Privacy Policy
How BizSource collects, uses, and protects your personal data.
Draft — publish date not yet set.
1. Who we are
BizSource User Group ("BizSource," "we," "us") is a free, volunteer-run, non-profit community for people working with Microsoft Dynamics 365 and Power Platform, operating monthly meetups and one annual event across Serbia, Croatia, and Africa.
BizSource is an informal, unincorporated community group, not a registered legal entity. Under GDPR, the data controller is the BizSourceUG organizing team, contactable at info@bizsourceug.com.
Contact for privacy questions: info@bizsourceug.com.
We have not appointed a formal Data Protection Officer, as BizSource's scale does not currently require one under GDPR Article 37.
2. What data we collect
We only collect what we need to run events, forms, and the community platform itself:
- We do not collect payment information. BizSource events are free and the platform does not process payments today. If that changes in the future, this section will be updated to reflect what payment data we collect and how.
| Category | What | Collected when |
|---|---|---|
| Account data | Name, email, password (hashed, never stored in plain text), optional company, job title, LinkedIn, bio, photo, user-group preference, and notification/marketing preferences | You register an account, or sign in with Google or Microsoft |
| OAuth identity | Your provider account ID only — never your password, which we never see | You sign in with Google or Microsoft |
| Event registration | Which events you registered for, your ticket/QR code, and your check-in status and time | You register for or attend an event |
| Form submissions | Whatever a specific form asks for (for example, a speaker proposal, sponsor interest, or feedback survey), plus any file you upload to it | You submit a form |
| Link-click and attribution data | A hashed (not raw) IP address, approximate country and city, device type, browser, operating system, referring page, and which tracked link or channel you came from | You click a BizSource tracked link, or register or submit a form shortly after |
| Usage / product analytics data | Pages viewed, general navigation patterns, device and browser type, and which features you use — pseudonymous, not tied to your name or account | You accept the analytics cookie banner, and continue browsing |
| Support and contact messages | Whatever you send us via the Contact form or email | You contact us |
| Event photos and video | Photos and, in some cases, video of sessions, which may include you if you're visible or audible — see our Terms of Service, section 5, for the full practice and how to opt out | You attend an in-person BizSource event |
3. Cookies
We use a small number of cookies, described in full in our separate Cookie Policy page, linked in the site footer: a session cookie to keep you signed in, a cookie that remembers which link or channel brought you to the site for 30 days (so we can credit the right channel for a registration), and — only if you accept our cookie banner — a privacy-focused analytics cookie that helps us understand overall usage. We do not use third-party advertising cookies.
4. Why we process your data, and on what legal basis
Under GDPR, every use of your data needs a lawful basis. Here's ours:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of a contract (our Terms of Service) |
| Registering you for events, sending tickets/QR codes, check-in | Performance of a contract |
| Sending account-related email (verification, password reset, registration confirmation) | Performance of a contract |
| Sending optional community updates | Consent (you opt in separately from registration) |
| Measuring which social channels drive registrations (link attribution) | Legitimate interest (understanding what promotion works) |
| Preventing spam and bot form submissions (Cloudflare Turnstile) | Legitimate interest (security) |
| Speaker proposals, sponsor interest, feedback forms | Consent (you choose to submit the form) |
| Syncing event, attendance, and form data to our internal CRM | Legitimate interest (community relationship management, entirely internal — not shared with third parties beyond our processors, see section 6) |
| Understanding how the platform is used, to improve it (product analytics) | Consent (you accept the cookie banner before any analytics data is collected) |
5. How long we keep your data
Automated deletion after these periods is not yet built into the platform — until it is, requests under section 7 below are fulfilled manually. This table states our intended retention practice.
| Data type | Retention |
|---|---|
| Click and attribution logs | 12 months |
| Form submissions | 24 months, or a shorter period set for that specific form |
| Registration data | For as long as you're an active community member, plus 12 months |
| Account data | Until you ask us to delete it, or after 36 months of account inactivity |
| Email delivery logs | 6 months |
| Analytics event data (pages viewed, feature usage) | 365 days (PostHog's default retention; not separately configured in our setup) |
| Aggregated/anonymized analytics | Indefinitely (no longer personal data once aggregated) |
6. Who we share data with
We never sell your data. We share it only with the service providers that make BizSource run, and only for the purposes above:
- None of these providers may use your data for their own purposes — they process it only on our instructions, under each provider's own standard terms of service. We have not separately negotiated or signed bespoke Data Processing Agreements with any of them beyond what their standard terms already provide.
| Provider | Purpose | Location |
|---|---|---|
| Neon (Postgres database) | Stores all platform data | EU (Frankfurt) |
| Render | Hosts our backend API | EU region |
| Cloudflare | Hosts our website (Workers), stores uploaded files (R2), and provides bot protection (Turnstile) on public forms | R2 storage is EU-region; Cloudflare's edge network is global by design, so a request may be routed through a data center outside the EU on its way to our EU-hosted backend |
| Sign-in with Google, only if you choose that option | Google operates globally; where data leaves the EU/EEA, Google relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | |
| Microsoft | Sign-in with Microsoft, transactional email delivery, and our internal CRM, used to keep a record of event registrations, attendance, form submissions, and speaker/sponsor relationships | Europe (our Microsoft 365/Dataverse tenant is configured in the EU region) |
| Sessionize | We import publicly-available speaker/session information you've already submitted directly to Sessionize as part of our call-for-speakers process — we don't send Sessionize any of your BizSource account data | Sessionize does not publish an exact hosting location; its own privacy policy states data may be processed outside the EEA under safeguards it describes as adequate |
| PostHog | Product analytics — understanding how the platform is used in aggregate, only after you accept the cookie banner | EU (PostHog's EU Cloud, eu.posthog.com) |
7. Your rights
Under GDPR (and equivalent laws where you're based), you can:
- Access the personal data we hold about you
- Correct inaccurate data, or just edit your profile directly
- Delete your account and associated data ("right to erasure")
- Restrict or object to certain processing, including our legitimate-interest uses in section 4
- Port your data to another service in a machine-readable format
- Withdraw consent at any time for anything based on consent, without affecting processing done before you withdrew it
- Complain to your local data protection supervisory authority if you think we've gotten this wrong
8. Exercising your rights
To exercise any of the rights in section 7, email info@bizsourceug.com. We'll respond within one month, as GDPR requires. This is currently a manual process — the platform doesn't yet have a self-service "delete my account" or "export my data" feature.
9. International data transfers
Our core infrastructure (database, backend) is EU-hosted specifically to keep your data in the EU. Some of our processors (Cloudflare's edge network, Google, Microsoft) operate globally and may process data outside the EU as part of their normal service delivery. Where that happens, it's covered by those providers' own Standard Contractual Clauses or equivalent GDPR-approved transfer mechanisms — see the provider table in section 6 for what we've confirmed about each one specifically.
10. Security
We hash passwords and IP addresses (we never store a raw IP address from a link click), use HTTPS everywhere, and host our database and backend in the EU.
11. Children
BizSource is intended for working professionals and is not directed at children. You must be at least 16 years old to create a BizSource account.
12. Changes to this policy
We'll update the date at the top of this page when we make changes, and for material changes we'll make a reasonable effort to notify active members — currently a manual process, not backed by any automated notification mechanism.
13. Contact
Questions about this policy, or to exercise any of the rights in section 7: info@bizsourceug.com.