Privacy policy
This policy covers the website https://www.alistaworks.com and the Alista service at app.alistaworks.com, including its attendee portal. Using the service is also governed by our Terms of service.
Who is responsible
1st Thing Apps, the trading name of Olufela Anreti Hughes, sole trader, NIF X9699472G, C/ Anselm Clavé 44, 08750 Molins de Rei, Barcelona, Spain. Email: helloalistaworks.com.
Two roles
For our website, for the people who sign in to Alista, and for how Alista itself is used, we decide what is collected and why: we are the controller.
The events in Alista belong to our customers, the destination management companies and agencies that use it. What they and their teams put in, such as attendee lists, dietary needs, rooms, journeys and passport copies sent through the attendee portal, is processed by us on their behalf: for that data the customer is the controller and we are its processor. If you are an attendee, a freelancer or one of a partner company’s staff, the organiser of your event is responsible for your data in Alista, and their own privacy notice applies; we will pass on any request you send us.
The website
Server logs
Our hosting provider records standard server logs: IP address, the page requested, the time and your browser’s description. We use them to keep the site working and secure. They are kept for a limited period and are not combined with other data.
Cookies and visit statistics
This website sets no cookies and stores nothing in your browser, which is why you see no cookie banner. It uses no advertising trackers and no outside analytics service.
We count visits ourselves, on our own hosting, to learn which pages are read and how people find us. When you open a page we record the page, the site or tagged link you came from, your approximate location (city, region and country, worked out from your IP address as the page is requested), your browser, operating system, type of device, screen size and language, how long the page was on screen and how far down it you read, and whether you sent the early access form or followed an email or outside link.
Your IP address is not stored. To count a visitor once a day, it is combined with your browser’s description and a secret that is replaced every day, and only the result is kept, so you cannot be recognised from one day to the next. The statistics are kept for 25 months and are not shared with anyone. The legal basis is our legitimate interest in understanding how the website is used. If your browser sends a Do Not Track or Global Privacy Control signal, you are not counted. Locations come from DB-IP’s free database (db-ip.com), used on our own server.
When you ask for early access or write to us
We receive what you send: your name, email address, company and message. We use it to reply to you and to arrange early access. The legal basis is your request (steps taken before entering into a contract) and our legitimate interest in answering enquiries. We keep enquiries for up to two years, or until you ask us to delete them.
The Alista service
Signing in
To sign you in we hold your email address, your name as your organisation gives it, the accounts and events you have access to and your role in them, and when you last signed in. Sign-in links are sent to your email. The legal basis is the contract with your organisation, and our legitimate interest in giving its people secure access.
How the service is used
To see which features are used and where people struggle, the app records which screens are opened and for how long, which actions are taken (an item added, a task ticked, a file imported), how long things take to load, and errors. Each record carries the account it belongs to, your role in it, the app’s version, and your browser, operating system, type of device, screen size and language.
It never records what you write: no titles, names, notes, messages or files. You are recorded as a code made from your sign-in with a secret held only in our database, not by name or email. These records are kept for 25 months. The legal basis is our legitimate interest in maintaining and improving the service. It is off for browsers that send a Do Not Track or Global Privacy Control signal. You can object to it at any time by writing tohelloalistaworks.com, and we will stop recording how you use the service.
Support, and running the service
When you contact us we use what you send to help you. We keep records needed to run the service securely, such as error logs, for a limited time. When paid plans begin, we keep invoicing records as Spanish tax and commercial law requires.
Storage in your browser
The app keeps your sign-in session and a few display choices (such as light or dark, or the calendar’s view) in your browser’s storage, because it cannot work without them. It uses no advertising or tracking cookies.
Who processes data for us
- Supabase (servers in the European Union, Ireland): the service’s database, sign-in, file storage and server functions, and the website’s early access form.
- Netlify (United States): delivers the app’s files to your browser, recording standard request logs.
- 20i (United Kingdom): hosts the website, its visit statistics and our own management tools.
- Zoho ZeptoMail (European Union data centre): sends sign-in, invitation and other service emails.
- Anthropic (United States): reads files uploaded to Import, only when a user chooses to import one, and does not train its models on them.
- Geoapify (Germany): finds places typed into place searches.
- Google Workspace: our own email.
Each works under a data processing agreement. Transfers to the United States rely on the European Commission’s standard contractual clauses or its adequacy decision for the EU-US Data Privacy Framework; transfers to the United Kingdom on its adequacy decision for the United Kingdom. We give customers notice before adding a processor, as our Terms of service set out. We do not sell personal data or share it for marketing.
How long we keep it
- Website visit statistics and records of how the service is used: 25 months.
- Early access enquiries: up to two years.
- Sign-in details: while you have access to an account, and up to 90 days after.
- Customer data, as our customers’ processor: until the customer deletes it, or within 90 days after its account ends, with backups expiring within 30 days after that.
- Invoicing records: as long as Spanish law requires.
Security
Data is encrypted in transit and at rest. Access to each account’s data is limited by the account and by each person’s role, enforced in the database itself. Only the people who need to, under confidentiality, can reach our systems.
Your rights
You may ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to its use, or receive it in a portable form. Write to helloalistaworks.com. Where your data is in an event, we will refer your request to its organiser, who decides on it, and help them answer. You also have the right to complain to a data protection authority; in Spain that is the Agencia Española de Protección de Datos (aepd.es).
Children
The service is for business use and not for anyone under 16.
Changes
If this policy changes, the new version is published here with its date, and customers are told of changes that matter.