Privacy Policy

0. Overview

This Privacy Policy describes the types of personal information Printer's Academy On Line, LLC d/b/a dinnerHQ ("dinnerHQ", "we", "us", or "our") collects from website visitors and people who use our Services, how we use and share that information, and the choices you have. Please read it carefully to understand our practices and how we will treat your information.

Capitalized terms not defined in this Policy have the meaning given in our Terms of Use.

1. Who we are

Printer’s Academy On Line, LLC, d/b/a dinnerHQ (“dinnerHQ,” “we,” “us” or “our”) operates curated B2B networking dinners in the United States.

Postal address: 3870 NE 167th St, North Miami Beach, Florida 33160, USA
Email: [email protected]

We take privacy seriously and align our practices with leading U.S. and international frameworks, including the GDPR and California CCPA/CPRA.

2. Definitions

“Services” means our public website at www.dinnerhq.com (the “Site”) and the curated B2B networking dinners and related features we operate (for example, ticketing and attendee rosters).

“Personal Information” means information about an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to that person’s identity.

“Third‑Party Products/Service Providers” are products or services not owned or controlled by dinnerHQ (for example, Luma for ticketing or Stripe for payments). Their own privacy notices apply to their handling of information.

3. Scope of this Policy

This Policy explains how we collect, use, share and protect personal information when you:

• browse www.dinnerhq.com (the “Site”);
• purchase or manage a ticket via Luma or other ticketing widgets embedded in the Site;
• interact with our emails, SMS messages or social‑media ads; or
• attend a dinnerHQ event;
• network with other professional attendees via dinner‑specific rosters or post‑event follow‑up messages.

This Policy does not cover third‑party websites or services that link to or from us. Their own privacy statements apply.

Controller details: The controller responsible for the processing of personal information is Printer’s Academy On Line, LLC d/b/a dinnerHQ. You can reach us at the address and email listed above.

4. Acceptance of this Policy

By accessing or using the Services, you agree to this Privacy Policy. If you do not agree, do not use the Services. You can contact us at [email protected] with questions about this Policy.

5. Updates to this Policy

We may update this Policy from time to time. When we do, we will post the revised version on this page and update the effective date at the top. Where required, we will provide additional notice (for example, by email or banner). Your continued use after an update constitutes acceptance of the revised Policy.

5a. Legal Basis for Processing Your Data

Under GDPR and similar privacy laws, we must have a legal basis to process your personal information. We rely on the following bases depending on the processing activity:

6. Information we collect

We collect information from the following sources: (a) directly from you; (b) automatically from your device and browser; (c) from event partners and service providers that help us operate dinners (for example, Luma, Stripe); and (d) from publicly available sources or third‑party services, where allowed by law.

We do not intentionally collect sensitive data such as social‑security numbers, health information or government identifiers.

We also do not seek or require information about legally protected characteristics (for example race, color, religion, national origin, disability, or medical details). Please do not provide such information.

7. How we use your information

We process personal information to:

• Provide our service — issue tickets, confirm restaurant logistics, handle seating and send pre‑/post‑event communications.
• Process payments via Stripe and detect fraud.
• Personalise outreach — recommend dinners aligned with your industry or interests.
• Operate, secure and improve the Site and any future mobile app.
• Facilitate networking — share limited professional contact details (name, company, role, LinkedIn) with other confirmed attendees so you can follow up after the dinner.
• Send marketing emails/SMS you opt into; you may unsubscribe at any time.
• Comply with law — e.g. tax, accounting and lawful requests.
• Defend our rights and prevent misuse of our services.

We rely on one or more of the following legal bases, as applicable: (i) performance of a contract (ticket purchase), (ii) our legitimate interests in running and marketing the business, (iii) your consent (for optional newsletters/texts), and (iv) compliance with legal obligations.

8. Cookies & similar technologies

We use first‑ and third‑party cookies, pixel tags and local‑storage objects to recognise your browser, analyse traffic, remember preferences and measure ad performance. You can control cookies through your browser settings. Blocking all cookies may degrade Site functionality.

Key third‑party cookies/pixels:

• Google Analytics 4 — site analytics (IP anonymised)
• PostHog — user behavior analytics and feature flags
• Meta (Facebook) & LinkedIn Insight Tags — conversion tracking & retargeting
• Stripe — checkout session, fraud prevention and payment performance
• Loops — email campaign analytics

9. Who we share information with

We disclose information only as needed to run the service:

We require each service provider to keep information confidential and to use it only for the purpose we disclosed it.

Event sponsors: We share your professional contact information (name, business email, company, job title, industry, LinkedIn profile, attendance history) with event sponsors to enable professional networking and business development. This data sharing applies to all dinnerHQ events (both sponsored and non-sponsored community dinners). Sponsors must comply with anti-spam laws (CAN-SPAM, GDPR, CASL) and cannot sell your data to third parties without your consent. See Section 6.1 for full details.

Payment processing: We use Stripe to process payments and do not store full credit‑card numbers. Stripe handles card data in accordance with its own privacy policy and PCI‑DSS requirements. We receive tokens and limited payment metadata (e.g., last four digits, card brand, amount).

We may also share information (i) to comply with law or valid legal process, (ii) to enforce our Terms of Use, (iii) in connection with a business transfer such as a merger or sale, or (iv) with your consent.

10. International transfers

dinnerHQ is based in the United States. When you access our services from the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to the US.

We use appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914) and the UK International Data Transfer Agreement (IDTA) where applicable. All third-party processors who handle your data have executed Data Processing Agreements (DPAs) with these safeguards.

Request Documentation: For complete details on our data processing practices, Standard Contractual Clauses, and Sub-Processors, see our Data Processing Agreement (DPA). You can also request a copy by emailing [email protected] (GDPR Article 46(2)(c) right to information about safeguards).

If you object to international data transfers, you may choose not to use our services. We cannot provide our services without transferring data to US-based processors. However, where technically feasible, we can accommodate requests to store your data on EU servers — email [email protected] to request EU-based hosting options.

11. Retention

We keep information only as long as necessary to fulfil the purposes in Section 7, to resolve disputes or as required by law (e.g., U.S. tax regulations). When no longer needed, we securely delete or de‑identify it.

12. Your choices & rights

• Email & SMS marketing — click “Unsubscribe” in any message or email [email protected].
• Cookies — use browser controls to block or delete cookies.
• Access / correction / deletion — U.S. residents may request a copy or deletion of personal information by emailing [email protected].
• California residents — you have CCPA rights to know, delete and opt out.
• EEA/UK/Swiss visitors — you have GDPR rights of access, rectification, erasure, restriction, objection and data portability, exercisable via the same email. Because we are not established in the EEA, we process your data on the Article 3(2) GDPR extraterritorial basis.

We will respond within 30 days (or the period required by applicable law). We may ask for identity verification.

Do Not Track. At this time there is no industry standard for recognizing browser “Do Not Track” signals, so we do not respond to them. You can control cookie‑based tracking via your browser settings.

13. Security

We implement appropriate technical and organizational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access (GDPR Article 32).

Technical Measures

• Encryption: TLS 1.3 for data in transit; AES-256 encryption at rest (Neon PostgreSQL)
• Access Controls: Database row-level security (RLS), multi-factor authentication (MFA) for all admin accounts, role-based access controls (RBAC)
• Network Security: Transaction pooler with connection limits, IP allowlisting for admin access, DDoS protection via Vercel Edge Network
• Security Testing: Annual penetration testing, quarterly external vulnerability scans, automated dependency scanning
• Patch Management: Automated security patching within 7 days of critical vulnerability disclosure
• Logging & Monitoring: Access logs retained 90 days, real-time intrusion detection, automated alerting for suspicious activity
• Backups: Nightly encrypted database backups with 30-day retention, tested quarterly

Organizational Measures

• Staff Training: Annual security and data protection training for all personnel
• Incident Response: Written incident response plan tested quarterly
• Data Minimization: Unverified accounts deleted after 30 days; inactive accounts reviewed annually
• Vendor Management: All processors undergo risk assessment and execute Data Processing Agreements (DPAs) with Standard Contractual Clauses
• Confidentiality: All employees and contractors sign confidentiality agreements
• Access Reviews: Quarterly review and revocation of unnecessary access permissions

Security Limitations: No internet transmission is ever 100% secure. By using our services, you acknowledge this inherent risk. We cannot guarantee absolute security but commit to implementing industry-standard safeguards appropriate to the risk.

Data Breach Notification

If we become aware of a personal data breach that compromises your information, we will:

• Notify Regulators: Within 72 hours of discovery, we will notify the relevant supervisory authority (GDPR Article 33)
• Notify You: Without undue delay, we will inform affected individuals if the breach is likely to result in a high risk to your rights and freedoms (GDPR Article 34)
• Provide Details: Notification will include the nature of the breach, likely consequences, and mitigation measures taken
• Cooperation: We will cooperate fully with any regulatory investigation and provide necessary documentation

Your Right to Compensation: Under GDPR Article 82, you have the right to receive compensation from us if you suffer material or non-material damage as a result of a data breach caused by our violation of GDPR. This right cannot be contractually limited (see Section 13 of our Terms of Use for liability limitations that do not apply to GDPR violations).

14. Responsible disclosure of security vulnerabilities

If you discover or suspect a security vulnerability in our Services, please notify us immediately at[email protected]. If, during testing, you encounter any sensitive data, stop the test and do not share that data. We will investigate in a reasonable timeframe and may limit access while an issue is assessed.

15. Children’s privacy

Our Services are intended for adults 18 years and older. We do not knowingly collect information from children. If you believe we have done so inadvertently, please contact us for removal.

16. Contact

Data Protection Officer (DPO)

For data protection inquiries, GDPR rights requests, or to exercise your rights under applicable data protection laws, contact our Data Protection Officer:

General Privacy Inquiries

For general questions about this Policy or your personal information, email [email protected] or write to the Florida address above.