Privacy and terms

Anyone selling tickets processes people's data: a name, an email address, sometimes an address. Rules come with that. This article explains in plain language what those rules involve, what we have arranged for you, and — the part that is most often forgotten — what you have to write yourself before your first ticket is sold.

This is not legal advice. It is a manual, written by people who make software. If it concerns a lot of money, minors or sensitive data, put it to a lawyer or to your umbrella organisation.

What is the GDPR?

The GDPR — the General Data Protection Regulation, in Dutch AVG — is the European law about personal data. It has applied throughout the European Union since 2018 and it applies to a local history society with eighty members too.

What it says at heart, in five sentences:

• You only collect data you really need.
• You say in advance what you are using it for.
• You do not keep it longer than necessary.
• You protect it reasonably against theft and loss.
• Anyone in your records may ask what you hold about them, and may ask for it to be deleted.

A personal data item is anything with which you can point to a human being: a name, an email address, a telephone number, sometimes even an order number you can link to a person. A counter saying "312 visitors" is not.

Controller and processor

This is the part that is most often misunderstood, and it determines who a visitor should go to with a question.

The law knows two roles:

• The controller decides why and how data is used.
• The processor carries that out, on instruction, and does nothing else with it.

The comparison that sticks: you are the owner of the archive, we are the filing cabinet with a lock. You decide what goes into it, who may look at it and when it may come out. The cabinet stores and guards, but does not read along and does not ring your visitors.

Another way of seeing it: your association hires a hall. The hall operator looks after the door and the lock; you decide who may come in.

Data	Controller	Processor
Your own account, your invoices, your support questions	Us	—
Name, email, orders, tickets, scans of your visitors	Your organisation	Us

In practice that means: if a visitor asks for access to or deletion of their data, you decide about that, not us. If such a question reaches us, we pass it on to you within five working days and let the visitor know who they should go to. You can look up what you have on someone yourself, on the Orders screen. Providing a copy of someone's data or wiping it is not something you can do yourself in the admin screen: ask us, and we do it for you.

---

The four texts we supply

On the public site there are four legal documents. They refer to each other and all carry the same version date, so that in a file you can say which version you used.

Document	What it is about
Legal notice	Who runs the service: name, address, company number, VAT number, contact
Privacy statement	Which personal data is processed, what for, for how long and who it is shared with
Terms and conditions	The agreements between your organisation and us: subscription, payment, availability, liability
Data processing agreement	What we do with your visitors' data, on your instruction

You do not have to sign the data processing agreement separately: it forms part of the terms and conditions. If you accept those when you register, you accept it with them. The version you accepted is stored with your organisation — so you can always check what you agreed to.

If a grant application or a tender does need a signed copy on our own letterhead, write to us. We will sign it.

Note: these four texts are about us and about you. They say nothing to your visitor about your event. That is the next chapter, and that is your work.

---

What you need beforehand

• Half a day to write two texts: your own terms and your own privacy statement.
• A place to publish those texts, usually your own website. In the admin screen you only fill in the link to your terms, not the text itself.
• The name, the address and the company or association number of your organisation, plus an email address somebody can go to.
• A decision by your committee on two questions: what do you do in case of cancellation, and until when may somebody cancel.
• The Owner role, to fill in that link under Settings → Organisation.
• If you are in doubt about VAT: your accountant's number.

---

What you arrange yourself

If you sell tickets to visitors, you are the seller towards that visitor. That brings four things with it that we cannot do for you.

1. Your own terms and conditions

These are the agreements between you and your visitor. Put them on a page of your own website and paste the link under Settings → Organisation, Look and feel tab, in the Link to your terms field. Your visitor sees that link at checkout, next to the box with which they agree to your terms, and at the bottom of your ticket shop. If you fill in nothing, they still agree to "the terms of" your organisation, but cannot read them anywhere.

What belongs in them, each with an example of what a small association puts there:

What	Example
In case of cancellation	"If the performance does not go ahead, we refund the ticket price in full within 30 days. Booking fees are not refunded."
In case of postponement	"If the date is moved, your ticket stays valid for the new date. If you cannot make it, let us know before the new date and you will get your money back."
Resale	"You may pass your ticket on to somebody else. We do not allow resale at a higher price than the ticket price."
Cancellation until when	"You can cancel up to 7 days before the dinner evening through eetfestijn@yourassociation.com. After that your ticket can no longer be refunded, because the shopping has been done by then."
Arriving late	"The guided tour starts punctually at 2 p.m. Anyone arriving later joins the group but has no right to a refund for the part missed."
House rules	"Dogs are welcome on a lead, except in the cellar room. Smoking is only possible outside. The organisation may refuse somebody admission in case of drunkenness or disruptive behaviour."
Liability	"The organisation is not liable for the loss or theft of personal belongings."
Who you are	"Toneelkring De Wissel vzw, Dorpsstraat 3, 9000 Ergens, company number 0123.456.789."

Note: write them in the language you sell in and keep them short. Nobody reads three screens of text; ten clear lines they will. And keep them fair — a condition that is plainly unreasonable towards a consumer will not stand up before a judge anyway.

2. Your own privacy statement

You determine why you collect your visitors' data and how long you keep it. Our privacy statement says what the platform does with that data; it does not replace yours. At checkout we link to ours; there is no separate field for yours. Put it on your own website and refer to it from your terms — or put both on the same page.

Five questions you answer, with an example:

Question	Example for a small association
What do you collect?	"With an order: your name, your email address and what you have ordered. At a dinner evening also your menu choice and whether you tell us about allergies."
Why?	"To be able to supply your ticket, to notify you if something changes, and to know how many portions we have to cook."
For how long?	"We keep your order details for 7 years because our bookkeeping requires it. We keep your email address for the newsletter until you unsubscribe."
Who do you share it with?	"With our ticketing platform, which processes it on our instruction, and with our payment provider for the payment. With nobody else. We do not sell addresses."
Where can somebody go?	"Write to privacy@yourassociation.com or to Toneelkring De Wissel vzw, Dorpsstraat 3, 9000 Ergens. You can request your data, have it corrected or have it wiped."

That last address is not optional. A privacy statement without a place where somebody can ask a question is not a privacy statement.

Note: do you send newsletters? Then that is a separate purpose, and you ask separately for consent for it. An email address you were given in order to supply a ticket is not consent to send something to it three times a year.

3. The right of withdrawal

Anyone who buys something online normally has fourteen days to think it over. For events on a fixed date there is generally no fourteen-day right of withdrawal in the European Union — otherwise somebody could buy a ticket, go and watch, and then ask for it back.

Say that expressly in your terms, because otherwise a visitor assumes they do have that right.

One sentence is enough: "For tickets for an event on a particular date there is no statutory 14-day right of withdrawal. Your purchase is final, except as stated above under cancellation."

If you sell something that does not have a fixed date — a gift voucher, a season pass that starts at any moment — do not simply assume that the same exception applies. Check that.

4. VAT and bookkeeping

You determine whether and which VAT you charge on your tickets. The platform calculates what you set; it does not give tax advice.

What a small association puts there in practice: many associations fall under an exemption and charge 0%, with a mention such as "Exempt from VAT" on the ticket. Other associations are liable for VAT for their dinner evening but not for their performance. That difference is precisely the kind of question you ring your accountant about once instead of guessing at it.

Also bear in mind that as a seller you have to be able to account for your own turnover. If you sell at the door, the till journal helps with that; see The counter till.

---

We do not process payment data

Card numbers, account numbers and everything else that goes with a payment go straight to the payment provider you connect yourself. We only see whether a payment succeeded and what amount it concerned. The money also goes straight into your account; we are not in between. See Connecting your payment provider.

---

Retention periods

The full list is in the privacy statement. The periods you need most often:

What	How long	Why
Orders, tickets and scans	As long as you are a customer, plus what you specify yourself	You determine this as the controller
Your data after the end of your subscription	30 days to export, then gone	Enough time to make your export
Invoices	10 years	Bulgarian accounting law, applicable to us
Your own accounting documents in Belgium	7 years	Belgian Code of Economic Law, applicable to you
Server logs	90 days	Long enough to investigate an incident

If you need a stricter period for your own sector, let us know.

---

Who else sees your data?

Only suppliers we need to make the platform work. The full list with name, country and what they are for is in the privacy statement and in the data processing agreement. Those two lists come from the same source, so that they cannot drift apart.

If a supplier is added or falls away, we let you know by email at least thirty days in advance. If you do not agree with it, you can cancel free of charge.

Your data stays in the European Union, with three exceptions that you control yourself: a ticket in Apple Wallet or Google Wallet, and Stripe as the payment provider. For all three the European Commission's standard contractual clauses or the EU-US Data Privacy Framework apply.

---

Cookies

Functional ones only: the session, the CSRF token and the cookie that keeps you signed in — and, on a tablet you have paired as a till, a cookie that recognises that device. No analytics, no advertising, no trackers, and no typefaces or scripts from a foreign server. Your language choice is in the page's address and not in a cookie.

That is also why there is no cookie banner on the site. That is not an oversight: for cookies that are strictly necessary to deliver the service, no consent is required.

---

If something does go wrong

If we find a data breach affecting your visitors, we inform you within 48 hours of discovery — not within 72, because those 72 hours are the deadline within which you have to inform your supervisory authority, and you only make it if you hear from us sooner. You get from us what we know at that moment, and what we do not yet know we say so honestly.

---

Making a complaint

If you are not satisfied with how we handle data, tell us first — most things are put right more quickly than a procedure takes. You can also go straight to a supervisory authority: to the Bulgarian CPDP (cpdp.bg), our lead supervisory authority, or if you live in Belgium to the Data Protection Authority (gegevensbeschermingsautoriteit.be).

---

Common mistakes

• Using our privacy statement as yours. It is about the platform. Your visitor buys from you and has to be able to read your text.
• Not filling in a link to your terms. Your visitor then cannot read anywhere at checkout what they are agreeing to, and at the first cancellation you have not a single agreement to refer to.
• Using email addresses from ticket sales for a newsletter. That is a different purpose. Ask separately for consent for it.
• Claiming that there is a fourteen-day cooling-off period after all. Or saying nothing about it, which comes to the same thing as soon as somebody asks.
• Asking for more than you need. A date of birth, a national registration number or an address for a ticket that comes by email: leave it alone. What you do not have, you cannot lose.

---

What if …

What if a visitor asks for all their data to be wiped?

Then you decide. First look at whether you still need it: an order that is in your bookkeeping you may generally keep until your statutory period is over. The rest can go. Look the person up under Orders and let us know what may go: we do the wiping or anonymising for you.

What if I have no terms of my own and have already sold?

Write them anyway, put them online and fill in the link under Settings → Organisation, Look and feel tab. From then on they apply to new orders. For what has already been sold, you fall back on the law and on what you promised in your communications — a reason not to put it off.

What if my event is cancelled?

Do what is in your own terms, and do it quickly. Email everybody with a ticket, say what is happening with their money and when. Silence costs you more goodwill than a refund that takes two weeks.

What if a visitor has a complaint about how we handle their data?

Send them to you, not to us: you are the controller. If you cannot work it out, we will help you with the facts. A visitor may in addition always turn to their own supervisory authority.

What if a funding body asks for a signed data processing agreement?

Write to us. We will sign a copy on letterhead. The content is the same as the one you already accepted when you registered.

---

Frequently asked questions

Do I have to sign the data processing agreement separately? No. It is in the terms and conditions you accepted when you registered. For a file we will sign a separate copy on request.

Does my small association really have to have a privacy statement? Yes. The GDPR makes no exception for size. The good news: for an association that only collects names and email addresses, one page is enough.

May I copy the example sentences from this article? Yes, do — adapt them to your own situation. They are examples to help you on your way and not a model text checked by a lawyer.

Do I need a cookie banner on my own ticket page? Not for the pages we supply: there are only functional cookies on those. If you embed the ticket shop in your own website with analytics tools alongside, it concerns your cookies and your banner.

Where can I see which version of the terms I accepted? It is stored with your organisation. Ask us if you need the copy you accepted at the time.