Privacy Policy

Last updated 25 June 2026

This Privacy Policy explains how Geniva accesses, collects, stores, uses and shares your personal information when you use our services (the "Services"), including when you download and use the Geniva mobile application, visit geniva.co.uk, or otherwise engage with us.

Geniva is a university social platform that brings together events, sports, ticketing and group chat for student societies and their members. We are responsible for deciding how your personal information is processed. If you do not agree with this policy, please do not use the Services.

Who we are. The Services are currently operated by Joshua Hinder, trading as Geniva, a sole trader registered with the UK Information Commissioner's Office (registration number ICO00014031434). We intend to incorporate as a limited company before our public launch; when we do, the data controller will become that company (Geniva Ltd) and this policy will be updated to reflect it.

Questions? Contact us at [email protected].

Summary of key points

This summary highlights the main points. Use the table of contents to jump to any section in full.

What information do we collect? We collect the personal information you provide when you create an account and use the Services — such as your name, email address, username, society memberships and event activity. We do not collect your location.

Do we process sensitive information? We do not deliberately collect special category data. However, your membership of certain societies could reveal information such as religious belief or sexual orientation. We explain how we handle that below.

Do we collect information from third parties? No. We only collect information directly from you.

How do we process your information? To provide and run the Services, enable events, ticketing and chat, keep the platform safe and secure, and comply with the law. We process information only when we have a valid legal basis.

Who do we share it with? Only the service providers needed to operate Geniva (such as our hosting, payment and notification providers). We do not sell your personal information or share it for third-party marketing.

Where is your data held? Your account data is stored in the European Economic Area (Frankfurt, Germany). Some providers are based in the United States; we explain the safeguards for those transfers below.

What are your rights? Depending on where you live, you may have rights to access, correct, delete or restrict the use of your personal information. You can exercise these in the app or by contacting us.

What information do we collect?
How do we process your information?
What legal bases do we rely on?
When and with whom do we share your information?
Is your information transferred internationally?
How long do we keep your information?
How do we keep your information safe?
Do we collect information from minors?
What are your privacy rights?
Controls for do-not-track features
Do we make updates to this policy?
How can you contact us?
How can you review, update or delete your data?

01What information do we collect?

Personal information you provide to us

In short: We collect the personal information you give us when you register and use the Services.

We collect personal information that you voluntarily provide when you register, use the Services, take part in activities (such as joining a society, posting, or buying a ticket), or contact us. This may include:

names
email addresses
usernames
passwords (stored only in encrypted, hashed form by our authentication provider — we never see or store your password in plain text)
contact and notification preferences
society memberships and the events you create, join or attend
messages and content you post in society and event group chats

Payment information

If you buy a ticket, your payment is processed by Stripe. Stripe collects and handles your card details directly — Geniva does not receive, see or store your full card number, security code or billing card details. We receive only confirmation of payment and limited transaction details needed to issue your ticket. You can review Stripe's privacy notice at stripe.com/gb/privacy.

Sensitive (special category) information

We do not ask for, or deliberately collect, special category data — for example information about your health, racial or ethnic origin, religious beliefs, or sexual orientation.

However, because Geniva lets you join societies, your membership of a particular society could indirectly reveal special category information — for example, joining a faith society may suggest a religious belief, or joining an LGBTQ+ society may suggest sexual orientation.

Where this happens, we rely either on the "not-for-profit body" condition in Article 9(2)(d) of the UK GDPR (which covers societies processing data about their own members) or on your explicit consent. For each society's membership list, the society itself decides how that data is used and acts as the data controller, and Geniva acts as its data processor — meaning we only handle that membership data on the society's instructions.

Information collected automatically

In short: We collect a limited amount of technical information needed to run and secure the Services.

When you use the Services, our hosting and infrastructure providers automatically record limited technical information in server logs — principally your IP address, basic device and operating-system information, and diagnostic data such as error reports. We use this only to operate, secure and troubleshoot the Services. We do not collect or track your location, and we do not use this technical data to build advertising profiles.

If you use the mobile application, we may also process the device identifiers needed to deliver push notifications you have asked to receive.

02How do we process your information?

In short: We process your information to provide and improve the Services, communicate with you, keep the platform safe, and comply with the law.

We process your personal information for the following purposes:

To create and manage your account and keep you logged in.
To deliver the Services — including events, ticketing, society and event group chats, and the features you choose to use.
To enable communication between users through group chats and related features.
To respond to your enquiries and provide support.
To send you administrative messages about your account, changes to our terms, and other service-related matters.
To keep the platform safe and lawful — including moderating content, preventing fraud and abuse, and meeting our obligations under the Online Safety Act 2023.
To protect vital interests where necessary to prevent harm to you or others.

03What legal bases do we rely on?

In short: We only process your personal information when we have a valid legal reason to do so under the UK GDPR.

The UK GDPR requires us to explain the legal bases we rely on. Depending on the activity, these are:

Performance of a contract. We process your information to provide the Services you sign up for and to fulfil our agreement with you — for example, creating your account and issuing tickets you purchase.
Legitimate interests. We process some information where it is in our legitimate interests and not overridden by your rights — for example, to keep the Services secure, prevent fraud and abuse, understand how the Services are used, and improve them.
Consent. We rely on your consent for specific activities, such as sending you push notifications or, where relevant, processing data revealed by your society memberships. You can withdraw consent at any time.
Legal obligations. We process information where necessary to comply with the law, including our duties under the Online Safety Act 2023 and to cooperate with law enforcement or regulators.
Vital interests. We process information where necessary to protect someone's life or safety.

04When and with whom do we share your information?

In short: We share information only with the service providers that help us operate Geniva, and in a few specific legal situations.

We use trusted third-party providers to run the Services. They may access your personal information only to perform tasks on our behalf and on our instructions, under contracts designed to keep your data safe. They may not use it for their own purposes. The providers we rely on are:

Supabase — database hosting, authentication, and storage of account data and messages.
Vercel — hosting of our application and interface.
Stripe — payment processing for ticket purchases.
Expo — delivery of push notifications.

We may also disclose your information:

To comply with the law or respond to lawful requests from public authorities.
In connection with a business transfer — for example if Geniva is involved in a merger, acquisition or sale of assets, in which case your information would remain protected by a policy at least as protective as this one.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

05Is your information transferred internationally?

In short: Your account data is stored in the EEA. Some of our providers are based in the United States, with safeguards in place.

Your core account data — including your profile, society memberships and chat messages — is hosted by Supabase in Frankfurt, Germany, within the European Economic Area (EEA). Transfers of personal information from the UK to the EEA are permitted under the UK's data protection adequacy regulations, so no additional safeguard is required for this data.

Some of our other providers — including Stripe, Vercel and Expo — are based in the United States, which means some personal information may be transferred there. Where that happens, the transfer is protected by appropriate safeguards recognised under the UK GDPR, such as the UK International Data Transfer Agreement or Standard Contractual Clauses together with the UK Addendum, as set out in each provider's data processing terms. You can ask us for more information about these safeguards using the contact details below.

06How long do we keep your information?

In short: We keep your information only for as long as we need it, usually while your account is active.

We keep your personal information for as long as your account is active, and for as long afterwards as we need it for the purposes set out in this policy or to meet legal obligations such as tax and accounting requirements. When we no longer need your information, we will delete it or anonymise it. Where deletion is not immediately possible — for example because data sits in secure backups — we will isolate it from further use until deletion can take place.

07How do we keep your information safe?

In short: We use appropriate technical and organisational measures to protect your information.

We have put in place appropriate technical and organisational security measures designed to protect the personal information we process, including encryption in transit, access controls and authentication safeguards. However, no method of transmission or storage is completely secure, so we cannot guarantee absolute security. You should always access the Services within a secure environment.

08Do we collect information from minors?

In short: The Services are intended for users aged 18 and over.

We do not knowingly collect data from, or market to, anyone under 18 years of age. By using the Services, you confirm that you are at least 18. If we learn that we have collected personal information from someone under 18, we will deactivate the account and take reasonable steps to delete that information. If you believe we may hold information about someone under 18, please contact us at [email protected].

09What are your privacy rights?

In short: In the UK, EEA and Switzerland you have rights over your personal information, including access, correction and deletion.

Depending on where you live, you may have the right to:

request access to, and a copy of, your personal information;
request that we correct or delete your personal information;
restrict or object to how we process your information;
request portability of your information; and
withdraw consent where we rely on it (this does not affect processing that already took place).

You can exercise these rights in the app or by contacting us — see section 13. We will respond in line with applicable data protection law.

If you are in the UK and believe we are processing your information unlawfully, you have the right to complain to the Information Commissioner's Office (ICO). If you are in the EEA, you may complain to your local supervisory authority; if you are in Switzerland, to the Federal Data Protection and Information Commissioner.

Withdrawing your consent

Where we rely on your consent, you can withdraw it at any time by updating your preferences in the app or by contacting us. This will not affect the lawfulness of any processing carried out before you withdrew it.

Notifications

You can turn push notifications on or off at any time using the notification settings inside the Geniva app, or in your device's system settings.

Marketing communications

If we send you marketing emails, you can opt out at any time using the unsubscribe link in those emails or by contacting us. We may still send you service-related messages necessary to run your account.

10Controls for do-not-track features

Most browsers and some operating systems include a "Do-Not-Track" (DNT) setting. As no uniform standard for DNT signals has been agreed, we do not currently respond to them. If a standard is adopted that we are required to follow, we will update this policy.

11Do we make updates to this policy?

In short: Yes — we will update this policy as needed to stay compliant.

We may update this policy from time to time. The updated version will be shown by a revised "Last updated" date at the top. If we make material changes, we may notify you directly or by posting a prominent notice. We encourage you to review this policy regularly.

12How can you contact us?

If you have questions or comments about this policy, you can email us at [email protected] or write to us at:

Geniva
124 City Road
London EC1V 2NX
United Kingdom

13How can you review, update or delete your data?

You have two ways to review, update or delete the personal information we hold about you:

In the app (recommended). Log in and go to your account settings, where you can review and update your details, export a copy of your data, or request deletion of your account and information.
By contacting us. If you cannot access your account, email us at [email protected] and we will help you. You can also submit a data subject access request.

When you ask us to delete your account, we will deactivate or delete it and your information from our active databases. We may retain limited information where necessary to prevent fraud, resolve disputes, comply with legal obligations, or enforce our terms.