Your personal data when you buy a ticket

Who is responsible for your data

The organiser of the event — the seller named on the event page and at checkout — is responsible for your personal data when you buy a ticket: selling it to you, confirming it, admitting you at the door, refunds, and messages about the event. In the language of the law, the organiser is the controller. The organiser’s contact details are on the event page and in your confirmation.

Pilarres EOOD runs the platform, Bicyr Cangor, and processes that data for the organiser, as its processor, only on the organiser’s instructions.

For a few purposes of its own, Pilarres EOOD is responsible itself: keeping the platform secure and preventing fraud, accounting for its platform fee, and meeting its own legal obligations.

Your payment is processed by Stripe, the organiser’s payment provider, under Stripe’s own privacy notice. Your card details go from your browser to Stripe; we never see them.

What we process, and why

• Your e-mail address and mobile number, to deliver your ticket and so that the organiser can reach you about the event.
• Your order, your tickets and whether they were used at the door, to perform your contract with the organiser.
• Your language, to write to you in it.
• Any message you send to the organiser through the platform, to answer it.
• A payment reference and the amounts, never your card details, to link your payment to your order and to handle refunds.

The legal basis is the performance of your contract with the organiser (GDPR Art. 6(1)(b)). Keeping the record of a sale for accounting is a legal obligation (Art. 6(1)(c)). Security and fraud prevention rest on the legitimate interest in a platform people can trust with a purchase (Art. 6(1)(f)).

Who receives it

The organiser; the companies that host and run the platform for us, listed at /legal/sub-processors; Stripe, for your payment; and an authority, where the law requires it.

Nobody buys your data from us or from the organiser through us. We do not use it to market anything to you, and we build no profile of you across organisers.

Our e-mail provider, Cloudflare, sends from outside the European Union, under the EU Standard Contractual Clauses. The list at /legal/sub-processors says where each company processes data and on what safeguard.

How long it is kept

The records of your admission and of the messages about the event are kept for 24 months after the event. The record of the sale, which accounting law requires, is kept for 10 years.

Today nothing in the platform deletes data automatically when those periods end. We are building it, and we will say here when it is in place.

Your rights

You may ask for a copy of your data, have it corrected or erased, restrict or object to its use, and receive it in a machine-readable form. Ask the organiser, who is responsible for it; you may also write to us, and we will help the organiser answer you.

You may complain to a data protection authority: in Belgium, the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels; in Bulgaria, where we are established, the Commission for Personal Data Protection; or the authority of the country where you live.

If the organiser is a private person

If the event is a purely private one — a wedding, say, for guests the organiser invites — data-protection law may not apply to the organiser. It still applies to us, and we are then responsible ourselves for what we process on the platform, under the same limits.

Who we are

Pilarres EOOD, UIC 208702712, Legis Center, office 3-8B, 152 6-ti Septemvri Street, 4000 Plovdiv, Bulgaria. E-mail info@bicyr.com. Telephone +32 485 02 94 23.