Privacy policy

Evote.io is operated by ogdahl, CVR 36943157, Denmark. Questions about privacy: [email protected]. Last updated 5 November 2026.

Who is responsible

For your own organiser account, we are the data controller.

For voter lists and everything else about a meeting, the association running the vote is the controller, and we process the data on its behalf. If you are a participant, contact your association first. We help it answer.

The website

This website has no forms and no login, sets no cookies and loads no tracking scripts. It is delivered through Cloudflare, which processes technical traffic data such as IP addresses to deliver and protect the site.

Organiser accounts

When you create an account at app.evote.io, we process your email address, your name, your organisation and its country, your language and when you last signed in. We use this to sign you in and provide the service you asked for. We send no newsletters. We also record which website sent you to us (only its domain name, such as google.com) and any campaign tag in the link, to see which channels bring new organisers.

Participants in a vote

The association enters your name and, where relevant, your email address, voting weight and a reference. We also record when your personal link was opened, attendance, proxies, receipts and votes.

In a secret ballot the vote is stored without your name, and no screen or record shows who voted for what. In an open ballot the vote is stored together with your name.

The record shows the association who took part and who gave proxies to whom. If you give a proxy, you see the names of the other participants in the meeting, and the person you choose is told by email.

Who else handles the data

We do not sell data or use it for marketing. Hetzner Online GmbH hosts the servers and the database in Germany. Cloudflare, Inc. delivers the traffic and sends the emails. Cloudflare may process data in the USA, under the EU standard contractual clauses and the EU-U.S. Data Privacy Framework.

How long we keep it

Accounts, meetings, voter lists and records are kept until the association asks us to delete them, because the record may be needed as documentation long after the meeting. Draft meetings can be deleted in the app. Write to [email protected] to have an account or a held meeting deleted.

Session data, including IP address and browser type, is removed shortly after two hours of inactivity. The event log of a meeting stores only a scrambled IP address and is deleted with the meeting. Web server logs with IP addresses are deleted after 14 days.

Cookies

The app uses technical cookies only. evote-session keeps you signed in and XSRF-TOKEN protects the forms; both expire after two hours of inactivity. evote_device is set when a personal voting link is opened, lasts up to 400 days and is used to notice if a link has also been opened on another device. None of them is used for tracking or marketing.

Your rights

You have the right to access, rectify and delete your data, to restrict or object to its processing, and to receive it in a portable format. Write to [email protected]. You can also complain to the Danish Data Protection Agency (Datatilsynet) or the data protection authority in your own country.