Privacy Policy
In short
localz helps you find events. You can browse the whole site without an account, and we do not track you: there is no analytics, no advertising, and no third-party tracking script anywhere on these pages. We ask for personal data in three places only — when you create an account, when you write to us, and when you turn on weekend notifications — and this policy explains what happens to it in each case.
Who is responsible for your data
The data controller for the personal data described in this policy is:
- Company: Прайс Екс ЕООД (Pricex Ltd)
- Company number (ЕИК): 206487271
- Registered address: България, гр. Пловдив 4000, р-н Централен, ул. Петьофи 1
- Email: [email protected]
What we collect, and why
We collect only what a given feature needs to work. Nothing here is bought from anyone, and nothing is combined into a profile of you.
Your account
To publish an event you need an account. We store the name you give, your email address, and your password — the password only as a cryptographic hash, so nobody at localz can read it. We also record when you confirmed your email address, because publishing requires a confirmed one. We use these to keep your account working and to contact you about it. We do not send marketing email.
Events you publish
An event you submit is public: its title, description, dates, image, venue name and address, and ticket link are shown to everyone. Your name and email address are not displayed on the event page and are not part of what is published. Do not put personal details into an event listing that you are not willing to make public.
Messages you send us
The contact form asks for your name, email address and message so that we can answer you. The message is emailed to us and also written to our application log. Your IP address is used to limit how many messages can be sent from one place in an hour, which is what keeps the form from being turned into a relay for other people's inboxes.
Weekend notifications
If you turn on notifications, your browser gives us a subscription: an address at your browser vendor's push service, two keys that encrypt the message, the city you picked and your chosen language. If you were signed in at the time, the subscription is linked to your account. We use it for one thing — the weekend digest for that city. You can turn it off in the app or in your browser settings, and doing so ends it.
Technical data
While you are signed in, your session record holds your IP address and browser user-agent string, which is what lets us recognise your session and end it everywhere when you change your password. Our servers and error logs also record request data, including IP addresses, which we use to keep the site running and to investigate abuse.
Location
The "Locate me" button on the map asks your browser for your position and uses it to re-centre the map in front of you. Those coordinates stay in your browser — they are never sent to us and never stored.
Our legal grounds
Under the GDPR we need a lawful basis for each use. Ours are:
- Performance of a contract — running your account and publishing the events you submit.
- Your consent — weekend notifications, which you switch on yourself and can switch off at any time.
- Our legitimate interests — keeping the service available and secure, preventing abuse of the contact form and the sign-in page, and republishing public event listings so people can find them.
- Legal obligations — where the law requires us to keep or disclose something.
No tracking, no advertising
We do not use Google Analytics or any other analytics product, we do not show advertising, we run no advertising or remarketing cookies, and we do not allow third-party behavioural tracking on the site. We do not sell, rent or trade personal data, and we do not build advertising profiles.
Event photos are copied onto our own servers rather than linked from wherever they came from. That is partly so listings do not break, and partly so the original site never learns that you looked at the event.
Cookies
We use a small number of cookies, all of them necessary for the site to work. None of them are used for advertising or measurement.
- A session cookie, which keeps you signed in and protects forms against cross-site request forgery. It expires when your session does.
- A language cookie, set when you pick a language from the switcher, so the site keeps speaking to you in it on your next visit.
You can delete or block cookies in your browser settings. Blocking them will sign you out and stop the site remembering your language, but you can still browse events.
Who else sees your data
We do not share personal data except where a part of the service cannot work without it:
- Our hosting provider, which operates the servers the site and its database run on. Those servers are in Europe.
- Our email provider, which delivers account emails such as password resets and address confirmations.
- Your own browser vendor's push service, which delivers a notification to your device — and only if you turned notifications on.
- OpenStreetMap, whose servers provide the map tiles. When a map loads, your browser requests those tiles directly, so OpenStreetMap sees your IP address and which part of the map you are looking at. Their terms govern that request; we receive nothing from it.
- Public authorities, where we are legally required to respond to a valid request.
Nobody else. In particular, no advertisers, no data brokers and no analytics companies.
Events gathered from public sources
Most listings on localz are not written by us. They are collected from public sources — city open-data portals, venue calendars and ticketing sites — and republished with the source named. Such a listing can contain someone's personal data, typically an organiser or performer named in the event. We process it to run an event directory, which is our legitimate interest in making public events findable.
If a listing names you and you want it corrected or removed, write to us and we will act on it.
How long we keep it
We keep personal data only as long as the purpose it was collected for lasts:
- Account data — until you delete your account. Deleting it removes your account record and takes the events you published off the site.
- Sessions — until they expire or you sign out.
- A notification subscription — until you turn notifications off, or until your browser's push service tells us the subscription no longer exists.
- Application logs — 14 days, then they are deleted automatically.
- Messages you send us — for as long as we need them to deal with what you wrote about.
How we protect it
The site is served over HTTPS. Passwords are stored only as hashes, never in a readable form, and changing your password signs out every other session. The database is not reachable from the internet, and access to the servers is limited to the people who operate them. No system is perfectly secure, but we do not ask for data we do not need, which is the part that helps most.
Transfers outside the EEA
The site and its database run on servers in Europe. The one routine exception is notification delivery: if you turn notifications on, the message goes through your browser vendor's push service, which may be operated outside the EEA. That happens only for people who enable notifications, and the notification's contents are encrypted so that only your browser can read them.
Your rights
Under the GDPR you can ask us to:
- Give you a copy of the personal data we hold about you.
- Correct anything about you that is wrong or incomplete — you can also edit your name and email address yourself, in your profile.
- Delete your data. You can delete your account yourself at any time from your profile; if anything about you remains elsewhere, ask us and we will remove it.
- Stop using your data for a while, while a dispute about it is sorted out.
- Hand over the data you gave us in a machine-readable format.
- Stop processing that we base on our legitimate interests.
- Withdraw a consent you gave — turning notifications off does exactly that, and it does not affect anything done before.
Write to the address below to exercise any of these. We answer within one month. We may need to confirm who you are first, so that we do not hand your data to somebody else.
If you think we have handled your data wrongly, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg), or to the supervisory authority in the EU country where you live.
Children
localz is not aimed at children. You have to be at least 16 to create an account, and we do not knowingly collect personal data from children under that age. If you believe a child has given us their data, tell us and we will delete it.
Changes to this policy
We may update this policy as the site changes. The date at the bottom always shows when it last changed. If a change materially affects how we handle your personal data, we will say so on the site rather than expect you to notice.
Contacting us
Questions about this policy, or a request about your data, can be sent through the contacts page or to the address below.
Last updated on 2026-08-26