Privacy policy

This policy covers two different relationships, because this platform serves two different kinds of people, and they are not the same.

• You, visiting this website. If you fill in the "Request a demo" or "Contact us" form, Castkom is the one deciding what happens with what you send — we are responsible for that data.
• You, registered for an event that runs on Castkom. The organiser who set up that event decided what their registration form asks for, and owns the data it collects. Castkom operates the platform that stores and processes it on the organiser's behalf — we are not the one deciding what your data is used for.

Enquiries submitted through this website

When you submit the demo-request or contact form, we store what you typed: name, work email, phone number, company, role, city, and — for a demo request — the event name, event date, expected attendee band and expected exhibitor band, plus any notes you added. A general enquiry stores a subject and message instead.

We also record which page the form was submitted from and any campaign parameters your link carried, along with your browser's user agent — this tells us which page or campaign an enquiry came from, nothing more.

Your IP address is not stored. What we keep is a one-way SHA-256 hash of it — enough to notice one source submitting the form repeatedly in a short window, not enough to recover your actual address or to build a record of who visited the site. We do not otherwise log visits to this website.

This data is visible only to Castkom staff who handle sales enquiries, inside an internal console. [Retention period — placeholder: this system does not yet define a fixed retention period for enquiry data.]

If you registered for an event run on Castkom

Registration details. The organiser running the event chooses what their registration form asks for — Castkom does not set those fields. Whatever you submitted through that form is stored so the organiser can process your registration and, once approved, issue your ticket.

Verifying your email or phone. Before a registration completes, we may text or email you a one-time code to confirm you actually own that contact detail. That code is never stored as plain text — only a cryptographic hash of it — and a submission is rejected outright after five incorrect attempts. The code itself expires after ten minutes.

Your entry ticket. Once a registration is approved, we issue a signed QR code as the entry ticket. The database never holds a working copy of that code — only a one-way digest of it, derived per event, so a copy of our database is never a stack of usable tickets. The code itself is cryptographically signed, so it cannot be altered or forged without the forgery being detectable at the door.

Scan records. Every scan of your ticket at an event is recorded — admitted, already used, wrong event, expired, or rejected as a forgery — along with when it happened. A failed or forged scan is logged exactly the same way a successful one is; that is also how a forged or copied code would be caught.

Badge printing. If the event prints physical badges, the same registration details are used to produce them.

Who processes this on our behalf

We use MSG91, an Indian communications provider, to send the emails and WhatsApp messages this platform generates — verification codes, ticket delivery, registration confirmations, and sales follow-up. MSG91 receives only what a given message needs: the recipient's email address or phone number, and the content of that message.

Self-hosting

Castkom Event OS can also be run entirely on infrastructure an organiser controls instead of infrastructure Castkom operates. Where that is the case, none of that organiser's event or attendee data passes through Castkom-operated servers at all — this policy describes Castkom's own hosted service, not a self-hosted deployment.

Who owns attendee data

Data collected through an organiser's event belongs to that organiser, not to Castkom. Castkom operates the platform the organiser uses to collect and manage it; we are not the party deciding what becomes of it afterward. A question about a specific event's data should go to the organiser who ran that event, not to Castkom.

Audit logging

Privileged actions inside an organisation's account can be recorded in an audit trail. Whether this is switched on is a setting each organiser controls for their own account. Turning it off stops new entries from being written from that point on — entries already recorded are kept, not deleted.

Your rights, and who to ask

[Data protection contact — placeholder: no dedicated privacy contact or Data Protection Officer has been appointed yet.] Until one is, direct a privacy question to hello@castkom.com and it will be routed appropriately — that address is Castkom's general sales inbox, not a dedicated privacy line.

Changes to this policy

We will update the date at the top of this page whenever this policy changes in a way that matters. Because it is still marked draft, expect it to change at least once more — when legal review is complete.

Company details

[Legal entity name and company registration number — placeholder, not present anywhere in this repository.]
[Registered address — placeholder.]
[Governing jurisdiction — placeholder.]