Legal information · Live event platform

Live event platform privacy

Last updated: October 2026

This policy describes how Nomacast processes the personal data of participants in live events broadcast via its event platform (URLs /i/<token>, /chat/<slug> and /event-admin/<slug>). It is a distinct policy from the general privacy policy of the marketing site nomacast.fr, which only covers quote requests and browsing the commercial site.

Scope of this policy

Any processing of personal data within the context of a live event organised by a Nomacast client and broadcast via the event platform (live chat, moderated Q&A, polls, quizzes, idea board, reactions, quotes, presence tracking, engagement analytics).

Roles: data controller and processor

For each event broadcast via the platform, two distinct GDPR roles are involved:

The client organiser (the company commissioning the event, shown as "organised by" on the participant page) is the data controller within the meaning of Article 4(7) of the GDPR. The client decides to hold the event, chooses which participants to invite, configures the interactive tools enabled, and exploits the resulting analytics.
Nomacast acts as a processor within the meaning of Article 4(8) of the GDPR. The platform is made available to the client organiser for the duration of the event and the associated retention period, under a Data Processing Agreement (DPA) attached to the quote.

Participants in a live event are therefore invited to contact the client organiser first for any data-related request. Nomacast assists the data controller in responding to such requests within the legal time limits.

Processor contact details

MatLiveProd, trading as Nomacast

French EURL with a share capital of €1,000, Paris RCS 909 103 335

Registered office: 49 rue de Ponthieu, 75008 Paris, France

Represented by Jérôme Bouquillon, managing director

Email: [email protected]

Phone: +33 6 60 54 17 32

Full details on the legal notice page.

Data collected by the event platform

Depending on the interactive tools activated by the client organiser for the event, the following data may be collected and processed:

Participant identity: full name and email address. Provided by the client organiser (private event with invitation) or entered by the participant (public event).
User-generated content: messages sent in the live chat or in moderated Q&A, questions submitted ahead of the event, votes in polls and quizzes, ideas shared on the idea board, selected quotes, emoji reactions.
Technical usage data: IP address stored only as a cryptographic HMAC-SHA-256 hash (the original value is never retained), browser user-agent, connection and submission timestamps.
Presence statistics: connection duration (watchtime), presence history aggregated via periodic heartbeats.
Speakers' statements: when live captioning or the written report is enabled for the event, the broadcast audio is automatically transcribed (and translated where applicable) to produce the captions, transcript, summary and replay chapters.
Engagement analytics: number of messages sent, votes cast, reactions clicked, resources viewed, CTAs clicked, quotes shared (depending on the tools enabled).

No sensitive data within the meaning of Article 9 of the GDPR (health, political opinions, religion, sexual life, biometric data, etc.) is collected. No advertising or third-party profiling cookies are placed on the event platform pages.

Processing purposes

Your data is used solely for:

Live animation of the event (display of messages, votes, reactions, presence) on behalf of the client organiser.
Technical moderation of the chat and prevention of abuse (anti-spam filters, abnormal behaviour detection).
Production of aggregated engagement and presence statistics for the client organiser (post-event reporting).
Replay of the event during the retention period, when enabled by the client organiser.
Security and technical traceability of accesses (authentication logs, per-invitee action traceability, timestamps).

No data is used for commercial prospecting, advertising profiling or resale to third parties.

Legal basis for processing

The legal basis is determined by the client organiser as data controller, depending on the event context:

Performance of a contract or pre-contractual measures (GDPR Article 6.1.b): for events aimed at the organiser's clients, prospects or partners in a contractual setting.
Legitimate interest of the client organiser (GDPR Article 6.1.f): for internal events (staff, teams), professional conferences, or any B2B event where the participant is invited in a clearly identified professional context.
Explicit consent of the participant (GDPR Article 6.1.a): when the event collects data beyond what is strictly necessary for it to take place (for example, opt-in to receive post-event communications).

Retention period

The retention periods applied by the platform are as follows:

Event data (chat messages, votes, reactions, presence, analytics): 90 days by default after the end of the broadcast, configurable between 30 and 365 days at the client organiser's discretion. Beyond that, automatic deletion.
Client authentication logs (auth_logs table, admin access): 90 days, for traceability and security purposes, then automatic deletion.
IP hashes: same duration as the associated actions (messages, votes), then deleted jointly.
Video replay (when enabled): 30 days by default from the end of the broadcast, hosted on Cloudflare Stream (European region). An MP4 download is also provided for the client organiser's own archive needs. Hosting extension is available on request, billed per additional 30-day period.
Early erasure request: upon request from the client organiser or a participant exercising their right to erasure, effective deletion within 30 days maximum, without waiting for the end of the standard retention period.

Recipients and sub-processors

Your data is accessible to:

The client organiser of the event (data controller), via their dedicated administration interface /event-admin/<slug>, protected by login/password credentials.
Nomacast, as a processor, for technical maintenance of the platform and support to the organiser.
The technical sub-processors listed below, strictly within the scope of their hosting and delivery services, with no commercial access to the data.

No data is sold, transferred or rented to third parties for commercial purposes.

Cloudflare Inc. (101 Townsend Street, San Francisco CA 94107, USA) and its GDPR subsidiary Cloudflare Ireland Ltd. (Dublin, Ireland): event platform hosting (Cloudflare Pages), event database storage (Cloudflare D1, contractual European Union jurisdiction, Cloudflare European zone), client logo and resource storage (Cloudflare R2, European region), partner code and anti-spam storage (Workers KV), live and replay video delivery (Cloudflare Stream, European region), screen sharing signalling (Cloudflare Workers), generation of summaries, chapters and automatic answers from transcripts (Cloudflare Workers AI), anti-bot protection on the quote form (Turnstile). Transfers outside the EU are framed by the Standard Contractual Clauses adopted by the European Commission and the Cloudflare Data Processing Addendum.

Gladia (Paris, France): automatic speech transcription and live translation, only when live captioning or the written report is enabled for the event.

Resend Inc. (United States): sending of invitation emails to participants from the technical address [email protected]. Resend relies on Amazon SES (Ireland region, eu-west-1) for actual delivery. Transfers outside the EU are framed by the Standard Contractual Clauses and the Resend Data Processing Addendum.

Google Ireland Ltd.: professional inbox [email protected] used to receive rights-exercise requests and correspondence related to events. No use of Google Analytics or Google Ads on the event platform pages (no advertising tracking on /i/<token>, /chat/<slug>, /event-admin/<slug>). Participant pages do however load typefaces from Google Fonts, which transmits the participant's IP address to Google.

Transfers outside the European Union

The event platform is designed to minimise transfers outside the EU. Event data (messages, votes, analytics) is stored within Cloudflare's European infrastructure, with the relational database (Cloudflare D1) under contractual European Union jurisdiction (Cloudflare European zone). Invitation emails transit through Resend (United States) and then Amazon SES in Ireland before being delivered. All these transfers are framed by the Standard Contractual Clauses adopted by the European Commission and by the compliance policies of the relevant sub-processors.

Security: technical and organisational measures

Nomacast implements the following measures to protect your data:

Encryption in transit: all traffic over HTTPS / TLS 1.3 via Cloudflare.
IP pseudonymisation: IP addresses stored exclusively as HMAC-SHA-256 cryptographic hashes, never in plain text.
Strong client authentication: passwords hashed with PBKDF2 (100,000 iterations SHA-256, random per-user salt).
Secure session cookies: HttpOnly + Secure + SameSite=Lax flags, HMAC-signed.
Event isolation: strict separation between events (no possibility of accessing data from another event with a given token).
Access traceability: logging of authentication attempts (auth_logs table) to detect abnormal behaviour.
Anti-injection protection: systematic escaping of user content (escapeHtml on output), strict server-side input validation.
Non-indexable platform pages: robots: noindex, nofollow, noarchive meta tag on all participant pages to prevent public exposure.

Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

Right of access: obtain a copy of the data concerning you processed in the context of the event.
Right to rectification: have inaccurate or incomplete data corrected (name, email).
Right to erasure ("right to be forgotten"): request the deletion of your data, executed within 30 days maximum.
Right to restriction of processing.
Right to object to processing based on legitimate interest.
Right to portability of your data in a structured, machine-readable format.
Right to withdraw consent at any time when processing is based on that legal basis, without affecting the lawfulness of prior processing.

To exercise these rights, two routes are available:

1. With the client organiser (data controller, priority route)

Contact the company shown as "organised by" on the event page directly. The client organiser has an early erasure feature in their administration interface to immediately delete your data.

2. With Nomacast (processor, as relay)

Write to [email protected], specifying the event concerned (date, title, organiser) and the subject of your request. Nomacast will forward the request to the data controller and assist in its execution. A response will be provided within one month maximum, in accordance with Article 12 of the GDPR. Proof of identity may be requested in case of reasonable doubt.

Personal data contact

MatLiveProd has not appointed a Data Protection Officer (DPO), as such an appointment is not mandatory for its activity (GDPR Article 37). For any question relating to the event platform, the exercise of rights or a security incident, the single point of contact is Jérôme Bouquillon, managing director.

Contact: [email protected]

Maximum response time: one month, in accordance with Article 12 of the GDPR.

Personal data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, Nomacast undertakes to notify the client organiser (data controller) within a maximum of 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR. The client organiser, as data controller, will then proceed where applicable to notify the supervisory authority (CNIL in France) and inform the data subjects concerned.

Lodging a complaint with the CNIL

If, after contacting the client organiser or Nomacast, you consider that your rights have not been respected, you may lodge a complaint with the French Data Protection Authority (CNIL):

3 place de Fontenoy, TSA 80715

75334 Paris Cedex 07, France

www.cnil.fr/en/plaints

Changes

This policy may evolve to adapt to legal, technical or organisational developments of the platform. The date of the last update is shown at the top of the page. Participants in an event will be informed of substantial changes via the event's landing page.