IndieTix Privacy Policy

1. Who we are

IndieTix is a ticketing platform for independent events. It is run by Indietix, registered with the Dutch Chamber of Commerce (KvK) under number 42107158.

For anything about your personal data, contact us at info@indietix.app.

2. Who is responsible for your data

When you buy a ticket, you buy it from the event organizer. The organizer is responsible for the data of their ticket buyers and guests; IndieTix processes that data on the organizer's behalf, to run the shop, deliver your tickets and show the organizer their sales.

IndieTix is itself responsible for: handling payments and the bookkeeping that comes with them, keeping the platform secure and working (including error reports), and the IndieTix website and its waitlist.

This policy is for ticket buyers, guests and visitors. Organizers and community partners find how we handle their account data in their dashboard.

You can always contact us, also about data an organizer is responsible for; we will help or pass your request on.

3. What we process and why

If you buy a ticket or are on a guest list

• Your order: your name, email address, the names on the tickets, what you bought and the order status. Needed to sell and deliver your tickets and to let you into the event (performance of the contract).
• Age and gender, if the organizer asks for them. Answering is optional. The organizer only sees them as totals across all buyers (for example, the share of buyers aged 25–34), to understand their audience.
• Payment: you pay through Stripe. Your card or bank details go to Stripe, not to us; we receive whether and how the payment succeeded.
• The link you came from: if you open the shop through a link with a code (for example from a community partner), that code is stored with your order, so the partner who brought you can be credited. It is not used to follow you elsewhere.
• Emails about your order, such as your confirmation and tickets, are sent through Postmark. Links in these emails go through Postmark's click tracking, which records that a link was clicked.
• Updates from the organizer, only if you tick "Keep me updated" at checkout (consent). Every update has an unsubscribe link, and you can withdraw your consent at any time.

If you visit indietix.app

• Waitlist: if you request an invite, we store your email address to contact you about IndieTix (consent). Ask us and we remove it.
• To stop spam, the form briefly counts requests per IP address; that count disappears within minutes.

For everyone

• Server logs: our servers log requests to keep the platform secure and fix problems (legitimate interest). They record a shortened IP address (the last part removed, so it no longer points to you), the page and your browser, and are overwritten automatically as new logs come in.
• Error reports: when something breaks in the ticket shop in your browser, a report goes to Sentry: what went wrong, the page (without any codes or links that give access to an order), your browser and operating system, and an approximate location (city) derived from your IP address. Your IP address itself is not stored, and nothing is recorded unless an error happens (legitimate interest).
• Performance measurements: on about 1 in 10 visits to the ticket shop, your browser sends Sentry how long the page and the cart took to load: timings, the pages and requests involved (without any codes or links that give access to an order), your browser and an approximate location (city). Nothing identifies you, and nothing is stored in your browser (legitimate interest: keeping the shop fast).

4. Cookies and similar technologies

We only use what the platform needs to work. There are no advertising or analytics cookies.

• Ticket shop: a session cookie that holds your cart and a security cookie that protects forms, plus the choice you make in the shop's cookie dialog.
• indietix.app: no cookies. Your choice of light or dark theme is stored in your browser only.

5. Who receives your data

• The event organizer receives the data of their buyers and guests (section 3).
• Hetzner (Germany) hosts the platform and its backups.
• Stripe processes payments. For fraud prevention and financial regulation, Stripe is itself responsible for some of this data; see Stripe's privacy policy.
• Postmark (ActiveCampaign, USA) sends our emails.
• Sentry (Functional Software, USA) receives error reports and performance measurements, stored in the EU.

We do not sell your data. Where a provider is based outside the EU, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep it

• Orders and payments: 7 years, as Dutch tax law requires.
• Guest lists: until 12 months after the event.
• Consent to updates, and the waitlist: until you withdraw it or ask us to remove you.
• Server logs: overwritten automatically; their size is capped, so old entries are removed as new ones come in.
• Error reports and performance measurements: at most 90 days.
• Database backups: up to 6 months; snapshots of the server: 7 days. Both are deleted automatically.

7. Your rights

You can ask us for a copy of your data, to correct or delete it, to limit how it is used, or to receive it in a portable format, and you can object to processing based on legitimate interest. Where we rely on your consent, you can withdraw it at any time. Email info@indietix.app; we answer within one month.

If you are not satisfied, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

8. Security

All connections are encrypted, database backups are encrypted, and access to systems with personal data is limited to the people who run IndieTix.

9. Changes

When we change how we process data, we update this policy and the date at the top.