Privacy policy

1. Two different roles

For the data of organizers and their team members, TixBeam is the controller. We decide why and how that data is processed.

For the data of ticket buyers, the organizer is the controller and TixBeam is the processor. We process buyer data on the organizer's instructions, to run their shop and their door.

The organizer's name and contact details appear in its ticket shop. Its own privacy notice also applies to processing for which it is responsible. TixBeam is separately responsible for limited data it processes to secure and operate its own platform.

Where TixBeam processes personal data on an organizer's behalf, arrangements meeting Article 28 GDPR are required. This privacy policy does not replace a data processing agreement.

2. What we process

• Account data: name, email address, role and organization membership
• Contact and support data: messages you send us and details needed to handle a request or incident
• Organization data: name, branding, domains and settings
• Event and order data: events, ticket types, orders, ticket status and check-ins
• Buyer data on behalf of the organizer: first and last name, email address, any phone number and organizer-configured checkout fields, orders, payment status, tickets and check-ins
• Technical data: security logs and error reports needed to keep the platform reliable

3. Legal bases by processing purpose

• Performance of a contract: accounts, organizations, support and the functions for which an organizer uses TixBeam
• Buyer data: the organizer determines the purposes and legal bases, for example performance of the ticket or reservation contract. TixBeam does not choose that legal basis on the organizer's behalf and processes the data for the service under its instructions
• Legitimate interests: minimal security logs, fraud prevention and incident investigation, balanced against the rights of the people involved
• Legal obligation: records demonstrably required for administration, tax, disputes or competent authorities
• Consent is used only for a separate optional purpose and can always be withdrawn. The current checkout does not request marketing consent

4. Payment data

Online payments run through the payment provider used by the organizer. TixBeam does not receive or store full card numbers. We do process information such as amount, payment method, payment status and transaction reference where needed for the order. For payments at a location, the organizer records payment confirmation.

5. Recipients and suppliers

We use Vercel (hosting), Supabase (database, authentication and storage) and Resend (transactional email) to provide the service. Error reporting through Sentry may be enabled. Google Analytics 4 is used on the informational website only after consent. The organizer's chosen payment provider receives the data needed for payment under its own privacy information.

Staff access is restricted to what their role requires; support access is logged. Transfers outside the European Economic Area require an applicable legal transfer mechanism and, where needed, appropriate protection. Contact us at the address below for current supplier and transfer arrangements.

6. Retention periods and criteria

Within the law, the organizer sets the retention period for buyer data for which it is responsible. Fixed automatic deletion periods are not yet configured for every situation involving paid orders, support and logs. Data must therefore not be kept longer than necessary; ask the organizer or us about the period applicable to your specific data.

• Expired or cancelled reservations that were never paid: the name, email address and public receipt link are automatically anonymized one month after expiry or cancellation
• Paid orders and financial records: for as long as the organizer needs them for performance, administration, tax, refunds or disputes; after that we erase or anonymize them on the organizer's instructions
• Accounts and team memberships: during the customer relationship; afterwards only as long as concrete security incidents, claims or legal duties require
• Support requests and operational logs: as long as needed to handle and substantiate the request, incident or security issue; sensitive payment and ticket data should not enter application logs

7. Your rights

We normally respond within one month. If identity is uncertain, we ask only for the additional information needed to prevent abuse of a privacy request.

Not every right applies in every situation. If we cannot fulfil a request, we explain why and what options you have to challenge that decision.

• Access to the personal data we hold about you
• Correction of data that is inaccurate or incomplete
• Deletion, where no legal obligation requires us to keep it
• Restriction of and objection to processing
• Data portability in a common format
• Withdrawal of consent for optional processing; earlier lawful processing remains valid

8. Ticket buyers

If you bought a ticket, the organizer whose shop you used is the first point of contact for your request. We help them handle it. You can also contact us and we will route your request.

Required checkout details are needed to make the reservation and issue the ticket. The organizer chooses additional fields and may make them required or optional; the organizer must be able to explain why those details are needed.

9. Questions and complaints

Write to info@tixbeam.com with any question about this policy. You also have the right to lodge a complaint with the Dutch Data Protection Authority.