GDPR
Webinars run on our servers in Germany and Finland under a public data processing agreement, and the company behind them is registered in Lithuania. Each point below links to the document or the setting it comes from.
Where the data is
EU hosting means different things on different sites. Here is what it means on ours.
The servers that carry webinar traffic stand in Germany and Finland, and recordings, uploaded files and attendee lists are stored there and nowhere else. All of our data centres are in the European Union and follow the Tier III standard.
Source Why your speed to EU servers is slower than SpeedtestPrivacy policy, §8
Invitations and reminders for upcoming webinars are sent from our mail servers in the Netherlands and France, run by velia.net and OVH.
Source Why your speed to EU servers is slower than Speedtest
On their way to viewers, the broadcast, recordings and files pass through the delivery networks of Cloudflare, Bunny.net and Amazon CloudFront, which have servers around the world, so that people far from Europe get a smooth picture too.
Source About us
MyOwnConference is operated by Akovana, UAB, registered at Didžioji Street 18 in Vilnius, Lithuania.
Source Privacy policy
Everything you broadcast travels over TLS. Presentations, videos and other files you upload are stored encrypted with AES-128.
Source Privacy policy, §8
This website sets no cookies until you answer the consent banner, and "Cookie settings" in the footer lets you change that answer at any time. Visitor statistics come from Plausible Analytics, which uses none, and the support chat loads only after you accept.
Source Privacy policy, §5
Data processing agreement
The agreement is published on this site and applies to every account from sign-up. These are the clauses compliance teams usually ask about first.
We process attendee data only to run your webinars and only as you instruct, and that includes any transfer to another country.
Source DPA, §2
Before a new sub-processor starts handling your attendees' data, we tell you at least 21 days in advance.
Source DPA, §1
If a breach affects personal data, we notify you without undue delay and describe what happened, which data and how many people it touches, the likely consequences and what we are doing about it.
Source DPA, §2
When the agreement ends, or earlier if you ask, we stop processing and delete or return the data, unless EU or member state law requires us to keep it.
Source DPA, §2
You or an auditor you appoint can check how we meet Article 28 of GDPR. We answer questions about the agreement with evidence within 3 days and fix what an audit finds within 7 days.
Source DPA, §2 and §3
Anything the agreement leaves open is governed by Lithuanian law, including GDPR.
Source DPA, §7
Does your company need a signed copy? Write to us and we will sign the agreement with you. [email protected]
In your control panel
Most of these live in the settings of a single webinar or room, so you decide event by event.
A permanent room asks for "Full name" and nothing more, and a nickname will do. A scheduled webinar adds "Email", because reminders go there. Add other fields only when the event needs them. "Allow sign-up with social accounts" decides whether attendees can come in with a Google or Microsoft account.
"Anonymize attendee names" shows attendees only each other's initials, "Hide attendees list" takes the list away, and turning off "Show host name" keeps the host's name off the broadcast. Your moderators still see everyone in full.
Source Anonymous webinar and participant data protection under GDPR
Turn off "Including the moderators' names" and "Including a list of attendees", and the recording keeps the slides, screen sharing, speech and audience interaction without presenter name labels or a closing list of attendees.
Source Anonymous webinar and participant data protection under GDPR
With "Chat moderation" on, a message reaches the chat only after a moderator approves it. Once the webinar ends, attendees can no longer read the chat, and the history stays in your control panel.
Source Anonymous webinar and participant data protection under GDPR
"Invitation link login only" leaves personal invitation links as the only way in. Each link holds one seat, "Restrict access" emails a one-time code to the invited address, and the account itself can require a code from an authenticator app.
Source Platform security
"Export attendees" downloads the list as CSV or Excel with the columns you pick. Deleted files wait in "Trash" for seven days, and deleting your account in "Profile" removes it and everything stored in it for good.
Sub-processors
Grouped by what they touch. The DPA commits us to tell you 21 days before a new one starts handling your attendees' data.
| Company | What it does |
|---|---|
| Hetzner | Servers for webinar traffic and storage in Germany and Finland |
| velia.net, OVH | Mail servers that send invitations and reminders, in the Netherlands and France |
| Cloudflare | Delivery network for the broadcast, recordings and files |
| Bunny.net | Delivery network for the broadcast, recordings and files |
| Amazon CloudFront | Delivery network for the broadcast, recordings and files |
| Company | What it does |
|---|---|
| Crisp | Support chat on this website, loaded only after you accept cookies |
| Plausible Analytics | Visitor statistics for this website, without cookies |
| Paysera, Revolut, PayPal | Payments for plans, with card details kept on their side |
| Company | What it does |
|---|---|
| Google, Microsoft | Attendee sign-up with a Google or Microsoft account |
| Google Tag Manager | Traffic analytics on your webinar pages once you add a GTM ID |
| PayPal | Ticket sales for paid webinars, paid into your own PayPal account |
| YouTube | YouTube videos and live streams you play in the room |
Your part
As the organiser you decide which attendee data to collect and why. That makes you the controller, and a few duties stay with you on any platform.
Your privacy notice and the legal basis for collecting attendee data are yours to provide. If an attendee writes to us instead of you, the DPA commits us to pass the request on and help you answer it.
Source DPA, §2
The webinar room shows attendees no recording indicator, so telling them that a session is recorded is up to you.
Source Webinar attendee guide
A CRM you connect through the API, the PayPal account behind a paid webinar and a YouTube video played in the room each follow their own provider's terms.
Source MyOwnConference public API
Anyone you give full access to your control panel or webinar rooms can delete material, so keep that access for people you trust.
FAQ
Short answers for compliance checks and data protection officers
Still have questions? Contact usEU-hosted webinars
Start on the free plan, try the settings above in your own control panel and read the DPA before your first event
EU-hosted • GDPR compliant • Free forever plan • No payment card
