Privacy Policy

Last updated: February 8, 2026

Socialista ("we," "our," or "us") operates GuestAccess, a smart guestlist management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

1.1 Personal Information

When you register for an account, we collect:

  • Email address
  • Account credentials (encrypted password)
  • Profile information you provide

1.2 Guest Data

When you create guestlists, we process:

  • Guest names
  • Contact information (email, phone)
  • Company affiliations
  • Check-in status and timestamps
  • Guest type classifications

1.3 Usage Data

We automatically collect minimal usage data for security and service improvement:

  • Device information (for compatibility)
  • Browser type and version
  • IP address (for security monitoring)
  • Login timestamps
  • Error logs (for debugging)

1.4 Analytics Data (Google Analytics - Landing Page Only)

With your consent, we use Google Analytics only on our public landing page (guestaccess.nl) to collect:

  • Page views and session duration
  • Approximate geographic location (city/country level)
  • Device type, operating system, and browser information
  • Referring websites and navigation paths
  • User interactions and click behavior

Important: Google Analytics is NOT used within the GuestAccess application itself. Once you log in, no third-party tracking occurs. Your event data, guestlists, and usage within the app are completely private and not shared with Google or any analytics service.

You can opt-out of landing page analytics at any time through our cookie consent banner.

1.5 Payment Information

Payment processing is handled by Stripe. We do not store your credit card details. We receive only:

  • Subscription status
  • Payment history
  • Stripe customer identifier

2. How We Use Your Information

We use collected information to:

  • Provide and maintain our service
  • Process your transactions and manage subscriptions
  • Send you technical notices and support messages
  • Respond to your requests and provide customer support
  • Improve and personalize your experience
  • Monitor landing page performance (with your consent via Google Analytics - public pages only)
  • Detect and prevent fraud and abuse
  • Comply with legal obligations

3. Legal Basis for Processing (GDPR/AVG)

Under Dutch and EU data protection law (AVG/GDPR), we process your data based on:

  • Contract Performance: Processing necessary to provide our service
  • Consent: When you've given explicit consent
  • Legitimate Interests: For service improvement and fraud prevention
  • Legal Obligation: To comply with applicable laws

4. Data Storage and Security

4.1 Data Storage

Your data is stored on our own secure servers, hosted on infrastructure provided by Contabo GmbH with data centers in the EU to ensure GDPR compliance. We implement industry-standard security measures including:

  • Encryption in transit (HTTPS/TLS)
  • Encryption at rest for sensitive data
  • Regular security audits
  • Access controls and authentication
  • Secure backup procedures

4.2 Data Retention

We retain your data for specific periods based on legal requirements and business necessity:

  • Account data: Until account deletion or 2 years of inactivity
  • Event data (guests, crew, artists): Automatically deleted 1 month (30 days) after the event date. You will receive an email notification 7 days before deletion and can export or delete your data earlier at any time.
  • Crew time entries: 7 years (required by Dutch payroll and tax law)
  • Payment records: 7 years (required by Dutch tax law - Belastingdienst)
  • Usage logs: 12 months (for security monitoring and fraud prevention)
  • Database backups: 30 days rolling (for disaster recovery)
  • Google Analytics data: Automatically expires after 26 months (Google's default, landing page only)
  • Cookie consent preferences: Stored locally in your browser until cleared

Automated Deletion: We automatically delete entire events (including all guest, crew, and artist data) 30 days after the event date to keep your data safe. You will receive an email notification 7 days before deletion and can export your data at any time.

Encryption: Contact information (emails and phone numbers) stored in the Artist Database and Crew Company Database is encrypted at rest using AES-256 encryption with per-user key derivation.

5. Data Sharing and Disclosure

We do not sell your personal information. We share data only with:

5.1 Service Providers (Sub-Processors)

We use the following trusted service providers to deliver our service. All have GDPR-compliant Data Processing Agreements (DPAs) in place:

  • Contabo GmbH: Server infrastructure hosting our self-managed database, authentication, and file storage (EU data centers). A GDPR-compliant Data Processing Agreement is in place.
  • Stripe, Inc.: Payment processing (EU data centers available). See their DPA.
  • Google Analytics (Google LLC): Landing page analytics only (with your consent). See Google's Privacy Policy.

Your Role as Data Controller: If you use GuestAccess to manage events, you are the "data controller" for your guest data, and we act as your "data processor." Our Data Processing Agreement (DPA) governs this relationship and ensures GDPR Article 28 compliance.

5.2 Legal Requirements

We may disclose information if required by law or to:

  • Comply with legal process
  • Enforce our terms of service
  • Protect our rights and safety
  • Prevent fraud or security threats

6. Your Rights (GDPR/AVG)

Under Dutch and EU law, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Delete your data ("right to be forgotten")
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a structured format
  • Object: Object to processing based on legitimate interests
  • Withdraw Consent: At any time

6.1 Self-Service Tools

You can exercise many of these rights directly from your account, without needing to contact us:

  • Download All My Data: Go to Account Settings and click "Download All My Data" to receive a complete JSON export of all your data, including events, guests, crew, artists, and audit logs. This is your right under GDPR Article 20 (Data Portability).
  • Delete My Account: Go to Account Settings and click "Delete My Account" in the Danger Zone section. This will permanently delete your account and all associated data, including events, guestlists, and associated records (except payment records retained for 7 years as required by Dutch tax law).
  • Edit Your Data: You can edit your event data, guest lists, artist information, and crew data at any time directly within the application.

6.2 Contact Us

For any other data rights requests (restriction, objection, or complex access requests), contact us at: [email protected]

You can also submit a formal request via our Data Subject Access Request form.

Response Time: We will respond to your request within 30 days (extendable to 60 days for complex requests). There is no fee for exercising these rights unless requests are manifestly unfounded or excessive.

7. Cookies and Tracking Technologies

7.1 Essential Cookies

We use essential cookies to:

  • Maintain your session and keep you logged in
  • Remember your preferences
  • Ensure security and prevent fraud
  • Store your cookie consent preferences

These cookies are necessary for the service to function and cannot be disabled.

7.2 Analytics Cookies (Google Analytics - Landing Page Only)

With your explicit consent, we use Google Analytics cookies only on our public landing page (guestaccess.nl) to:

  • Track landing page usage and visitor behavior
  • Measure marketing campaign effectiveness
  • Understand which features attract visitors
  • Improve landing page performance and user experience

Important: Google Analytics is NOT active within the GuestAccess application (after login). Your event management activities, guestlists, and usage within the app are completely private.

Google Analytics Cookies (Landing Page Only):

  • _ga: Distinguishes unique visitors (expires after 2 years)
  • _gid: Distinguishes unique visitors (expires after 24 hours)
  • _gat: Throttles request rate (expires after 1 minute)

Google Analytics data is processed by Google LLC under their privacy policy. Learn more at: https://policies.google.com/privacy

7.3 Managing Cookies

You can control analytics cookies through our cookie consent banner that appears on your first visit. You can change your preferences at any time by clearing your browser's local storage for our site.

You can also control cookies through your browser settings. Note that disabling essential cookies may affect service functionality. To opt-out of Google Analytics across all websites, you can install the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

7.4 Do Not Track

We respect Do Not Track (DNT) signals. If your browser has DNT enabled, we will not load Google Analytics. However, essential cookies required for the service to function will still be used.

8. International Data Transfers

Your data is primarily stored within the EU. If we transfer data outside the EU, we ensure adequate protection through:

  • EU-approved standard contractual clauses
  • Adequacy decisions
  • Other appropriate safeguards

9. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe we have collected such data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the service. Continued use after changes constitutes acceptance.

11. Contact Information

Socialista

Casembrootstraat 60RD

1972CC IJmuiden

The Netherlands

KVK: 61396478

Email: [email protected]

Data Protection Authority
If you're not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
https://autoriteitpersoonsgegevens.nl