Privacy Policy (GDPR)

We collect the following data, depending on how you use the Platform:

• Account data: name, email, password (encrypted, never in plain text), phone (optional), profile picture (optional);
• Purchase data: tickets and reservations purchased, associated events, order history, digital wallet transactions and balance;
• Ticket usage data: check-in validation (date/time of entry), VIP/table access verifications;
• Technical data: IP address and session identifiers, only to the extent necessary for authentication and security;
• Data you provide when contacting us (e.g. support requests).

If you are staff or an admin of an Organization, we also process your access role within that Organization.

• Creating and managing your account, and authenticating you on the Platform — performance of a contract (Terms and Conditions);
• Processing ticket purchases, reservations and wallet top-ups — performance of a contract;
• Issuing and validating tickets (including the QR code) on the day of the event — performance of a contract;
• Communicating with you about your account, purchases or changes to the Service — performance of a contract and legitimate interest;
• Preventing fraud and ensuring the Platform's security (including login attempt rate-limiting) — legitimate interest;
• Complying with legal obligations, including tax and accounting obligations — legal obligation.

We share personal data only to the extent necessary for the Service to work:

• With the Organization of each event you bought a ticket or reservation for — to manage the event, check-in and customer support (name, contact details, ticket status);
• With our infrastructure and database provider, Supabase Inc., which stores data on servers located in the European Union, under a data processing agreement that ensures the same data protection obligations;
• With public authorities, when required by law.

We do not sell your personal data to third parties, and we do not use it for behavioural advertising.

We keep your data for as long as your account is active. After your account is closed, we delete or anonymize the data within 90 days, except where a longer legal retention period applies — in particular billing and financial transaction data, kept for 10 years under Portuguese tax law.

Under the GDPR, you have the right to:

• Access the personal data we process about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data ("right to be forgotten"), where applicable;
• Request restriction of processing, in certain circumstances;
• Request portability of your data, in a structured format;
• Object to processing based on legitimate interest;
• Lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the supervisory authority in Portugal (www.cnpd.pt).

To exercise any of these rights, contact us at privacidade@servevents.com. We respond within one month, as required by the GDPR.

We apply technical and organizational measures to protect your data, including: password encryption (never stored in plain text), data isolation between Organizations at the database level (Row Level Security), sessions managed via secure cookies, and login attempt rate-limiting.

No system is entirely immune to security incidents. In the event of a data breach posing a risk to your rights, we will notify you as required by the GDPR.

We only use cookies that are strictly necessary for the Platform to work. See our Cookie Policy for more detail.

Your data is stored on servers located in the European Union. Should any future subprocessor involve transfers outside the European Economic Area, we will ensure that transfer is subject to appropriate legal safeguards (such as the European Commission's standard contractual clauses).

We may update this Privacy Policy to reflect changes to the Service or to applicable law. Material changes will be communicated through the Platform or by email, with the "last updated" date at the top of this document.

For any question about this Policy or about your personal data, contact us at privacidade@servevents.com.