colleague data must be defined within the customer relationship, rather than assuming that every colleague is a contractual party.

4. Which files are accessible

The public website does not access the visitor’s or player’s disk. Selecting files makes only those selected files available to the browser for upload; it does not grant general access to the photo library.

Desktop stores uploaded originals, playback copies, thumbnails and event settings in its own data folder. Remote controls expose content managed by FotoVent, not arbitrary folders on the computer. Photos and videos may contain faces, voices, names or other personal data. Originals can retain metadata such as location and capture time. A contributor name or filename may be associated with a file.

5. Who sees event content

Guest QR access is upload-only, without gallery or control-panel access. Authorised photographers can view the event sequence and manage it within their role; it is not a private space visible only to the uploader. Desktop administrators can manage playback and export originals, including items awaiting approval, hidden or removed from the sequence. The audience sees projected content. Immediate publication of guest contributions is optional and moderation is the organiser’s decision. A QR code is an upload access link: anyone receiving it can use it while valid; the organiser can disable or regenerate it.

6. Connect data flows

With Connect, uploads, previews, downloads and commands pass through FotoVent’s server to reach the player. Originals remain on the event computer; Connect is not a permanent media archive. The server still processes and relays data and manages accounts, licences, sessions and technical information.

Connect uses HTTPS and secure WebSockets, not a claim of end-to-end encryption. Local access uses HTTP and requires a trusted private network. Disconnecting Connect stops remote access but does not delete local media.

6a. Hosted FotoVent Cloud

Cloud is separate from Desktop and Connect. Uploaded files are processed into copies optimised for the project resolution. These are held in a private Cloudflare R2 archive under EU jurisdiction and delivered to authorised browsers. Originals are temporary conversion inputs, not a downloadable archive; keep your own originals before uploading. Media, previews and technical data are processed to provide the service on the customer’s instructions. Event settings determine content expiry; the customer must communicate those settings and account for exports and copies when handling requests.

The playback browser stores a technical pairing identifier and may preload assigned media. Clearing browser data does not delete hosted content. Cloudflare is an additional technical provider whose roles, safeguards and terms must be addressed in the customer agreements. This technical description does not certify that a professional legal review is complete.

7. Organiser and REC Eventi responsibilities

The party deciding why and how event images are collected and displayed must identify the relevant data controller, normally the organiser or customer according to the actual relationship. REC Eventi manages the data needed for its service. Where personal content is processed on a customer’s behalf, the relationship must be governed by an Article 28 GDPR agreement covering instructions, security and authorised providers. This page is not that agreement.

The organiser must provide event-specific information and identify a lawful basis for collection, display and further use. Uploading a file or accepting cookies does not automatically authorise every use of images of the people shown. Particular care is needed for children.

8. Retention and deletion

For Desktop, including through Connect, removing an item from a sequence does not delete the original from the computer. Originals remain available to the administrator for export. There is no automatic end-of-event deletion of the Desktop archive. The operator must implement retention and actual deletion, including exports and backups.

Accounts are retained during the service relationship; a Lifetime licence is not deleted simply for inactivity. In My account, users can download account information and request closure by confirming their current password, or contact support@fotovent.it. A request does not immediately stop service. REC Eventi records intake, export checks, commercial obligations, treatment of active data and copies, and its reply. Administrative removal revokes access and licences but preserves necessary history; it is not complete erasure. Retention exceptions must be justified and communicated. This procedure does not delete photos or videos on PCs.

Connect activity records: at most 180 days and 2,000 operations. Closed administrative requests: at most 180 days after closure; open requests remain available for handling. Connect server logs rotate daily, normally up to approximately 14 days, with a system-journal space limit. Access logs omit query parameters, cookies, uploaded content and password-recovery links; error logs may include technical request information.

External Connect registry/configuration backups are encrypted before transfer, with hourly copies and a daily complete copy. Copies remain available for 30 days, followed by deletion after one further day subject to provider processing; the first seven days are protected against deletion. Active-data deletion therefore reaches backups through their expiry cycle. These backups do not contain player photos or videos and are not used for routine operation. After a restore, later deletions must be reapplied. Public-site hosting logs have separate retention rules.

9. Providers and transfers

Connect runs on Hetzner infrastructure in Finland. Aruba provides website hosting and email. Encrypted Connect backups use Backblaze B2 in the configured European region. Healthchecks.io receives success/failure monitoring signals without FotoVent account data, media or credentials in their messages; connection technical data may still be processed. The private backup recovery key is stored separately from the Connect server.

Server location alone does not establish that no other access or transfers occur. Provider agreements, roles and any transfers outside the EEA and their safeguards must be assessed. Stripe handles payments and subscriptions; FotoVent retains order references, states and amounts, not full card details. Fatture in Cloud receives billing and payment data to prepare documents; REC Eventi handles SDI submission. Applicable contracting entities, roles and safeguards follow the respective agreements: Stripe and Fatture in Cloud. This page does not attest completion of the contractual review.

10. Requests and rights

For data managed by REC Eventi, contact info@receventi.it to request access, correction, deletion, restriction or portability, or to object where applicable. Consent can be withdrawn without affecting earlier lawful processing. You may complain to the Italian data protection authority.

For event images, identify the organiser, event and relevant content. The event controller handles its copies; REC Eventi assists within its processing role. Do not resend a whole gallery or unrequested documents. The described functions do not make automated decisions about or profile people in the images. Required account data are necessary to access the service; guest uploads are optional.

11. Service agreements

Providing the service for a customer requires retention terms, operational procedures, customer/provider agreements and an appropriate guest upload notice. This page does not certify those steps or constitute a data processing agreement. Contact REC Eventi to arrange the service. The notice is updated when hosting, features or tracking change. Reference: Regulation (EU) 2016/679, particularly Articles 13 and 28. See also the cookie policy.