1. Controller
The controller of your personal data is TOURINGTUNES Sp. z o.o., ul. Złota 7 lok. 28, 00-019 Warszawa, Poland (KRS 0001053019, NIP 5252968519). Contact: [privacy@strobo.events].
Important — two roles. For data you give us as a user of Strobo (your account, your purchases, platform analytics) we act as controller and this Policy applies. Where an Organizer uses Strobo to manage their guest lists and marketing contacts, the Organizer is the controller of that data and we act as their processor under a Data Processing Agreement; the Organizer's own privacy notice applies to that use. When you opt in to marketing from a specific Organizer at checkout, that consent is given to the Organizer.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email, name (optional), phone (optional) at checkout | Selling and delivering tickets, transactional email (ticket, receipt, reminders, event changes) | Art. 6(1)(b) — contract |
| Payment data | Processed by Stripe; we never store card numbers | Art. 6(1)(b); Stripe acts per its own terms |
| Order history, ticket status, entry scans | Operating entry control, fraud prevention (duplicate QR), support | Art. 6(1)(b), 6(1)(f) — legitimate interest |
| Account data (Clerk), organization membership | Providing organizer/fan accounts | Art. 6(1)(b) |
| Marketing opt-in to an Organizer | Passing your contact to that Organizer's audience | Art. 6(1)(a) — consent (withdrawable per organizer, unsubscribe link in every email) |
| Cookies/pixels (Meta, TikTok, GA4) on event pages | Organizer's ad measurement; our analytics | Art. 6(1)(a) — consent via cookie banner (see Cookie Policy) |
| Technical logs, IP | Security, abuse and fraud prevention | Art. 6(1)(f) |
| Waitlist entries | Offering tickets when they free up | Art. 6(1)(b) |
We do not sell personal data and do not use it for third-party advertising of our own.
3. Recipients
Data is shared with: the Organizer of the event you buy for (your order details — they are the seller); and our subprocessors (hosting, payments, email — full list at /legal/subprocessors: Stripe, Supabase, Vercel, Clerk, Resend). Some subprocessors process data outside the EEA; transfers rely on adequacy decisions (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.
4. Retention
Order and ticket data: as long as needed for the contract and then for limitation periods and tax law (in Poland generally 5–6 years). Account data: until account deletion plus a short safety window. Marketing consent data: until you withdraw consent. Entry-scan logs: up to 12 months after the event. Technical logs: up to 12 months.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), and to withdraw consent at any time without affecting prior processing. Write to [privacy@strobo.events]. You may lodge a complaint with your supervisory authority; in Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa.
For data controlled by an Organizer (their marketing lists), we will forward your request to the Organizer or you may contact them directly.
6. Automated decisions
We do not make decisions producing legal effects based solely on automated processing. Fraud checks may flag transactions for human review.
7. Children
Strobo is not directed at children under 16. Events may carry their own age restrictions set by the Organizer.
8. Non-EEA users
If you use Strobo from outside the EEA, we apply the same standards described here. Where local law grants you additional rights (e.g. certain US state privacy laws), you may exercise them via [privacy@strobo.events].
9. Changes
We will announce material changes to this Policy in-product or by email. Version history is available on request.