Privacy Policy

In short

localz helps you find events. You can browse the whole site without an account. There is no advertising and no tracking that follows you around; the only measurement is page-view statistics with Google Analytics, which runs only if you accept it. We ask for personal data in four places only — when you create an account, when you write to us, when you report a listing, and when you turn on weekend notifications — and this policy explains what happens to it in each case.

Who is responsible for your data

The data controller for the personal data described in this policy is:

  • Company: Прайс Екс ЕООД (Pricex Ltd)
  • Company number (ЕИК): 206487271
  • Registered address: България, гр. Пловдив 4000, р-н Централен, ул. Петьофи 1
  • Email: [email protected]

What we collect, and why

We collect only what a given feature needs to work. Nothing here is bought from anyone, and nothing is combined into a profile of you.

Your account

To publish an event you need an account. We store the name you give, your email address, and your password — the password only as a cryptographic hash, so nobody at localz can read it. We also record when you confirmed your email address, because publishing requires a confirmed one. We use these to keep your account working and to contact you about it. We do not send marketing email.

Events you publish

An event you submit is public: its title, description, dates, image, venue name and address, and ticket link are shown to everyone. Your name and email address are not displayed on the event page and are not part of what is published. Do not put personal details into an event listing that you are not willing to make public.

Messages you send us

The contact form asks for your name, email address and message so that we can answer you. The message is emailed to our support inbox and is not written to our logs. Your IP address is used to limit how many messages can be sent from one place in an hour, which is what keeps the form from being turned into a relay for other people's inboxes.

Reports about a listing

If you report an event or a place, the report form sends us the link to the listing, your explanation, and the name and email address you give. The report is emailed to our support inbox so that we can review the listing and tell you what we decided. As with the contact form, your IP address is used to limit how many reports can be sent from one place.

Weekend notifications

If you turn on notifications, your browser gives us a subscription: an address at your browser vendor's push service, two keys that encrypt the message, the city you picked and your chosen language. If you were signed in at the time, the subscription is linked to your account. We use it for one thing — the weekend digest for that city. You can turn it off in the app or in your browser settings, and doing so ends it.

Technical data

Every visit opens a session, even if you are not signed in. The session record holds your IP address and browser user-agent string and is deleted after the session expires, 120 minutes after your last request. It lets us recognise your session, protect forms, and end every session when you change your password. Our servers and application logs also record request data, including IP addresses, which we use to keep the site running and to investigate abuse.

When something on the site breaks, an error report goes to our error-tracking system (Sentry, which we run ourselves rather than using Sentry's cloud service). Before a report is sent, cookies, form contents, query strings, email addresses and tokens are removed from it. It keeps the page path and the browser type, which is what we need to find the fault.

Location

The "Locate me" button on the map asks your browser for your position and uses it to re-centre the map in front of you. Those coordinates stay in your browser — they are never sent to us and never stored.

Our legal grounds

Under the GDPR we need a lawful basis for each use. Ours are:

  • Performance of a contract — running your account and publishing the events you submit.
  • Your consent — weekend notifications, which you switch on yourself, and Google Analytics statistics, which run only after you click Accept. You can withdraw either at any time.
  • Our legitimate interests — keeping the service available and secure, preventing abuse of the contact form and the sign-in page, and republishing public event listings so people can find them.
  • Legal obligations — where the law requires us to keep or disclose something, and handling reports about illegal content under the EU Digital Services Act.

Statistics (only with your consent), no advertising

If you click Accept in the cookie notice, we use Google Analytics 4 to count page views. Until you do, the Google Analytics script is not loaded at all. Google then receives the page address without any query string, the address of the site you came from without its path, a random identifier stored in the _ga cookies, and technical details such as browser and approximate region. This is pseudonymous data, not anonymous data. We do not link it to your account. We show no advertising, run no advertising or remarketing cookies, and allow no other third-party behavioural tracking. We do not sell, rent or trade personal data.

Event photos are copied onto our own servers rather than linked from wherever they came from. That is partly so listings do not break, and partly so the original site never learns that you looked at the event.

Cookies

We use a small number of cookies and browser storage entries. The first four cookies are needed for the site to work or for something you asked for; the Google Analytics cookies are optional and are set only if you accept them.

  • localz-session — identifies your session, so that you stay signed in and forms work. It expires with the session.
  • XSRF-TOKEN — protects forms against cross-site request forgery. It expires with the session.
  • remember_web_… — set only if you choose to stay signed in when you log in. It keeps you signed in for up to 400 days, or until you sign out.
  • locale — set when you pick a language from the switcher, so the site keeps speaking to you in it on your next visit. It lasts up to 400 days.
  • Google Analytics 4 cookies (_ga and _ga_ZEDHG1P9J0), set only after you click Accept, for visit statistics. Provider: Google Ireland Ltd. The cookies last up to 13 months and Google keeps the analytics data for 14 months. You can withdraw your consent at any time with “Cookie settings” in the footer.

Your browser also keeps three small settings for us in its local storage: your cookie choice (cookie_consent, 12 months), whether the map is shown, and the topics you filtered by. They never leave your device, and you can clear them in your browser settings.

The site also installs a service worker, a small script in your browser. It keeps an offline page and the site icon in your browser's Cache Storage so that a page can be shown when you have no connection, and it is what delivers push notifications if you turn them on. It holds no personal data. You can remove it and its cache at any time by clearing the site's data in your browser settings.

You can delete or block cookies in your browser settings. Blocking them will sign you out and stop the site remembering your language, but you can still browse events.

Who else sees your data

We do not share personal data except where a part of the service cannot work without it:

  • Hetzner Online GmbH, our hosting provider, which operates the servers the site, its database and its outgoing email run on. Those servers are in Germany.
  • Cloudflare, Inc., which sits in front of the site to deliver it quickly and protect it from attacks. Every request passes through Cloudflare, so it sees your IP address and the pages you request. Cloudflare acts on our instructions as our processor.
  • Google Ireland Ltd, for Google Analytics, only if you accept it (see “Statistics” above).
  • Your own browser vendor's push service, which delivers a notification to your device — and only if you turned notifications on.
  • OpenStreetMap, whose servers provide the map tiles. When a map loads, your browser requests those tiles directly, so OpenStreetMap sees your IP address and which part of the map you are looking at. Their terms govern that request; we receive nothing from it.
  • Public authorities, where we are legally required to respond to a valid request.

Nobody else. In particular, no advertisers and no data brokers. Our fonts are served from our own servers, so loading a page does not contact Google Fonts or any other font service.

Events gathered from public sources

Most listings on localz are not written by us. They are collected from public sources — city open-data portals, venue calendars and ticketing sites — and republished with the source named on each event page. Such a listing can contain someone's personal data, typically an organiser or performer named in the event. We process it to run an event directory, which is our legitimate interest in making public events findable.

If a listing names you and you want it corrected or removed, write to us and we will act on it.

How long we keep it

We keep personal data only as long as the purpose it was collected for lasts:

  • Account data — until you delete your account. Deleting it permanently removes your account record, the events you published and their images, and your notification subscriptions.
  • Sessions — deleted after they expire, 120 minutes after your last request, or when you sign out.
  • A notification subscription — until you turn notifications off, or until your browser's push service tells us the subscription no longer exists.
  • Application logs — 14 days, then they are deleted automatically.
  • Messages and reports you send us — kept in our support inbox for as long as we need them to deal with what you wrote about.

How we protect it

The site is served over HTTPS. Passwords are stored only as hashes, never in a readable form, and changing your password signs out every other session. The database is not reachable from the internet, and access to the servers is limited to the people who operate them. No system is perfectly secure, but we do not ask for data we do not need, which is the part that helps most.

Transfers outside the EEA

The site, its database and its email run on servers in Germany. Some providers may process data outside the EEA: Cloudflare and Google (for Google Analytics, only if you accept it) are US companies certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving adequate protection. If you turn notifications on, the message also goes through your browser vendor's push service, which may be outside the EEA. The notification's contents are encrypted so that only your browser can read them.

Your rights

Under the GDPR you can ask us to:

  • Give you a copy of the personal data we hold about you.
  • Correct anything about you that is wrong or incomplete — you can also edit your name and email address yourself, in your profile.
  • Delete your data. You can delete your account yourself at any time from your profile; if anything about you remains elsewhere, ask us and we will remove it.
  • Stop using your data for a while, while a dispute about it is sorted out.
  • Hand over the data you gave us in a machine-readable format.
  • Stop processing that we base on our legitimate interests.
  • Withdraw a consent you gave — turning notifications off, or rejecting statistics under “Cookie settings”, does exactly that, and it does not affect anything done before.

Write to the address below to exercise any of these. We answer within one month. We may need to confirm who you are first, so that we do not hand your data to somebody else.

If you think we have handled your data wrongly, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, cpdp.bg), or to the supervisory authority in the EU country where you live.

Children

localz is not aimed at children. You have to be at least 16 to create an account, and we do not knowingly collect personal data from children under that age. If you believe a child has given us their data, tell us and we will delete it.

Changes to this policy

We may update this policy as the site changes. The date at the bottom always shows when it last changed. If a change materially affects how we handle your personal data, we will say so on the site rather than expect you to notice.

Contacting us

Questions about this policy, or a request about your data, can be sent through the contacts page or to the address below.

[email protected]

Last updated on 2026-10-25