Privacy notice

The organiser of BBYO EC26 is responsible for your data in this app (the “controller”):

Questions about your data or this notice go to the same contact. Teens can also ask any staff member, who will pass it on.

From your registration

BBYO shares these with the app: your name, email, community and chapter, track, class (your graduation year, which also puts the Seniors’ Lounge on a senior’s schedule), room, travel and bus details (your flights in and out of Budapest, and your bus number on Sunday: you see it on Today, and staff in their bus lists), dietary needs and allergies, Shabbat choices, and whether you agreed to photos. For the safety leads only: date of birth, medical, wellbeing, and emergency contact details. If Kiosk Card points were prepaid for you on BBYO’s Kiosk & Shuk order form, the app reads that order from BBYO’s Airtable, finds you by the order’s email address (or by your name, when the email isn’t one the app knows), and keeps only how many points were prepaid, not the order itself.

What you add

Your profile photo and pronouns, your socials (teens) or a short bio (staff), posts and photos in Moments, pins you give, likes, the Shuk pieces you like (everyone sees only how many likes a piece has, never who gave them), what only you can see (the posts and pins you save in Moments, the songs you like in Kumzitz, and the Shabbat quotes you like), the people you connect with (for example by scanning codes), session ratings and comments, favourite sessions, song requests, poll votes, program ideas, your game scores, your team’s Budapest hunt photos and codes (only your team and staff can open the photos, which are saved without any location or camera details), your challenges (the photos, videos, and words you send as proof, the items you tick and the challenges you mark done, the number of countries in your Most Countries Selfie, and your secret dance word; only you and BBYO EC26 staff can open your proof, and only you ever see your secret word; the challenges’ board shows each track’s score, and the Most Countries board shows the top entries’ names and counts), survey answers, and the Boulevard partner newsletters you sign up to (the partner, the email you give, and when).

What the app records

Bus check-ins (which of Sunday’s buses you got on: staff check you on by scanning your code, tapping your badge, or ticking you in a list, and the app notes which staff member did), the Budapest hunt team staff put you in (its name, its members’ first names and photos, and the staff member walking with it, shown to your team) and when you’re checked into it (by the staff member walking your team, a lead, or the core team, noting which one), which NFC badge sticker is yours (the sticker itself holds only a random code), your Kiosk Card (points for snacks at the Kiosk): the points loaded onto it (prepaid, and any the core team adds, with their note) and how points were used (what each Kiosk spend bought, when staff ring up the snacks), the basket you can pick in the Kiosk menu (kept on your card for staff to ring up, until it’s paid or you clear it), a Shabbat message from home if your parent or guardian writes you one (teens only: see Who can see what), the BBYO History chapters and BBYO Leaders slideshows you finish (teens only: which ones and when, so the pins for reading them all are yours on any phone; only you see which ones you read, and the two pins they earn show in your pin case like your other pins), which Moments photos the core team shares with parents, your sign-ins (browser type and when), when you agreed to this notice and the terms, a security log of sign-ins and sensitive actions, and anonymous usage statistics (see Usage statistics below).

Parents and partners

For parents and guardians: your name, email and which teen you follow, and the Shabbat message you write your teen, if you do (see Who can see what). For Boulevard partners: your name, email, and your organisation’s booth page, activities, posts, and resources (PDFs and links).

Teen leaders

For the teens who lead BBYO EC26 (coordinators, admins, and steering): BBYO shares your name, country, AZA or BBG, and your roles, and a headshot if you sent one with photo consent, for Meet the Teen Leadership. The app links your card to your account by your name, so your photo follows your own settings, and it can show your profile photo when there’s no headshot. Your card (name, roles, and country) shows even if you hide your profile in People; only your photo follows your settings. Legal basis: BBYO’s legitimate interest in showing who leads the convention (Art. 6(1)(f)).

Staff shifts

If you’re staff: the jobs the core team gives you at BBYO EC26 (your shifts: what, when, where, and who else is on each). Once the core team shares them, every staff member can see the board. We send you a reminder 30 minutes before each shift, unless you turn Reminders off. When you tap “I’m here” on a shift, the core team, leads and whoever is in charge of that job see when you arrived. For staff, the core team may note which side of the convention you work with best (AZA side, BBG side, or either), to help hand out jobs. Only the core team sees it.

Staff feedback

If you’re staff: your answers to the EC Staff Feedback, the staff survey that opens as the convention ends. Only the core team reads them, never with your name, and only once at least five staff have answered (before that, just the counts). If you say you’d like to help chair a future conference, your name as it is in the app goes on the core team’s list of volunteers, and only there: never next to your other answers. You can change your answers and send them again any time.

Song leaders and speakers

The Kumzitz times the core team plans, with the first names of the song leaders (and any staff) leading each one. For the program’s guest speakers (adults): their name, role, organisation, a short bio, and a photo, shown with the sessions they speak at. Everyone signed in sees both, parents and partners included. The core team adds and edits them. Legal basis: BBYO’s legitimate interest in showing who leads and speaks at the convention (Art. 6(1)(f)).

What the core team adds

Pictures of the Budapest hunt’s stations, which teens and staff see, and the Kiosk’s and the Shuk’s items (names, photos, prices, sizes, and what’s sold out), which hold no personal data.

Your registration details are needed to take part in BBYO EC26. Everything you add in the app is up to you: leave it out and the app still works.

Running the convention and the app

Your schedule, track, room, buses, Kiosk Card and sign-in, and for staff, your shifts. Legal basis: carrying out the registration agreement for BBYO EC26, and BBYO's legitimate interest in running a safe, well-organised convention (GDPR Art. 6(1)(b) and (f)).

Keeping everyone safe

Dietary needs, allergies, medical and emergency details. Legal basis: protecting your vital interests and meeting legal obligations to look after young people (Art. 6(1)(c) and (d), and Art. 9(2)(c) for health details). Staff only; medical details for the safety leads only, encrypted, and every view is logged.

Photos, posts, and your profile

Your photo, socials or staff bio, posts, pins, song requests, favourite sessions, poll votes, program ideas, game scores, challenges, and the BBYO History and BBYO Leaders you finish are your choice (consent, Art. 6(1)(a)), and so is a parent’s or guardian’s Shabbat message to their teen. You can remove most of them any time, and deleting your account removes them all. The BBYO EC26 core team may share a post’s photos and caption with parents and guardians in the app, without the name of who posted it.

Boulevard newsletters

Only if you sign up, and only teens who are 16 or older on the day they sign up can (consent, Art. 6(1)(a) and Art. 8). To check, the app looks at the date of birth from your registration when you open the Boulevard or sign up, and uses only the answer, yes or no; if there’s no date, you confirm it yourself, and the app notes which of the two it went by. If you confirmed it yourself and a date that comes in later shows you were under 16 when you signed up, the sign-up is taken off the partner’s list and deleted. The partner sees your name, the email you give, and when you signed up, and sends the newsletter themselves.

Notifications

Your choice (consent). Turn them off any time in Me or in your phone's settings.

Security and feedback

Sign-in records and the security log keep your data safe; session ratings, the survey, and the staff feedback help us make the next convention better (legitimate interests, Art. 6(1)(f)). You can object at any time.

Staff location at the Budapest hunt

Only adult staff walking a hunt team, never teens. While the hunt is open or paused, that staff member’s phone shares its location with the BBYO EC26 core team, who see it on the hunt’s teams map, so they can reach any team quickly. It starts by itself, the staff member’s hunt screen says it’s on, and they can turn it off there. Only the latest point is kept, at most every 20 to 25 seconds, with no route history. It’s deleted at once when the staff member turns sharing off or a lead takes them off their team, and everyone’s is deleted when a lead closes the hunt or publishes the results. Otherwise, for example when the hunt ends by its clock, it’s deleted the next time their phone tries to send a point, and in any case with the rest of the hunt on 8 December 2026. Legal basis: BBYO’s legitimate interest in keeping teens safe in the city (Art. 6(1)(f)).

NFC badges

Tapping a badge opens that person’s profile in the app, showing only what their privacy settings already show you, so you can add them as a friend or give them a pin. Staff can use a badge for points, bus and hunt check-in, and room checks; a tap never does anything until someone presses a button. Taps are briefly counted to stop misuse. Legal basis: running the convention and the app (legitimate interests, Art. 6(1)(f)).

Usage statistics

Which screens and features are used, how long people stay on them (such as a BBYO History card), and whether they finish, counted under a code instead of your name. No names, messages, search words, or locations. For teens, the totals are also split by class (from your graduation year), country, and region, and the core team sees which Kumzitz songs are liked most, as totals. Only the BBYO EC26 core team sees the totals, never for a group smaller than 5 people, and nothing is shared with other companies. Legal basis: BBYO’s legitimate interest in making the app work well for everyone (Art. 6(1)(f)). You can turn it off any time in Me, under Privacy and data (Share anonymous usage), which also deletes what was recorded about you.

• Everyone signed in at EC (teens and staff) sees your name, community, and track. Your profile and photo show depending on your privacy settings.
• Teens choose in Me, under Privacy and data, whether everyone or only their people (people who added each other, for example by scanning codes) can find their profile and see their photo, who sees their socials, and who can give them pins.
• Other teens only can see your socials, and only if you choose. Staff never see teens’ socials.
• Each Moments post is for everyone, your track, or your friends (people who added each other), as you choose when you post. Staff can always see posts, to keep everyone safe, and only posts for everyone can be shared with parents.
• Staff see dietary needs, allergies, room, travel, and sign-in email, to look after you. They can always see your profile, to keep everyone safe. Staff also see who is on each flight, to meet you at the airport and get you on the right bus. Nobody else sees who you’re flying with: not other teens, partners, or other teens’ parents.
• Safety leads and admins only see medical, wellbeing and emergency contact details. These are encrypted, and every view is logged.
• Parents and guardians see only their own teen’s schedule and travel (and photo, with photo consent), plus the photos and captions the BBYO EC26 core team chooses to share with all parents, never who posted them. Never other teens’ details, apart from the teen leaders’ names, roles, and countries.
• A Shabbat message from home is for its teen alone. A parent or guardian can write their own teen a few lines before Shabbat; it reaches the teen an hour before candle lighting. Only that parent and that teen ever read it: never staff, other parents, or other teens, and it’s never in a notification. It goes with either account and is deleted after the convention.
• Meet the Teen Leadership shows the teens who lead BBYO EC26. Teens and staff see their names, roles, countries, and photos (each leader’s own photo settings still apply). Parents and guardians see their names, roles, and countries, without photos. A leader’s card shows even if they hide their profile in People; only their photo follows their settings. Boulevard partners and song leaders don’t see it.
• Staff shifts are for staff only: every staff member sees the board once the core team shares it, and only the core team sees which side each staff member works with best. Nobody else sees them.
• Staff feedback is read only by the BBYO EC26 core team, without names. The name of a staff member who offers to help chair a future conference is only on the core team’s list of volunteers, never next to their answers.
• Kumzitz times and speakers are for everyone signed in, parents and partners included: the times with the first names of the song leaders (and any staff) leading them, and the speakers’ profiles.
• Boulevard partners never see teens’ profiles. If you sign up to a partner’s newsletter, that partner sees your name, the email you gave, and when you signed up. You can leave at any time, on the Boulevard or in Me, under Privacy and data. You’ll come off their list in the app straight away. If they’ve already copied the list or emailed you, unsubscribe from their emails too.
• Phone numbers are never shown to teens. Nothing is public on the internet: you have to sign in to see anything.

These companies run parts of the app for us. They only use your data to provide their service, under a data processing agreement:

Vercel

Hosts the app. The app's servers run in Frankfurt, Germany.

Neon

The database, in Frankfurt, Germany (eu-central-1).

Vercel Blob

Stores photos, videos, profile pictures, and partners’ PDFs privately: only signed-in people can open them. Photos and videos are saved without their location.

Microsoft 365

BBYO’s own email, run by Microsoft for BBYO. Sends sign-in emails from a BBYO mailbox, through Microsoft Graph.

Apple, Google, and Mozilla push services

Deliver notifications to your phone. The notification text never contains personal details.

Spotify and YouTube

Only asked for a song’s or a video’s details, by its id, when someone requests a song. Nothing about you is sent.

Where a provider is based outside the EU, transfers are covered by the EU-US Data Privacy Framework or standard contractual clauses.

• The app stays open after EC, which ends on 8 November 2026. People’s accounts, their registration details, and what they added are deleted on 8 December 2026. That includes teens’ newsletter sign-ups and the resources (PDFs and links) partners uploaded.
• Staff shifts (with when each staff member said they’d arrived) and the side the core team noted for each staff member, the Kumzitz times with who led them, the speakers’ profiles and photos, and the pictures of the hunt’s stations are deleted on 8 December 2026 too.
• Organisations’ Boulevard booth pages, logos, and activities stay: they’re the organisation’s, not anyone’s personal data. So do the Kiosk’s and the Shuk’s items, without who last changed them.
• Usage statistics are kept for up to 120 days. After the deletion on 8 December 2026 they can no longer be linked to anyone.
• Safeguarding concern records are kept by the safeguarding lead for as long as the law requires.
• Feedback and survey answers are kept without your name or any details about you, to improve future conventions.
• After the deletion on 8 December 2026, the staff feedback is kept for the core team on an anonymous placeholder in place of each staff member’s account, without the name stored with an offer to help chair a future conference. The answers themselves stay as they were written.
• If you delete your account, what you added goes straight away. Registration and safety details staff need at convention stay until the deletion on 8 December 2026.
• What staff add for everyone at the convention (news, polls, and track materials) stays up without their name if they delete their account. Polls and track materials go in the deletion on 8 December 2026; news stays, without anyone’s name.
• If you sign up to a partner’s newsletter, the partner keeps your email on its own mailing list, under its own privacy notice, until you unsubscribe.

See and download your data

In Me, under Privacy and data: Download my data gives you a file with everything the app holds about you.

Correct it

Edit your profile in Me. For registration details, ask a staff member or the contact above.

Delete it

Delete my account, in Me under Privacy and data, deletes what you added straight away.

Limit or object

You can ask us to stop or limit using your data, or object to uses based on legitimate interests. Contact us using the details above. To stop usage statistics yourself, turn off Share anonymous usage in Privacy and data.

Take it with you

Your download is a standard JSON file you can keep or give to someone else.

Change your mind

Remove photos and posts, change your privacy settings, leave a partner’s newsletter, or turn off notifications any time. That doesn't affect what happened before.

Complain

If you’re not happy with how we handle your data, you can complain to a data protection authority: in Hungary the NAIH (naih.hu), or the one in the country where you live.

We answer requests within one month.

The app only stores what it needs to work, so there’s no cookie banner:

• One sign-in cookie that keeps you signed in for up to 30 days, or until you haven’t opened the app for two weeks (staff previews use two more, for 12 hours).
• A copy of some pages and your Kiosk Card on your phone, so they work offline. Signing out, or being signed out, clears them.
• App settings and your progress, kept on your phone only and never sent: the chords and language you sing with and the cheers you know by heart in Kumzitz, the moments you saw in BBYO History and where you stopped (only which chapters and slideshows you finish is sent, see What the app records), the glossary cards you flipped, and your best scores in Camel run and Gavel Ready. Signing out or deleting your account clears them.
• Directions on the convention and festival maps, and the Budapest hunt map’s “show me” dot (only after you tap it), use your phone’s location only while they’re open. It stays on your phone and is never stored or sent. The one exception is staff walking a hunt team (see Staff location at the Budapest hunt).
• Birkat Hamazon’s reading settings, the packing list’s ticks, a Birkat banner you closed for one meal, and which day’s Now and Forever quote you’ve already seen: kept on your phone only and never sent.
• Song recordings in Kumzitz play from YouTube only when you tap play, using YouTube’s privacy-enhanced mode. Until then, nothing is loaded from YouTube.
• A short list of usage events waiting to be sent while you’re offline. It’s sent when you’re back online, and cleared when you sign out.
• Which Good & Welfare evening your phone last lit the candle in, so its circle is counted once. Signing out clears it.
• No outside trackers, no ads, and nothing else from other websites.

Most people at BBYO EC26 are 14 to 18. Your parent or guardian agreed to BBYO EC26 using your details when they registered you, including for anyone under 16. We wrote this notice so you can understand it yourself. If anything is unclear, ask a staff member or your coordinator.

Parents and guardians can use the contact above for anything about their teen’s data.

• The app makes no automatic decisions about you and builds no profiles for marketing.
• When this notice changes, the new version is shown in the app the next time you open it.
• This is version 2026-10-27, 27 October 2026.