Privacy Policy

1. Controller and scope of this notice

Data controller for the platform's own purposes: ART STUDIOS MANAGEMENT S.R.L., Tax ID (CUI) 53262231, trade register number J2026002109006, registered in Romania, legal email address management@euphorictickets.ro. The registered office is available to competent authorities and verified counterparties through the appropriate private channel. Questions and requests about your data go through the contact channels at the end of this notice.

This notice covers:

• visitors of the website;
• buyers and attendees, including people whose Euphoria tickets were bought through the sales channels used before this platform;
• people who receive guest passes;
• customer account users and newsletter subscribers;
• people who contact support, send feedback, or report an event or content;
• artists and applicants who use the partner portal or appear in public artist profiles.
• Organizers' representatives, contacts, and door operators are covered by the separate Organizer Privacy Notice at /organizers/privacy.

2. Categories of data

3. Purposes and legal bases

Each purpose is listed below with the legal basis relied on for it. Withdrawing consent does not affect processing carried out before the withdrawal, or processing based on another legal basis.

4. Data sources and mandatory nature of data provision

Data is obtained:

• from you;
• from a buyer who orders tickets for you, or from the organizer or the platform's staff who add you to a guest list;
• from Stripe, which passes on the details entered on the payment page, and from Google, if you choose Google sign-in where it is offered;
• from organizers and artists who manage events, line-ups, and profiles, and, for public artist profiles, from publicly available sources such as an artist's official website or social profile;
• from the channels that sold Euphoria tickets before this platform existed (the former Euphoria online shop on Shopify, and Resident Advisor), for tickets bought there and the related sales records;
• from Euphoria's earlier mailing list, imported into the email provider on 14 September 2026 (see Marketing emails above).
• Data marked as mandatory is required for ordering, ticket delivery, admission verification, invoicing, or responding to a request. Refusal to provide it may prevent provision of the service. Optional data is labeled separately.

5. Guest passes

When an organizer or the platform's staff add a person to an event's guest list, the platform receives that person's name and, optionally, their email address, together with the guest type (such as guest, artist, photo or video, or staff), the number of passes, and any note from the organizer. A door team can also issue a free pass at the entrance with a name and an optional email address.

These details are used to issue the passes, to email the QR codes with a PDF and an Apple Wallet link, and to check the passes at the door. Organizer accounts with editing rights for the event, including a co-organizer with editing rights, can see the guest's email address; view-only accounts see the name only. Guests are not added to any marketing list. A guest can ask the organizer, or use the contact channels at the end of this notice, to have their pass cancelled or their details corrected or deleted.

6. Apple Wallet passes

If you tap “Add to Apple Wallet”, the platform's server creates a pass with your name, the event, its date and time, the venue (unless it is still secret or to be announced), the ticket type, the ticket and order references, the QR code, and any note from the organizer. The file is sent straight to your device and is not stored by the platform.

The pass does not register with Apple or receive updates from the platform. Apple handles it on your device under your own agreement with Apple.

7. Artists, applicants, and the exhibition

• Artists who use the partner portal publish their own profile, photos, and content, which appear immediately; the platform's staff can hide or remove them afterwards. A public profile shows what is entered for it, such as the name, genres, biography, links, and images, and any booking email address or contact methods the artist chooses to publish.
• Some profiles are created by the platform's staff from information the artist or their agency has already made public, such as an official website or social profile, so that event line-ups are accurate. The artist can claim the profile, correct it, or ask for its removal through the contact channels at the end of this notice.
• Applications to perform or exhibit include the stage name and, optionally, the legal name; the email address and, optionally, a phone number; city, country, artistic details, links, and availability; and, for visual artists, the works with their titles, details, prices, and images. They are reviewed by the platform's staff.
• The exhibition page shows each published work with its title, details, price, and status (available, reserved, or sold), together with the artist's name and profile.
• Images are published as uploaded, so remove location data from photos before uploading them.

8. Categories of recipients and providers

• The organizer of the event you buy for or are invited to receives the order reference, ticket type, quantity, and amounts it needs to run the event, settle sales, and handle refunds and complaints. Organizers do not receive buyer lists for marketing.
• Door staff checking tickets for an event see the email address used for the order and the order reference when a ticket is checked; while tickets are being checked for that event, they can also look up a ticket by the holder's name or email address.
• A co-organizer invited to an event with access to its finances can see that event's sales, refunds, order references, and amounts, but not buyers' names or email addresses. A co-organizer with editing rights can see the event's guest list, including guests' email addresses.
• Stripe runs the payment page (cards, wallets, and Revolut Pay), refunds, and disputes. For its own fraud-prevention and regulatory processing, Stripe is an independent controller.
• Oblio issues invoices and credit notes, can email the invoice to the buyer and, where enabled, submits invoices to the Romanian tax authority (ANAF) through the e-Factura system.
• Vercel (hosting), Supabase (database, partner portal sign-in, and file storage), and Resend (email delivery, marketing contacts, and broadcasts) act as processors on the platform's instructions.
• Google receives data through Google Analytics 4, only after you accept analytics. Meta (Facebook and Instagram) receives data through the Meta Pixel, only after you accept advertising. For the collection and transmission of data through the Meta Pixel, Meta and the platform are joint controllers; the essence of that arrangement is Meta's Controller Addendum at https://www.facebook.com/legal/controller_addendum. Meta alone is responsible for what it does with the data afterwards, as its notice at https://www.facebook.com/privacy/policy/ explains.
• The public sees the information that artists and organizers publish on their own profiles and event pages.
• Accountants, auditors, lawyers, insurers, and advisers receive data where access is necessary and protected by confidentiality.
• Authorities and courts receive data where disclosure is required or permitted by law.

9. Providers, locations, and international transfers

The platform's server functions run in Frankfurt, Germany, its database and stored files are kept in Frankfurt, and its emails are sent from Dublin, Ireland. Not everything stays in the European Union: Resend processes contact lists, message logs, and broadcasts mainly in the United States, and Vercel may keep request logs outside the EU.

Some providers are established, or belong to groups established, in the United States, outside the European Economic Area, so their staff or group companies may access data from there: Vercel, Supabase, Stripe, Resend, Google, Meta. Stripe keeps a customer record for each checkout, and Resend keeps a contact for each paying buyer.

For these transfers the platform relies on the European Commission's adequacy decision of 10 July 2023 for providers certified under the EU-U.S. Data Privacy Framework, and otherwise on the standard contractual clauses adopted by the Commission, which are part of the provider's data processing terms. The safeguard for each provider is listed below; a copy can be requested through the contact channels at the end of this notice.

Providers used by the platform today, with their role, location, transfer safeguard, and privacy notice:

• Vercel: Application hosting, request handling, scheduled jobs and logs. Server functions in Frankfurt, Germany, behind a global edge network; request logs may be kept outside the EU. Vercel Inc. is established in the United States. Transfer safeguard: Vercel Inc.'s certification under the EU-U.S. Data Privacy Framework. Privacy notice: https://vercel.com/legal/privacy-policy.
• Supabase: Database, partner portal sign-in and file storage. Frankfurt, Germany. Supabase Inc. is established in the United States. Transfer safeguard: the European Commission's standard contractual clauses in the provider's data processing terms. Privacy notice: https://supabase.com/privacy.
• Stripe: Payments, hosted checkout including Revolut Pay, refunds and disputes. European Union and United States. Transfer safeguard: Stripe, LLC's certification under the EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses in the provider's data processing terms. Privacy notice: https://stripe.com/privacy.
• Resend: Email delivery, marketing contacts and broadcasts. Emails are sent from Dublin, Ireland; contact lists, message logs and broadcasts are processed mainly in the United States, where Resend, Inc. is established. Transfer safeguard: Resend's certification under the EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses in the provider's data processing terms. Privacy notice: https://resend.com/legal/privacy-policy.
• Oblio: Invoices and credit notes. Romania. Privacy notice: https://www.oblio.eu/politica-de-confidentialitate.
• Google: Google Analytics 4, only after analytics consent. Google Ireland Limited, with processing by Google LLC in the United States. Transfer safeguard: Google LLC's certification under the EU-U.S. Data Privacy Framework. Privacy notice: https://policies.google.com/privacy.
• Meta: Meta Pixel for Facebook and Instagram, only after advertising consent. Meta Platforms Ireland Limited, with processing by Meta Platforms, Inc. in the United States. Transfer safeguard: Meta Platforms, Inc.'s certification under the EU-U.S. Data Privacy Framework. Privacy notice: https://www.facebook.com/privacy/policy/.

10. Retention

A single period does not apply to all data, and fixed periods for each category are still being set. Until then, data is kept for as long as it is needed for the purposes above and for the limits that apply to it, such as the periods that Romanian accounting and tax law sets for invoices and the order records behind them and the time limits for payment disputes and legal claims, and is then deleted or anonymized.

This currently applies to orders, invoices, customer accounts, guest lists, door checks, email delivery records, support requests, feedback, applications, marketing contacts, and the details of checkouts that were started but not paid, which are kept with the order record.

Deletions the platform already applies automatically:

• Sign-in links are valid for 15 minutes, can be used once, and are deleted one day after they expire.
• Rate-limit records, which hold only a keyed hash, are deleted at the next check after they are a day old. Checkout reservation guards are deleted seven days after the last attempt.
• An unpaid order releases its reserved tickets after 35 minutes; the order record itself is kept.
• Apple Wallet pass files are not stored by the platform.
• Cookies and browser storage last as listed in the Cookie Policy.

11. Security and incidents

No measure eliminates risk completely. Individuals are asked not to publish QR codes, authentication links, or sensitive documents and to report suspicious activity promptly.

• Role-based access and the principle of least privilege for staff and partners.
• Secure sign-in, protection of secrets, and a record of changes made to events.
• Payment hosted by the PSP, so the platform never receives or stores full card details.
• Database copies taken by the operator, for example before a release; regular component updates.
• Account, ticket, checkout, sign-in, partner, and staff pages are not cached and do not pass their address on to other sites. Sign-in links are single-use and are stored only as a hash.
• Security incidents are assessed and, where required, notified to ANSPDCP within 72 hours and to the people affected without undue delay.

12. Data subject rights

Rights may be exercised through the contact channels at the end of this notice; /gdpr explains how a request is handled. A request may require proportionate identity verification, and some data may be retained where a legal obligation or applicable legitimate reason exists.

Marketing consent can be withdrawn with the unsubscribe link in any marketing email, and analytics and advertising consent through “Cookie preferences” in the site footer. A customer account cannot be deleted from the account pages: to delete it, use the support form at /support or write to management@euphorictickets.ro. Invoices and the order records behind them are kept for the period required by accounting law.

• Information and access to processed data.
• Rectification of inaccurate data and completion of incomplete data.
• Erasure or restriction, subject to the conditions of law.
• Objection to processing based on legitimate interests and objection at any time to direct marketing.
• Data portability where the applicable conditions are met.
• Withdrawal of consent without affecting prior processing.
• Lodging a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Bld., District 1, 010336 Bucharest, Romania, www.dataprotection.ro, anspdcp@dataprotection.ro.

13. Marketing, cookies, and minors

• Marketing emails about ticket releases and events are sent to contacts marked as subscribed with the email provider, Resend. On this platform, you subscribe through the sign-up form on the homepage or the unticked box at checkout; the wording, date, and source of each opt-in are recorded, and for an opt-in at checkout also the version of the wording.
• Resend also holds Euphoria's earlier mailing list, imported on 14 September 2026, which has received event emails; see Marketing emails under Purposes and legal bases.
• Organizers do not receive buyer lists for marketing, and buyers are not offered a separate organizer marketing option.
• Each marketing email includes an unsubscribe link. Unsubscribing stops future marketing and does not affect ticket, order, or event-change emails.
• Buyers' names and email addresses, including those of tickets bought through earlier Euphoria sales channels, are kept as contacts with Resend so that every opt-out is respected. A buyer who has not subscribed is added as an unsubscribed contact and is not sent marketing.
• Messages concerning a ticket, payment, venue, admission, cancellation, or security are operational communications, not newsletters.
• Analytics and advertising technologies are enabled only after a choice in the cookie banner; the Cookie Policy describes them.
• Events sold on the platform are for adults: each event page shows a minimum age of 18 or higher. No date of birth or identity document is collected for a purchase. The platform is not intended for children and does not knowingly collect their data; if a child's data has been provided, tell us through the contact channels below and it will be deleted.

14. Automated decisions, updates, and contact

The platform takes no solely automated decision producing legal or similarly significant effects about a buyer. A card payment can be declined by the payment provider's own anti-fraud controls; that logic belongs to the provider, and its notice explains how a decline is contested. Rate limits protect forms and sign-in against abuse and do not assess a person.

Contact for data protection matters: the support form at /support, choosing the topic “Other”, or an email to management@euphorictickets.ro with the subject “Personal data request”. The controller is ART STUDIOS MANAGEMENT S.R.L., registered in Romania. No data protection officer has been appointed. Material changes to this policy receive a new version and reference date, shown at the top of this page.

Version 2026-10-07.1 replaces version 2026-08-01.1. Main changes: the providers in use, where they process data, and the safeguard for each transfer; a legal basis for each purpose; guest passes; Apple Wallet passes; artists, applicants, and the exhibition; analytics and advertising; messages to specific people, marketing contacts, and the earlier mailing list; how long data is kept; and the support form as a contact channel.