Privacy Policy — Tickets.btaqa

1. Introduction

808Studio (“we”) operates Tickets.btaqa and is committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and Dutch data protection law.

2. Data We Collect

For Attendees (ticket buyers):

Full name
Email address
Ticket purchase details (event, ticket type, quantity, amount paid)
Payment metadata (transaction ID — we do not store card details)

For Organisers:

Name and email address (via Google OAuth or email login)
Business/organiser profile information (name, slug, bio, logo)
Mollie OAuth access and refresh tokens (stored encrypted with AES-256-GCM)
Event data created on the platform

Automatically collected:

IP address (for security and fraud prevention)
Browser and device information
Usage data (pages visited, actions taken)

3. How We Use Your Data

Purpose	Legal Basis
Delivering tickets to Attendees	Contract performance
Processing payments via Mollie	Contract performance
Sending order confirmation emails	Contract performance
Organiser account management	Contract performance
Fraud prevention and security	Legitimate interest
Platform analytics and improvement	Legitimate interest
Legal compliance	Legal obligation

4. Third Parties

We share data with the following processors:

Processor	Purpose	Location
Mollie	Payment processing	Netherlands (EU)
Resend	Transactional email delivery	USA (SCCs applied)
Supabase	Database and authentication	EU region
Vercel	Hosting and infrastructure	USA (SCCs applied)
Google	Authentication (OAuth)	USA (SCCs applied)

We do not sell your personal data. We do not use your data for advertising.

5. Data Retention

Attendee order data: retained for 7 years (Dutch tax law requirement)
Organiser account data: retained for the duration of the account plus 2 years
Email logs: 90 days
Security audit logs: 90 days

6. Your Rights (GDPR)

You have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your data (subject to legal retention obligations)
Portability — receive your data in a machine-readable format
Objection — object to processing based on legitimate interest
Complaint — lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

To exercise your rights, contact: help@btaqa.io

7. Cookies

Tickets.btaqa uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies.

8. Data Security

We implement appropriate technical and organisational measures to protect your data including encryption at rest and in transit, access controls, and regular security reviews.

9. Changes to This Policy

We may update this policy. Material changes will be notified via email or a prominent notice on the platform.