Legal information
Privacy Policy
What data CityVibe uses when you look for events, save favorites or get alerts, why, how long we keep it and what your rights are. There are no accounts: we never ask for your name, e-mail or phone number.
- Last updated:
- In force from:
- 30 October 2026
- Version:
- 1
In short
- CityVibe is a free events site. You need no account, and we never ask who you are.
- Your favorites and settings stay in your browser. Your favorites reach our server only while your alerts are on, so that we can send you reminders.
- Google Analytics starts only if you say yes in the cookie window. You can change your choice at any time from “Cookie settings” at the bottom of the page.
- We also count visits with our own statistics, without cookies and without keeping your IP address.
- The server is in the European Union (Finland). We do not sell data or show personalised ads.
- For any question or request about your data, write to hello@fidens.ro.
Who is responsible for your data
The controller, within the meaning of Regulation (EU) 2016/679 (“GDPR”), is FIDENS SRL, CUI (tax ID) RO15535908, Trade Register number J12/1717/2003, registered office Cluj-Napoca (“we”).
- E-mail: hello@fidens.ro
- E-mail for personal data: hello@fidens.ro
The same details are on the Contact page.
What data we use, why and for how long
The table lists every situation in which we use data. The details on statistics and on alerts are in the next sections.
| When | What data | Why | Legal basis | How long |
|---|---|---|---|---|
| Visiting the site (server logs) | IP address, date and time, the address of the page or request (it may contain what you searched for or which events you saved), the page you came from, your browser and operating system. | To deliver the pages, find errors and protect the site from attacks and abuse. | Legitimate interest (Art. 6(1)(f) GDPR) | 14 days |
| Our own statistics, without cookies | Daily totals: the pages viewed, the city picked, the device type and the site you came from (its name only). For the number of visitors, a code that changes every day, computed from the IP address and browser. For each event: how often it was viewed and what is clicked on its page. What is searched for on the site. For alerts, whether they were shown or opened. | To know what is useful on the site and what needs fixing, without tracking anyone. | Legitimate interest (Art. 6(1)(f) GDPR) | The daily code: one day at most. Totals: 25 months. Per-event totals: 13 months. Searches: 90 days at most. Whether alerts were shown or opened: 30 days, with their history. |
| Google Analytics, only with your consent | The random code in the _ga cookies, the pages visited (their address may contain the city picked and the text searched for), what you click (for example share, tickets), the site you came from, your device and browser, language, and approximate location from the IP address. | To see how the site is used, from aggregate statistics. | Consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law no. 506/2004) | The cookies: 13 months. The data in Google Analytics: 2 months. |
| Alerts (push notifications), if you turn them on | The browser’s technical notification address and its encryption keys, a random device code, language, the system type (for example Android or iOS), what you chose (cities, categories, frequency, reminders) and the history of alerts sent. | To send you the alerts you asked for. | Consent (Art. 6(1)(a) GDPR), given when you turn alerts on and allow them in the browser | Until you remove the site’s notification permission in your browser (see Alerts, in detail). We delete the subscription of a device that has not visited the site for 12 months automatically. Alert history: 30 days. |
| Favorites | The list of saved events. It reaches the server only while this device has alerts, linked to its random code. | So you can find them again and we can send you reminders before the event. | On your device: the feature you use. On the server: the consent given for alerts (Art. 6(1)(a) GDPR). | On your device: until you remove them. On the server: until you remove them or remove the site’s notification permission (we then delete them at your next visit). We delete them from the server automatically 30 days after the event ends, and at the latest 30 days after the device no longer has alerts. |
| Settings kept only on your device | The city and language you picked, recent searches, your cookie choice, the windows you closed and copies of pages for offline use. | So you find the site as you left it and it loads fast. | They never reach us. They are strictly necessary (Art. 4(6) of Law no. 506/2004). | See the cookie policy. |
| Your location, only if you allow it | Your device’s position, only if you let the browser share it. | To pick the nearest city. | Consent, through the browser permission | We never receive or keep it: it is used only in your browser, which keeps only the city picked. |
| Maps (Google Maps) | Only when you ask for the map (“Show the map (Google Maps)” on an event page, “Map” on the home page), your browser loads it from Google, which receives your IP address, browser details and the page address. | So you can see where the event takes place. | Legitimate interest (Art. 6(1)(f) GDPR) | We keep nothing. Google uses the data under its own policy. |
| Messages you send us | Your e-mail address, your name if you write it, and what you write. | To answer you and handle requests about data. | Legitimate interest (Art. 6(1)(f) GDPR); for requests about data, a legal obligation (Art. 6(1)(c) GDPR) | 12 months after the request is closed |
| Event information | Names of organisers and performers, as they appear in the events’ public listings. | To present the events. | Legitimate interest (Art. 6(1)(f) GDPR) | As long as the event is on the site, then in the site’s archive, until you ask us to correct or remove it. |
| Backups | Daily copies of the database (alerts, their settings, favorites, alert history) and of the server files. | To restore the site after a failure or an attack. | Legitimate interest (Art. 6(1)(f) GDPR) | 30 days |
We did not receive the event information from the people named in it, but from the events’ public listings (Art. 14 GDPR). If you are an organiser or a performer and want your name corrected or removed, write to hello@fidens.ro.
Our own statistics, in detail
We count visits with our own system, on our own server. It stores nothing on your device (no cookies, nothing in browser storage) and reads nothing from it.
What we count
- Per day: how many pages are viewed, by type (home, event, search…), the city picked, the device type (phone, tablet or computer) and the name of the site you came from.
- Which events are viewed and what is clicked on their page: tickets, directions, add to calendar, share, favorites.
- Whether an alert was shown or opened. It is noted on the alert’s row in the history and deleted with it, after 30 days.
Unique visitors
To estimate how many different people visit in a day, the server computes a short code from the IP address and browser, mixed with a random value that changes every day. We keep neither the IP address nor the browser. The code and the day’s value are deleted at 00:15 the next day (Romanian time). After that only totals remain, which can no longer be linked to anyone.
Searches
We keep the text searched for only in lower case, without diacritics or punctuation, between 2 and 40 characters. We keep no search at all that contains @, 5 or more digits, a website address or more than 6 words. A term appears in the statistics only once it has been searched for at least 3 times. Rarer terms are deleted after 7 days, and all of them after 90 days.
What we do not count
- Anything from you, if your browser sends the Global Privacy Control or “Do Not Track” signal.
- Visits by the site’s administrators, bots and the administration pages.
We keep the daily totals for 25 months and the per-event totals for 13 months. You can object to these statistics at any time (see “Your rights”); the simplest way is to turn on Global Privacy Control in your browser.
Alerts, in detail
Alerts are optional. You turn them on from the Alerts page, and the browser then asks for your permission. Without both, you get nothing. At the start only the alerts about featured events in your city are on; you choose the rest. Featured events are picked by our team; nobody pays for them. If we ever have events promoted for a fee, we will mark them “Promoted”, and only people who separately turn on offer alerts will get alerts about them.
For alerts we keep the browser’s technical notification address (a unique address at the notification service of your browser’s maker) and its encryption keys, a random device code, the language, the system type and what you chose: cities, categories, frequency, reminders. We do not know who you are: we have no name, e-mail or phone number of yours.
Alerts are encrypted for your browser: the notification service delivers them but cannot read them. We keep their history (which alert, when, whether it left, whether it was shown or opened) for 30 days.
Favorites reach the server only while this device has alerts, so that we can send you reminders. We delete them there when you remove them from your favorites or after you remove the notification permission (see below). An event that has ended has no reminders left, so we delete it from the server 30 days after it ends; it stays in the list on your device.
Alerts with offers, if they ever exist, are commercial communications: you get them only if you turn them on separately. They start off.
How to stop them
- On the Alerts page, “Disable all” turns every alert type off.
- To have the subscription deleted too, remove the notification permission for cityvibe.ro in your browser settings. At your next visit to the site we delete the device’s subscription, settings, history and favorites from the server, and the browser forgets its code. If you do not come back, at the next alert sent the notification service tells us the address no longer works, and we delete the subscription with its settings and history.
- We delete the subscription of a device that has not visited the site for 12 months automatically, with its settings and history. We delete the favorites of a device without alerts at the latest after 30 days.
Who else receives data
We do not sell data or give it to anyone for advertising. Only the providers the site cannot work without receive it:
- Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) hosts the server, database, logs and backups in a data centre in Helsinki, Finland. It works for us, on our instructions (processor, Art. 28 GDPR).
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), for Google Analytics, only if you said yes. We use neither Google Signals nor the advertising features of Google Analytics.
- Google, for Google Maps, only when you ask for a map. Here Google uses the data as an independent controller, under its privacy policy.
- The browsers’ notification services, which deliver the alerts, depending on your browser: Google Firebase Cloud Messaging (Chrome and other Chromium-based browsers), Apple Push Notification service (Safari, iPhone and iPad), Mozilla Push Service (Firefox) and Microsoft Windows Push Notification Services (Edge). They receive only the technical address and the encrypted alert.
- Romarg SRL, which hosts our mailboxes, when you write to us.
Facebook and Instagram: the site has only plain links to our pages, with no Meta code. On those pages, Meta Platforms Ireland Limited uses data under its own policy. We use the pages’ statistics (Page Insights), which Meta shows us only as totals. For these we are joint controllers with Meta (Art. 26 GDPR), and you can also send your requests about them to Meta.
When you click the tickets button, you go to the seller’s site, which is responsible for the data you give it there. Data may also reach public authorities, but only when the law requires it.
Data outside the European Union
Our server is in the European Union. Some of the providers above are US companies or may send data to the US: Google LLC, Apple Inc., Microsoft Corporation and Mozilla Corporation. Such transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023) for certified companies, or on the standard contractual clauses approved by the European Commission. The list of certified companies is at dataprivacyframework.gov.
Your rights
You have the right:
- to know what data we hold about you and to get a copy (Art. 15 GDPR);
- to have it corrected (Art. 16);
- to have it deleted (Art. 17);
- to have its use restricted (Art. 18);
- to receive it in a format that is easy to use and move (Art. 20);
- to object to its use on the basis of legitimate interest, for example for statistics or logs (Art. 21);
- to withdraw your consent at any time, without affecting what was done before (Art. 7(3));
- to complain to ANSPDCP, the Romanian authority (www.dataprotection.ro), or to the authority of the EU country where you live (Art. 77).
Write to hello@fidens.ro. We answer free of charge, within one month. For complex requests this can be extended by two more months, and we will tell you if it is.
There are no accounts and we do not know who you are, so we cannot find you by name or e-mail. The data on the server is linked only to your device’s random code. You can control much of it yourself: you delete favorites and settings in your browser, and you stop alerts as described in the alerts section. If you write to us, we help you find your device’s data without asking for any other personal data.
How to withdraw your consent
- Google Analytics: “Cookie settings” at the bottom of any page, or from the cookie policy. After a no, we delete the _ga cookies and Google Analytics no longer starts.
- Alerts: as described in Alerts, in detail.
- Location: in your browser settings, under the location permission for cityvibe.ro.
- Our own statistics: turn on Global Privacy Control or “Do Not Track” in your browser.
Automated decisions
We make no automated decisions with legal effects on you and no profiling of the kind in Art. 22 GDPR. Choosing alerts by the cities and categories you ticked is not such a decision.
Age
Anyone can read the site. Alerts are for people aged 16 or over; under 16, turn them on only with a parent’s consent (Art. 8 GDPR). If you find out that a child under 16 turned alerts on without consent, write to us and we will delete the data.
How we protect data
- The whole site works only over encrypted connections (HTTPS).
- The server is in the European Union, it can be administered only with cryptographic keys, and the database cannot be reached from the internet.
- Alerts are encrypted all the way to your browser.
- The administration pages are protected by a password.
- We keep as little data as we can: no accounts, and no names, e-mails or phone numbers for alerts.
Changes
When we change this policy, we change the date at the top. If the change is important (for example a new provider or new data), we announce it on the site and, where needed, ask for your consent again.