Privacy Policy

1.Scope & Roles

This Policy applies to personal data processed by Diobox as a controller, that is, data about:

• Customers and their team members: people who create Diobox accounts, including organizers, their invited team members, and exhibitors who purchase lead retrieval licenses;
• Website visitors: people who visit diobox.com and related sites; and
• Business contacts: prospects, event contacts, and people who communicate with us.

Where Diobox processes Guest Data, meaning personal data about invitees, registrants, ticket buyers, and attendees that organizers manage through the Service, we do so as a processor on the organizer’s behalf, under our Terms of Service and Data Processing Addendum. The organizer’s own privacy policy governs that processing; this Policy applies to Guest Data only to the extent Sections 3, 7, 10, 11, and 12 describe our practices as a processor.

2.Information We Collect

2.1 Information you provide

• Account data: name, email address, password, organization name, role, profile details, and communication preferences.
• Billing data: billing contact and address, subscription and purchase history, and limited payment information. Full payment card details are collected and processed directly by our payment processor, Stripe; Diobox does not store full card numbers.
• Content you submit: event details, images, email and message templates, and other materials you add to the Service.
• Communications: messages you send us through support channels (including our in-app chat), surveys, and email.
• Lead retrieval purchases: exhibitor name, company, contact details, and event association when purchasing a lead retrieval license.

2.2 Information collected automatically

• Usage data: features used, actions taken, pages viewed, referring pages, and timestamps.
• Device and log data: IP address, browser type, operating system, device identifiers, mobile app version, crash and error reports, and approximate location derived from IP address.
• Cookies and similar technologies: see Section 9.
• Messaging metadata: delivery, bounce, open, click, opt-out, and error events for emails, SMS, and WhatsApp messages sent through the Service.

2.3 Information from other sources

• Integrations you connect, such as Stripe (account status for ticketing) and workflow tools such as Zapier, which may transmit data to your Diobox account per your configuration.
• Service providers and public sources, such as fraud-prevention signals and business contact information.

3.If You Are an Event Guest

If you received an invitation, registered for an event, bought a ticket, or checked in at an event powered by Diobox, the event organizer, not Diobox, decides what data is collected about you and how it is used. To exercise privacy rights over that data (access, correction, deletion, marketing opt-out), contact the event organizer directly. If you contact us, we will refer your request to the organizer and support them in responding, as required by our contract with them.

Depending on how the organizer configures their event, Guest Data processed through the Service may include: name and contact details, registration responses, ticket purchases, seating and table assignments, dietary or accessibility notes the organizer chooses to record, check-in status and timestamps, QR code identifiers, badge information, message history (email, SMS, WhatsApp) and related delivery events, and, where you allow your badge to be scanned, lead retrieval records (Section 7).

4.How We Use Personal Data

Acting as a controller, we use personal data to:

• provide, operate, maintain, and secure the Service, including authentication and account management;
• process subscription payments, message credit purchases, and lead retrieval license purchases, and manage billing;
• provide customer support and respond to inquiries;
• send transactional and administrative communications, such as receipts, security alerts, and service announcements;
• send marketing communications about our products and features, which you can opt out of at any time;
• monitor, analyze, and improve the Service, develop new features, and understand usage in aggregate;
• protect against fraud, abuse, spam, and security threats, and enforce our Terms of Service and messaging policies;
• comply with legal obligations and respond to lawful requests.

We may create aggregated or de-identified data from use of the Service (for example, deliverability benchmarks and feature usage statistics) and use it for lawful business purposes; we will not attempt to re-identify it.

Acting as a processor, we use Guest Data only to provide the Service to the organizer, per their instructions and our DPA, not for our own marketing, and we do not sell Guest Data.

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for individuals (Art. 22 GDPR).

5.Legal Bases for Processing (EEA/UK)

Where EEA or UK data protection law applies, the legal bases we rely on are:

• Providing the Service, billing, support — performance of a contract (Art. 6(1)(b) GDPR).
• Service improvement, analytics, security, fraud prevention — legitimate interests (Art. 6(1)(f)) in operating and protecting the Service.
• Marketing communications; non-essential cookies — consent (Art. 6(1)(a)), which you may withdraw at any time.
• Tax, accounting, and legal compliance — legal obligation (Art. 6(1)(c)).
• Guest Data processed for organizers — processed on the organizer’s behalf; the organizer is responsible for establishing its legal basis.

6.How We Share Personal Data

We do not sell personal data. We share personal data with:

• Subprocessors and service providers that help us operate the Service under contractual confidentiality and data-protection obligations, in categories including cloud hosting and storage, content delivery and network security, email delivery, SMS and WhatsApp delivery, payment processing, customer support, analytics, error monitoring, real-time infrastructure, and image processing. A current list of our subprocessors is available upon written request to legal@diobox.com, as described in our Data Processing Addendum.
• Event organizers: if you are a guest, your registration, ticketing, messaging, and check-in data is available to the organizer of your event and their team members.
• Exhibitors, when you allow your badge to be scanned at an event (Section 7).
• Telecommunications carriers and messaging platforms (including Meta, for WhatsApp) as necessary to route and deliver messages.
• Integrations you enable, such as Stripe or Zapier, per your configuration.
• Professional advisors, authorities, and other parties where required by law, to respond to lawful requests, to protect the rights, property, or safety of Diobox, our customers, or the public, or to enforce our agreements.
• Successors in connection with a merger, acquisition, financing, or sale of assets, in which case this Policy will continue to apply to your data until you are notified otherwise.

7.Lead Retrieval & Badge Scanning

At events that use Diobox Lead Retrieval, exhibitors can scan attendee badges to capture lead information. When your badge is scanned, the registration details designated by the organizer for lead retrieval (typically your name, company, title, and contact details, plus any notes or qualifiers the exhibitor records) are shared with that exhibitor, who becomes an independent controller of the data and is responsible for its own use of it, including any follow-up marketing. Allowing your badge to be scanned is your choice. To exercise rights over lead data after a scan, contact the exhibitor directly; the organizer can tell you which exhibitors scanned your badge.

8.Payments & Ticketing

Ticket and registration payments are processed by Stripe through the organizer’s connected Stripe account. When you buy a ticket, your payment card details are provided directly to Stripe and are subject to Stripe’s Privacy Policy; Diobox receives transaction metadata (such as amount, status, and the last four digits of the card) but not full card numbers. The organizer is the seller of record for tickets and is responsible for its own refund and receipt practices.

9.Cookies & Analytics

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how the Service and our websites are used. These include strictly necessary cookies (authentication, security, load balancing) and, with your consent where required, analytics cookies. You can control cookies through your browser settings and, where shown, our cookie preferences banner; disabling necessary cookies may prevent the Service from functioning. We do not respond to “Do Not Track” browser signals, but we honor opt-out preference signals (such as Global Privacy Control) where required by law.

10.International Data Transfers

Diobox is headquartered in the United States and stores data on servers located in the United States. If you use the Service from outside the U.S., your personal data will be transferred to and processed in the U.S. and other countries where our subprocessors operate, which may have data-protection laws different from those of your country.

For transfers of personal data from the EEA, UK, or Switzerland, Diobox relies on the European Commission’s Standard Contractual Clauses (and the UK Addendum / Swiss adaptations, as applicable), incorporated into our Data Processing Addendum, together with supplementary technical and organizational measures. Diobox is not certified under the EU–U.S. Data Privacy Framework and relies on SCCs as its transfer mechanism. You may request a copy of the relevant safeguards by contacting us.

11.Data Retention

We retain personal data for as long as needed for the purposes described in this Policy: account data for the life of the account and as required afterward for legal, tax, and accounting purposes; billing records as required by law; and support communications for as long as useful to serve you.

When an account is closed or Customer Data is deleted, we delete it from live systems within 30 days and from backups within 90 days thereafter, except where retention is required by law. Guest Data is retained and deleted per the organizer’s instructions and our DPA on the same schedule.

12.Security

We maintain administrative, technical, and physical safeguards designed to protect personal data, including encryption of data in transit (TLS), encryption at rest (AES-256), access controls and role-based permissions, network security measures, logging and monitoring, and vendor security review. No method of transmission or storage is completely secure; if we become aware of a personal data breach affecting you, we will notify you and relevant authorities as required by law.

13.Your Rights & Choices

Depending on your location, you may have rights to: access the personal data we hold about you; correct inaccurate data; delete your data; port your data to another service; restrict or object to certain processing; and withdraw consent where processing is based on consent. You will not be discriminated against for exercising your rights.

To exercise these rights, email legal@diobox.com from the address associated with your account, or use your in-app account settings. We will verify your identity and respond within the timeframe required by applicable law. You may also lodge a complaint with your local data protection authority; EEA/UK residents can find theirs via the EDPB member list or the ICO.

If your data was collected by an event organizer (you are a guest or lead), we will refer your request to the organizer or exhibitor, who is the controller of that data (see Sections 3 and 7).

Communication choices

• Marketing email from Diobox: use the unsubscribe link in any marketing message or adjust preferences in your account. We will still send transactional messages about your account.
• SMS: reply STOP to any SMS sent through the Service to opt out of further texts from that sender.
• WhatsApp: use WhatsApp’s native block/report controls or reply to opt out; opt-outs are recorded in the Service.

14.U.S. State Privacy Disclosures

For residents of California and other U.S. states with comprehensive privacy laws: in the preceding 12 months we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet activity, and professional information), for the purposes in Section 4, and disclosed them to the service providers in Section 6. Diobox does not sell personal information and does not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. You may exercise rights to know, access, correct, and delete as described in Section 13, and you may designate an authorized agent to act on your behalf. We do not knowingly collect personal information from consumers under 16.

15.Children

The Service is a business tool and is not directed to children. We do not knowingly collect personal data from children under 16, and children under 18 are not permitted to create accounts. If you believe a child has provided personal data to us, contact legal@diobox.com and we will delete it. Organizers who collect data about minors in connection with their events are responsible for complying with applicable laws, including COPPA and FERPA, and obtaining any required parental consents.

16.Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or prominent notice in the Service at least 30 days before the changes take effect. The “Last updated” date reflects the latest revision. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.

17.Contact Us