Privacy statement

Which data PartyPPL processes about you, why, who else sees it, how long we keep it and what you can do about it yourself. Written to the GDPR, and as honest as the code allows.

Dernière mise à jour : 19 October 2026

Brouillon. This statement describes what the platform does today, but it has not been reviewed by a lawyer. Where practice is not yet what it should be, it says so.

En bref

PartyPPL is responsible for your data, and we do not sell it, show no ads and use no third-party trackers.
We use your data for your account, the social features, tickets and the safety of the platform; push notifications, the digest and marketing mail only reach you if you turn them on yourself.
Everything we keep has a period, from 10 minutes for a login code to seven years for orders, and a task that runs every day cleans up.
You download your data and delete your account yourself in Settings; for anything else, mail privacy@partyppl.nl.

Un résumé. Ce sont les articles ci-dessous qui comptent.

1Who is the controller

PartyPPL determines the purposes and means of the processing on this page and is therefore the controller under article 4 GDPR. PartyPPL is the trade name of the business registered with the Netherlands Chamber of Commerce under number 97359866.

Controller: PartyPPL
Chamber of Commerce number: 97359866
VAT identification number: NL005264805B67
Address: Pater R.D. Kloegstraat 7, 5684 TK Best, the Netherlands
Contact: privacy@partyppl.nl
Security reports: security@partyppl.nl and Security

We have not appointed a Data Protection Officer (DPO). Any question can go to the address above.

For part of the data the organiser of an event is responsible, for example for what they do with the ticket export. See the article on recipients and the organiser terms.

gaming.partyppl.nl uses the same account and the same controller as partyppl.nl; this statement applies there too.

2What data we process

Account: E-mail address, name, username, city, genres, profile photo and banner, bio, links, colour, language and theme, whether your profile is private, your chosen badge, whether you show your reviews, your group chat choice for "I'm going", whether you want tips based on what you do, your notification preferences, quiet hours and whether you want the e-mail digest and marketing mail.
If you sign in with Apple: Also the fixed Apple id Apple gives PartyPPL, and the e-mail address Apple passes on (which can be an Apple relay address).
Age: Your date of birth, entered once, and the fact that the 18+ check passed. We do not ask for an ID document.
Logging in: The six-digit code (valid 10 minutes, 5 attempts), passkeys (the public key, a counter, the kind of device, the name you give it and when you used it), an encrypted TOTP secret and hashed recovery codes if you turn on two-factor authentication.
Sessions: Per logged-in device a hash of the session token, when it started, was last used and expires, your IP address, your browser (user agent) and whether you did two-factor authentication. You see that list yourself in your settings.
Security log: Logins, failed attempts, codes sent, two-factor authentication, passkeys, logouts and revoked sessions, with your e-mail address, IP address, user agent and time. Never the code itself.
Social: "I'm going" and "Interested", your party history ("Was there"), friends and requests, who you follow, blocks, muted and left group chats, invitations, likes, votes, badges and the photos a friend tagged you in. Whether your ticket for a night was scanned OK at the door: that proves you were there, shows as "Was there" under a review or report you write about that night, and makes your own "Your night" page and the notification the day after possible. Who gives respect to a review or report. And the sets you star in a timetable ("My timetable"), with whether you want a nudge before them.
Finding friends through your contacts: Only if you choose to at the start: the e-mail addresses from your contacts (at most 200) go to our server to see who is already on PartyPPL. We do not keep that list.
What you post: Chat messages, forum topics and replies, reviews of venues and nights, reports, questions and answers, photos, token prices, corrections to pages, site maps, events you submit and your checklist. When you upload a photo we strip its metadata, such as the place it was taken and the device. Profile photo and banner are also re-saved in your browser before they reach us.
Tickets and orders: Order, ticket type, amounts, service fee, discount code, ticket code, the name on the ticket, the moment of scanning, resale, transfers and refunds. If you pass a ticket on to an e-mail address that has no account yet, we create an account for that address.
Tickets from another shop: If an organiser sold tickets elsewhere and loaded them into PartyPPL, they give us your e-mail address, name, ticket code, type and price. We erase the e-mail address as soon as we have mailed you or the ticket is on your account; after that we keep only an encrypted fingerprint of it to link the ticket to you.
Pre-Buy: If you ask us to buy a ticket for you, we keep the names you give per ticket, the kind of ticket, the number, your maximum price, the amounts, the status of the purchase and the code or PDF of the ticket we bought for you. The PDF is kept private: only you and our administrators can open it.
Payment: Stripe handles that. We keep only the Stripe references and the amounts, never your card number or IBAN.
Reports you file: What you report, the reason, your username and what we did with it.
Notifications you receive: In-app notifications, and the addresses your device receives push notifications on: a web push subscription from your browser or a push token from the iPhone app, with the kind of device and the app version. The Android app does not exist yet; when it does, we keep its push token the same way.
The Apple apps: For widgets a token of which we keep only the hash, for a Live Activity a push token per night, for Apple Wallet which device holds which pass with the address Wallet receives updates on, and for a paired Apple TV the name of the TV, a hash of its key, the IP address at pairing and when it last asked for anything. See the article on the apps.
Linking Spotify: Only if you do it: an access key from Spotify, at most 15 minutes, to read which artists you follow there. What you tick becomes an ordinary follow here. We do not keep your Spotify account itself.
Linking Discord: Only if you do it yourself, with /koppel in the PartyPPL Discord: your Discord user id and your username, to give you roles in the PartyPPL Discord server. The bot only reads whether you are 18+ verified, organiser, artist or team. Nothing else goes to Discord. We keep it until you unlink or delete your account.
Location: Only when you tap "near me". Your position then travels, rounded to about a kilometre, in the address of the agenda (for example bij=52.09,5.12), so the server can pick the nights nearby. We do not keep it with your account; like every address requested, it does sit in the web server's access log for at most 7 days.
Organisers: If you are a team member of an organisation, also your role, the API tokens you create (with the version of the API terms you accepted then, and when), the scans you make at the door and, if you have the organisation verified, the Chamber of Commerce extract you upload. That extract sits in shielded storage only your team and our administrators can open. If you accept the organiser terms and the data processing agreement on behalf of the organisation, we keep that you did, with the versions and the time.
Connected apps (OAuth and MCP): If you connect an app to your account, such as Claude through our MCP server, we keep which app it is, whether you connected it on behalf of an organisation or just for yourself, with which rights, when you connected it, when the app last asked for anything, when it was disconnected, and which version of the API terms you accepted. We keep the app's keys only as a hash: an access key is valid for an hour, a refresh key for 30 days. When an app registers with us, we keep its name, its return addresses and the IP address and user agent it registered from.
Questions to support: If you ask a question on support.partyppl.nl, with the contact form or by mailing support@partyppl.nl, we keep your e-mail address and your name if you give it, the subject, the category, the language, your messages and ours, attachments, and if you are logged in your account and the order or night it is about. Without an account you first confirm your e-mail address with a code by mail. Mail to our other addresses, such as info@ and privacy@, arrives on our own mail server and we read it in webmail or a mail app.
Affiliate programme: If you take part: your application (the name on your link, where you share it and optionally a link to that channel), when you accepted the affiliate terms, our team's decision, the number of clicks on your link per day (nothing about who clicked), your monthly statements, your PartyPPL credit with every movement (added, taken off the service fee of which order, given back) and, once payouts in money are on, the id of your Stripe account. If you sign up through somebody else's link, we keep with that link your account, when you took the 18+ step, whether you came back after your first day, and an encrypted fingerprint of your e-mail address (an HMAC with a secret key, which cannot be turned back into the address), so the same person does not count twice. No IP address and no device. Whoever shared the link sees only numbers, never who you are.
Statistics: Counts per day: page views per kind of page, an estimate of unique visitors, how often and how long pages of nights, artists and venues were on screen, and how long visits lasted on which kind of device. No cookie and no id. We count searches per day; a search line that found nothing is kept as text, without an account, IP address or cookie, and lines that look like a name, e-mail address, phone number or address are left out. Clicks on the button to a night's official ticket shop are counted per night per day, without an account, cookie or IP address. When you arrive through one of our campaigns (a link or QR code on a poster, for example), we count the visit, the scan and the click to the App Store per campaign per day, also without an account, cookie, IP address or browser details. When you arrive from outside the site, we count per day where that visit came from: the utm details in the link (they are in the links of our posts on social media, for example), otherwise the kind of site you came from, such as Google or Instagram, otherwise 'direct'. Only as a total per source, without an account, cookie, IP address or browser details. When someone opens a page that does not exist, we count that address per day, with only the name of the site the link was on; nothing about the visitor. From 12 to 16 October 2026 we also counted visits with Umami, which we ran ourselves on our second server. Per page view Umami stored the path of the page without what comes after the question mark or after #, the site you came from, your browser, operating system, kind of device, screen size and language, and the country, region and city derived from your IP address, grouped with a session id with a secret value that changed every day. No IP address, no cookie and no id of you as a person. Since 16 October 2026 Umami is switched off: the site no longer loads the script and nothing goes to it. Those counts sit in a closed archive that is not online, and nothing is added. If we start measuring differently, this page says so first. See cookies.
Server log: Our server writes technical lines for requests. The web server keeps an access log: for each request your IP address, the time, the page requested, your browser (user agent) and technical details of the request, such as the country Cloudflare passes on. Our own lines contain your user id and IP address at login, and who did what for administrator actions.
Bounces and complaints: If a mail from us does not arrive because your address does not exist (any more), or you mark a mail from us as spam, Resend tells us. We then keep your e-mail address, whether it was a bounce or a complaint, when it first and last happened and how often. After that we send no more mail to that address, except a login code you ask for yourself.
Marketing mail: Only if you turn it on yourself, in Settings or on Mail preferences: that it is on, when and where you turned it on, and for each mail we sent you which campaign it was, when, and whether it went through. If you turn it off, we erase the moment and the place.

We do not ask for special categories of personal data. What you put in a chat, forum post or photo yourself, we do process. Do not put anything there you would not want out.

3Purposes and legal bases

Your account and the social features. Basis: contract (art. 6(1)(b) GDPR).: Logging in, your profile, "I'm going", friends, group chats and direct messages, forum, in-app notifications and the e-mails that go with them, such as your login code.
Selling, delivering and handling tickets. Basis: contract.: Ordering, paying through Stripe, your ticket and the confirmation mail, scanning at the door, resale, passing tickets on, refunds and telling you when an event is moved or cancelled.
Pre-Buy: buying a ticket in your name. Basis: contract.: We fill in the names per ticket in the organiser's official ticket shop, because it sells tickets in a name. We use them for nothing else. The ticket, the refund and the messages about them belong to the same contract.
The apps and their extras. Basis: contract.: Widgets, Live Activity, Apple Wallet, Apple TV and the Apple Watch do what you switch on. They do not work without this data.
The 18+ check. Basis: legitimate interest ((f)).: A platform about going out, alcohol and chats with strangers is not for minors. Our interest is that they do not become socially active or buy tickets here.
Security, abuse and moderation. Basis: legitimate interest ((f)) and the Digital Services Act ((c)).: Session management, the security log, rate limits, the automatic check of public text, handling reports and being able to account for our decisions. Our interest: a platform that stays up and where nobody gets scammed.
The web server's access log. Basis: legitimate interest ((f)).: Recognising attacks and abuse, and tracing faults that only show up after a few days. Our interest: a site that is safe and keeps working. We keep it for at most 7 days and use it for nothing else.
Statistics. Basis: legitimate interest ((f)).: Knowing how many people use the agenda, which pages work, through which channels people come in and which addresses do not exist (any more), without following individuals. The closed Umami archive falls under this too.
Delivering our mail. Basis: legitimate interest ((f)).: A list of addresses that bounced or complained about spam, so we stop mailing them. Our interest: that mail providers do not start treating our mail, your login code included, as spam. In your interest too: you get nothing more of what you reported as spam.
Marketing mail: news and tips from PartyPPL. Basis: consent ((a)), and for mail with advertising article 11.7 of the Dutch Telecommunications Act.: At most two mails per 30 days with news about PartyPPL, big nights and tips, only from PartyPPL itself. The switch is off until you turn it on yourself, and it is not tied to the digest or to the terms. To pick who gets a mail we only use what is already on your account: your city, your genres, whether you were active in the last 30 or 90 days (logged in, used the site or said "I'm going"), how often you said "I'm going", whether you are on an organiser's team, and your age: only people of 18 or older. The mail goes to your e-mail address through Resend, without a tracking pixel. You can turn it off any time: with one click at the bottom of every marketing mail (also without logging in), on Mail preferences or in Settings. Your digest then stays as it was.
Push notifications, the digest and marketing. Basis: consent ((a)).: You turn push notifications on yourself and off again per kind. Notifications about offers and news are off by default. The digest mails (your weekend on Friday, your unread notifications and, for organisers, the Monday mail) are off too until you turn them on yourself, in the onboarding or in Settings; we keep when you said yes. You stop them there again, or in one click with the unsubscribe link at the bottom of such a mail. A ticket alert you turn on per night, and off again with the link at the bottom of the alert mail.
Finding friends through your contacts, linking Spotify and linking Discord. Basis: consent ((a)).: Only when you ask for it, and we keep only the result you choose yourself.
Filling and sharing the agenda. Basis: legitimate interest ((f)).: Collecting public event data, having it completed by AI and publishing it, also on our social channels, where our team also posts messages it writes itself. It holds names of artists and organisers, never data of visitors.
Verifying organisers. Basis: contract and legitimate interest.: Checking that an organisation is who it says it is, with the Chamber of Commerce or VAT number and the extract.
The affiliate programme. Basis: contract (with the affiliate) and legitimate interest ((f)).: Rewarding affiliates for new members who are real, and preventing abuse: signing yourself up, second accounts, many signups at once. Our interest: a fair programme without fake accounts. On an affiliate's link the invitation cookie that remembers which link you came through is only set when you tap "Sign up through this link" yourself; if you open more than one link, the last one counts.
Connected apps and support. Basis: contract ((b)); for a question from someone without an account, legitimate interest ((f)).: Letting an app you connect yourself do what you allow, and answering your question. Our interest for a question without an account: being able to help anyone who asks us something.
Recording what you accepted. Basis: contract ((b)) and legitimate interest ((f)).: Which version of the terms, the organiser terms, the data processing agreement or the API terms you accepted, and when. Our interest: being able to show what was agreed.
Accounting. Basis: legal obligation ((c)).: Keeping orders and payments for as long as the tax retention obligation runs, seven years.

No ads, no third-party trackers, no selling of data.

You can object to processing based on legitimate interest. See the article on your rights.

4The apps for iPhone, iPad, Apple Watch, Mac and Apple TV

The apps show the same site as partyppl.nl and use the same account. A few things happen on your device itself or through Apple:

On your device: The widget token and your latest widget data (with the ticket code of your next night, so the QR works offline too) sit in the app's shielded storage and go when you log out. Alarms from "Wake me" are set locally by the app with AlarmKit. The Spotlight index of your upcoming nights exists only on your iPhone.
Apple Intelligence: Translate and Improve in the chat, and summarising, run on the language model on your iPhone itself. The text does not leave your phone for that and does not come to us.
Siri and Visual Intelligence: "What's on tonight" fetches the public list for tonight, without an account. Point the camera at a poster and your iPhone reads the text and sends the largest lines as a search to our public search, without an account. A search that found something is not kept; one that found nothing counts in the statistics above, without an account.
Push notifications and Live Activity: Run through Apple's push service (APNs). A Live Activity token belongs to one night you said "I'm going" to and disappears after two days.
Apple Wallet: Add a ticket and the pass shows the night, the venue, your name on the ticket and the QR code. Wallet registers with us for updates; on a scan, resale, transfer, postponement or cancellation we send a signal through Apple and Wallet fetches the new pass. Pass the ticket on and your pass becomes void.
Apple TV: You pair a TV with a code at /tv/koppel. The TV may then read your personal list and say "I'm going", nothing to do with tickets. Unpair in Settings or on the TV.
Sign in with Apple: Apple is responsible for that login step itself. We receive the Apple id and the e-mail address Apple passes on.

5AI and automatic completion of the agenda

We have Claude by Anthropic help to complete the agenda. That is about public event data, with one exception set out below: our marketing team's weekly proposal, with counts without people. The event data are: title, date, venue, city, line-up, the organiser's name and website and the source page. With that, Claude searches the web for a poster, a site map, the ticket types, the official shop, offers elsewhere with an indicative price, and for festivals the token price. Claude also writes better descriptions from the same facts and helps pick genres.

Nothing about you goes to Claude: no account, no chat, no tickets, nothing about any one visitor.
A site map from Claude only goes live after a person has approved it.
Prices elsewhere and token prices are shown as an indication, with the source and the day they were seen. They are not prices we vouch for.
Every question to Claude and every answer is kept in a log for six months, so we can trace where something came from. That log holds no visitor data.
For our marketing team, fixed rules work out a proposal every week (which nights to feature, on which channel). When it is switched on (only with a key, with Claude not paused and room in the month's budget), Claude rewrites that proposal into a short paragraph. Claude then receives only the proposal: counts without people, such as how many people said "I'm going" for a night or in a city or genre, how many people with marketing mail on fit an audience and how often a city was searched for without a result, with the names of nights, cities, audiences and channels. Never anything about one person. The numbers stay those of the rules.

On your iPhone, Apple Intelligence runs on the device itself; see the article on the apps.

6Profiling and automated decision-making

There is no automated decision-making with legal or similarly significant effect within the meaning of article 22 GDPR. Technology does decide some things by itself. This is it:

A check of public text. Chat messages, forum posts, reviews and profile texts get a score on signals of ticket scams, payment requests, contact details, drug dealing, hate, threats, spam and shouting. How new your account is and whether you just posted the same message elsewhere count too. The only outcomes are let through or hold: held text waits until a person looks at it, and you see that it is waiting. Nothing is removed automatically and nobody is suspended automatically.
The import filters events on date, duplicates and whether it is nightlife. That is about events, not people.
Rate limits per account or IP address on logging in, uploading, messages, reports, submissions and discount codes.
Resale automatically gets the price of the ticket type; you cannot set it yourself.
For you on the home page picks and orders tips. If you are logged in and "Tips based on what I do" is on (the default), it looks at exactly this: the artists, venues and organisers you follow; the nights that are over on which you had "I'm going", and your party history, counted per venue and organiser; your city and your genres; and the nights your friends have "I'm going" on, but only friends with a public profile, and never anyone you blocked or who blocked you. Every tip says in one line why it is there, for example "You follow Amelie Lens", "You were at Shelter 3 times" or "2 friends are going". Nights marked as sensitive count for nothing and are therefore never tipped. The tips are worked out again on every visit and not stored, and nobody else sees them. Featured events, which an organiser paid for, come first and are marked as such.
Objecting to For you (article 21 GDPR) is one switch: turn off "Tips based on what I do" in your settings under Privacy. For you then only orders by your city and your genres, as for someone who is not logged in, and no longer looks at what you follow, where you went or where your friends go.
People like you also went on the pages of artists, venues and organisers comes from a count that runs every night: which artists, venues and organisers are visited or followed by the same people. A pair only counts with at least 20 people in common, never from one night on its own, and without nights marked as sensitive. The result holds no people and no numbers: only which pages belong together.
How busy is it on the page of a night scanned in with PartyPPL says quiet, normal or busy. It comes from the number of scans at the door in a half hour that ended a quarter of an hour ago, next to the number of tickets or "I'm going" for that night, and only appears once 50 people are in. It never shows a number and none of it is about one person.
Who gets a marketing mail is chosen by our team per mail, with filters on city, genres, activity, the number of "I'm going" and whether you are an organiser (see the article on purposes). The server then looks up the people who have marketing mail on; with it off, you are never part of it. Nothing about you is kept except which mail you received.

Moderation decisions are made by people. If an automatic measure hits you unfairly, mail info@partyppl.nl. If we remove something of yours or suspend your account, the e-mail and the notification about that decision link to a page (partyppl.nl/bezwaar/...) where you can appeal.

7When you apply to us

On jobs you find the places in our own team, and you can also send an open application. You do not need an account for that.

What we ask: Your name, e-mail address and motivation, and if you like your phone number and your CV (PDF or Word, 5 MB at most). We also keep in which language and when you applied, and the status we give it.
What for: Only to assess your application and to get in touch with you. Legal basis: the steps you take yourself towards a possible employment contract (article 6(1)(b) GDPR). If you tick 'Keep my application for a year', we keep it longer with your consent (point (a)), for a next vacancy.
Who sees it: Only the administrators of PartyPPL, after logging in with a second factor. Your CV sits in a shielded part of our storage, never at a public address. Only an administrator who showed their second factor again within the last hour can download it, and every download is in our log. You get a confirmation by e-mail through Resend; the administrators get a mail with only your name and what you applied for.
How long: Until 4 weeks after the procedure has ended: when the vacancy closes, or when we decide on an open application. If we do not decide on an open application, at the latest half a year after we received it. If you tick 'Keep my application for a year', that becomes a year. A task that runs every day then erases your application with your CV.
Erase sooner: You can always withdraw your consent or have your application erased sooner: mail privacy@partyppl.nl.

No software decides on your application: we read it ourselves. A field you do not see stops robots, and we count how often a form is sent per e-mail address and per connection, against abuse.

8Invoices and bookkeeping

On pay.partyppl.nl are PartyPPL's invoices to organisers (such as featured slots) and our own bookkeeping. Visitors who buy a ticket never go there: their proof of payment stays the confirmation by e-mail and Stripe's receipt.

What we record: For an organisation we invoice: the legal name, the address, the country, the VAT number with the result and reference of the check in VIES, the Chamber of Commerce number and the e-mail address for invoices. On every invoice a frozen copy of those, with the lines, the amounts and the VAT. The bookkeeping holds every payment, refund and payout as an entry; a visitor is in it only as the number of an order, never with a name or e-mail address.
What for: To invoice, to file our VAT return and to keep the records the law asks for. Legal basis: the contract with the organisation (Article 6(1)(b) GDPR) and the legal obligation to keep and retain records (point c).
Who sees it: PartyPPL's administrators, after logging in with a second factor. Of an organisation only the members with the role Owner or Finance, and only their own invoices. A VAT number goes to VIES, the service of the European Commission, for the check. Logging in on pay.partyppl.nl goes through your account on partyppl.nl and gives a session of its own of at most 12 hours, which expires after an hour without use and ends when you log out on partyppl.nl. Booking money, making an invoice final or downloading an export asks for your second factor again, and is in our log.
How long: Invoices, credit notes, the bookkeeping and the data on an invoice: seven full calendar years after the end of the financial year, because of the tax retention obligation (Article 52 of the Dutch General State Taxes Act). We do not erase those earlier on request either (Article 17(3)(b) GDPR). The e-mail address for invoices and a contact person who is not on an invoice: as long as we do business, and two years after.

9How long we keep it

Everything we keep has a period. A task that runs every day deletes whatever is past its period. If you ask us to erase something sooner, we do that for whatever is not needed for our records or an open case.

Account and profile: As long as your account exists. What happens on deletion is further down.
Date of birth: As long as your account exists. Erased on deletion.
Login code: 10 minutes.
Sessions: At most 30 days, and expired after 14 days without use. Logging out or revoking erases the session at once; expired sessions are deleted every day.
Passkeys, TOTP secret and recovery codes: Until you remove them yourself or delete your account.
Security log: 12 months.
Vulnerability reports through the form on security.partyppl.nl: 24 months after the report.
A night's group chat: Twelve months after the night, when we delete the whole chat. If you delete your account before then, your messages stay until then in the name of "Verwijderd".
Direct messages: Each message 12 months after it was sent; the conversation itself goes a year after its last message. Only you and the other person read along. If you delete your account before then, your messages stay with the other person in the name of "Verwijderd".
Forum and reviews: As long as the topic or the page exists. If you delete your account, they stay in the name of "Verwijderd".
Photos: Until you remove them or we remove them after a report; they are then no longer shown. If you delete your account, we erase your photos and files from storage.
Social data: As long as your account exists.
In-app notifications: 12 months.
Push addresses: Until you turn notifications off, the push service rejects the address, or you delete your account.
Live Activity: Two days after it starts.
Widget token: 30 days, and never longer than the session it came from.
Apple Wallet: Until you remove the pass from Wallet or delete your account.
Apple TV: Until you unpair or delete your account.
Spotify link: The key at most 15 minutes.
Discord link: Until you unlink (in Settings or with /ontkoppel in Discord) or delete your account.
Connected apps: Until you disconnect or delete your account; for a disconnected app we keep that it was revoked, until you delete your account. Access keys an hour, refresh keys 30 days.
Invitations: Your invite link as long as your account exists. The counts of how often it was opened and led to a signup: 400 days.
Affiliate programme: Clicks per day and signups through a link: 25 months. Monthly statements and credit movements: seven years, for the tax retention obligation. If you delete your account, your account comes off the signup and unused credit lapses; your own affiliate link closes and your application is emptied.
Orders, tickets, payouts and Pre-Buy: Seven years, because of the tax retention obligation. Deleted after that.
Invoices and bookkeeping: Seven full calendar years after the end of the financial year, because of the tax retention obligation. The e-mail address for invoices outside an invoice: as long as we do business, and two years after.
Tickets from another shop: The e-mail address until you have been mailed or the ticket is linked. The rest 13 months after the night.
Door scans: 12 months after the night.
My timetable: The starred sets and your choice for a nudge: 30 days after the night.
Reports and moderation decisions: 24 months after the decision.
Questions to support: Your question, our answers and the attachments: 24 months after the question was closed. A solved question without a reply closes after seven days. If you delete your account, the messages and attachments go at once. A mail to support@ also sits in support's mailbox, and mail to our other addresses in that mailbox; there is no fixed period for those yet (see 'What we do not have yet').
Applications: With the CV: 4 weeks after the vacancy closes or we decide on an open application, without a decision half a year after receipt; a year if you tick that box.
An organisation's Chamber of Commerce extract: As long as the organisation has an account; sooner on request.
AI log: 6 months. Holds no visitor data.
Bounces and complaints: 24 months after the last report. On request we take your address off the list sooner; if it bounces again after that, it is back on it.
Marketing mail: That it is on, with the moment and the place: until you turn it off (then we erase the moment and the place) or delete your account. Which marketing mail we sent you when: 24 months after it was sent; if you delete your account, at once.
Mail from our team: A copy of a mail someone at PartyPPL sent you personally (sender, recipients, subject, the text, time): 24 months after it was sent. We do not keep the attachments.
Log of our tasks: 90 days. Which task ran when and what it did; no visitor data.
Organisers' API usage: Per key, per day and per part of the API how many requests: 13 months.
Statistics: The daily list of shortened hashes expires after 48 hours. Counts per page of a night, artist or venue are deleted after 100 days, search lines that found nothing and the counts of addresses that do not exist after 90 days, the number of searches per day, the counts per source a visit came from and the daily figures for our team after 400 days, the other daily counts after 25 months. Every day, automatically. The Umami counts, from 12 to 16 October 2026, are deleted at the latest 25 months after they were collected.
Insights for organisers: Counts per night and per organisation, without names or ids: sales per day and the audience as a group. Computed again every night; what is no longer computed we delete 25 months after the last time.
Server log: The web server's access log for at most 7 days: a new file starts every day, and a file older than 7 days is erased. With exceptionally heavy traffic it goes sooner, because no more than a fixed amount is ever kept. The system log with our own lines is cleared by size. We do not copy the lines into our database.
Backups: A copy of the database and of the mailboxes on our mail server every six hours, on the same server, and every day a copy of the stored files, such as photos. Every copy is deleted after 8 days. On top of that, OVHcloud makes a daily backup of the whole server, which OVHcloud keeps for at most 7 days. Since 16 October 2026 the database also goes continuously to our second server (see below), together with the stored files; older versions of the database stay there for at most 3 days, and an erased file is erased there within a quarter of an hour too. The six-hourly copies go to that server as well and are deleted there after 8 days. What we erase can therefore remain in a backup for at most 8 days.

10Recipients and processors

For OVHcloud, Cloudflare, Stripe, Resend and Anthropic the processor terms in their standard agreement apply. We do not have a separately signed data processing agreement. The full list, with per party the purpose, the data, the location and the safeguard, is on Subprocessors.

OVHcloud (France, server in Germany): Our server: hosting, database, file storage, the realtime chat, the backups, the server log and our own mail server with webmail, where mail to addresses on partyppl.nl arrives. The server is in a data centre in Germany.
OVHcloud (OVH Hosting, server in Canada): Our second server, in the Montreal/Beauharnois region. Since 16 October 2026 it keeps a continuous copy of our database and the stored files. That copy is there for when our server in Germany fails: the site can then carry on from here, through Cloudflare as always. From that copy it also makes smaller versions of pictures and draws the share cards of the site. It also holds a closed archive of the counts Umami made from 12 to 16 October 2026. The traffic between the two servers is encrypted. We run both servers; OVHcloud only hosts them. See the article on transfers.
Cloudflare (US, with data centres worldwide): DNS, CDN and attack protection. All traffic between you and our server passes through Cloudflare: it decrypts the traffic in its data centre and sends it on encrypted again, and keeps public files such as images and scripts in its cache for a while. Mail to addresses on partyppl.nl does not pass through Cloudflare: it arrives directly on our own mail server.
Stripe (Ireland, parent company in the US): Payments, refunds and payouts to organisers (and, once that is switched on, to affiliates) through Stripe Connect. Stripe is itself responsible for your payment data. If you pay with Apple Pay or Google Pay in the order screen, Stripe's script (Stripe.js) loads in your browser and Stripe sees your IP address and details of your device that it uses against fraud. If you pay at the door with your card on the organiser's iPhone (Tap to Pay), Stripe processes your card payment; the venue's address is on the payment.
Resend (US): Sends our e-mail: login codes, tickets, transfers, resale, cancellation and postponement, alerts, the digests, marketing mail if you turned it on (your e-mail address and the mail itself) and support's answers. Mail our team sends out from an address on partyppl.nl also goes through Resend. Resend tells us when a mail did not arrive or was marked as spam.
The organiser's ticket shop (with Pre-Buy): When we buy a ticket for you, that night's official shop gets the names you gave per ticket, because the shop puts them on the ticket. We are the buyer, so the shop gets our e-mail address and our payment, not yours. The shop itself is responsible for what it does with those names.
Anthropic (US): Claude, for completing public event data and, when switched on, rewriting our marketing team's weekly proposal, with counts without people. Nothing about any one visitor; see the article on AI.
Apple (Ireland and US): Push notifications to the iPhone app, Live Activities and Wallet pass updates run through Apple. Sign in with Apple and the App Store are Apple's own services. In the apps, Apple Maps (MapKit) shows the map and looks up a venue's address; Apple then sees your device's IP address and that address.
Your browser's push service: Web push notifications go through your browser's service (for example Apple, Google or Mozilla). It sees the text of the notification.
Google (Firebase Cloud Messaging), not in use yet: For the Android app, which does not exist yet. When it does, push notifications to that app run through Google's Firebase Cloud Messaging, with your device's push token and the text of the notification. Until then nothing goes there.
An app you connect yourself: If you connect an app to your account (for example Claude by Anthropic), that app receives what you request through our API or MCP server with it: the public agenda, and if you connect on behalf of an organisation, that organisation's data your rights allow. With the scan right, a scan at your own door gives it the name on the ticket and the ticket type. The provider of that app is itself responsible for what the app does with it.
Meta (Ireland and US), TikTok, YouTube (Google), X, LinkedIn, Bluesky (US), a Mastodon server, Discord (US) and a webhook: Our own account on Facebook, Instagram, Threads, TikTok, YouTube, X, LinkedIn, Bluesky and Mastodon, as far as we have connected it, a channel in the PartyPPL Discord server, and a link to a system of our own. What goes there is public data of new nights and a weekend overview (title, date, venue, city, genres, price, poster and link) and posts our team writes itself. Once a day we fetch the numbers of our own accounts, such as followers and reach, as totals, through each platform's official connection. Never data of visitors.
European Commission (VIES): Checks the VAT number of a business customer before we make an invoice, for example for featuring. Only that number goes there.
OpenFreeMap: Map tiles. The map loads them directly in your browser, so OpenFreeMap sees your IP address. No cookies.
OpenStreetMap (Nominatim): Looks up coordinates for venue addresses, from our server. No data of visitors.
Spotify (Sweden): Artist photos, links and how popular an artist is, from our server. If you link Spotify yourself, you log in at Spotify and we briefly read who you follow there. The player of a PartyPPL playlist only loads when you tap Play here; then Spotify (Spotify AB) sees your IP address and may set cookies.
Deezer, MusicBrainz, ListenBrainz, Wikipedia, Wikidata and iTunes Search: Public data about artists, fetched from our server. No data of visitors.
MET Norway, PDOK and Ticketmaster: The weather forecast for a night (MET Norway, with the venue's coordinates), addresses of venues in the Netherlands (PDOK, the Kadaster's BAG) and events and venues from Ticketmaster's Discovery API, fetched from our server. No data of visitors.
Google (YouTube Data API and Search Console) and Microsoft (Bing Webmaster Tools): From our server, once we have connected them: the most popular music videos in the Netherlands, and how partyppl.nl does in search results (queries, pages, clicks and positions, as totals). We send them no data of visitors.
YouTube (Google), SoundCloud and Mixcloud: Videos and sets only load when you tap play. The still image of a video and the cover of a set come from our own server, so YouTube, SoundCloud and Mixcloud only see you once you tap. A YouTube video then plays in our own player, in YouTube's privacy-enhanced mode (youtube-nocookie.com); for that it also loads the player script from youtube.com. From your tap on, Google sees your IP address, YouTube may use cookies and local storage, and YouTube's rules apply.
Ticket shops and resale markets: Ticketmaster, TicketSwap, Tixel and other shops get nothing from us. If you click through, their privacy policy applies. A link to Ticketmaster may carry a partner code of ours.

The organiser of an event receives what they need to let you in:

at the door: the name on the ticket, the ticket type and whether it has been scanned;
on the door list, an export for the door for when a scanner fails: the name on the ticket, the ticket type, whether it has been scanned and the buyer's e-mail address. The roles Owner, Administrator and Door can make that list. It is the only place where an organiser sees your e-mail address;
in the ticket export: per ticket only a number, the type, the price, the status and whether it has been scanned. No name, no e-mail address and no ticket code;
in overviews: counts, no names.

What an organiser sees about visitors as a group (whether they came before, which province they come from, their age group, which genres they follow, how many followers an artist has in the region) is always a group of at least ten people, and at least twenty-five in a cross table such as age by province. Numbers are rounded to fives, and when a group is too small it says 'fewer than 10'. When exactly one group drops out of an overview, we hide a second one with it, so the missing group cannot be worked out. Your home town comes from your profile and only counts when it is filled in; age comes from your date of birth. The same goes for an artist who manages their profile: they see their fans (who follows them or said they are going to one of their nights) only as numbers per home town and region, in groups of at least ten. A sensitive night counts in none of these overviews.

When a night is cancelled or postponed, we mail you at your account's e-mail address. The organiser does not get your address for that.

The organiser may use that data only to let you in and to inform you about that event; we impose that in the organiser terms. For what they do with it after that, they are responsible themselves. For their guest list, door scans and tickets from their own shop they are the controller and we are their processor; see the data processing agreement.

Other users see what you share. With a public profile everyone sees the nights you have been to ("Was bij"), and only your friends see where you are going ("I'm going"). With a private profile nobody sees where you are going or have been, your friends included; your name, username, colour, city and profile photo stay visible, to friends and in group chats, but you are not in lists like "friends going" and not in search results. Nobody but you sees "Interested". When the organiser or our team marks a night as sensitive, nobody sees that you are going or went there; the number of visitors stays visible. A friend can tag you in a photo; you get a notification and take your name off again with one tap.

Beyond that we only hand over data when the law requires it, for example on a valid order from the police or the public prosecutor, and no more than asked.

11Transfers outside the EEA

Some of the parties above are based in the US or process data there. When personal data goes to a country outside the European Economic Area without an adequate level of protection, the rule is: the EU-US Data Privacy Framework where the supplier is certified, otherwise the European Commission's standard contractual clauses. Which of the two applies per supplier we are still checking; the list is on Subprocessors.

Since 30 September 2026 our database and the stored files are on our server at OVHcloud in Germany, inside the EU. Cloudflare, which sits in front, handles the traffic in the data centre it picks itself; we have not set an EU region there.

Our second server is at OVHcloud in Canada: since 16 October 2026 the standby copy of the database and the files, from which it also makes smaller pictures and draws share cards, and the closed archive of the counts Umami made from 12 to 16 October 2026. For Canada the European Commission has adopted an adequacy decision (Decision 2002/2/EC, for commercial organisations under the Canadian PIPEDA). That decision is the safeguard for this transfer.

12Your rights

You have the right of access, rectification, erasure, restriction, objection and portability.

Access and portability: in Settings you download your data as a JSON file. That download does not yet hold everything: your choice for marketing mail and which marketing mails we sent you, when you turned on the digest, the affiliate programme, your Discord link and the apps you connected with OAuth are missing. If you want those too, mail us and we will send them.
Rectification you mostly do yourself in your profile and settings.
Erasure: in Settings under Delete account. What does and does not disappear then is in the next article.

For anything else: mail privacy@partyppl.nl. We respond within a month. If it exceptionally takes longer, we tell you within that month, with the reason. We may ask you to show that the account is yours.

Objection to processing based on legitimate interest, such as the statistics or the security log: we stop, unless there are compelling reasons to continue, and we explain those to you.

Consent for push notifications, the digest, marketing mail, your contacts or Spotify can be withdrawn at any time. What happened before stays lawful.

Exercising your rights is free.

Unhappy with how we handle your data? You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl. If you live in another EU country you can also go to the authority there. Tell us first and we will try to fix it.

13What happens when you delete your account

You confirm with your e-mail address. The deletion happens at once, you can no longer log in afterwards, and this happens:

Erased: Your profile (name, username, bio, links, city, genres, date of birth), "I'm going" and your party history, who you follow, friends, blocks, muted and left chats, your resale watchlist, in-app notifications, invitations, votes, your tags on photos by others and your membership of organisations. Also your login means: sessions, passkeys, your TOTP secret and recovery codes, and your Apple id. And what was tied to your devices: push addresses, app and Live Activity tokens, paired Apple TVs and Wallet registrations. And the apps you connected with OAuth, with their keys.
From storage: Your profile photo, banner and the photos and files you uploaded. Only a festival map or artist photo you sent in that became part of an event page or artist profile after approval stays there, without your name.
Anonymised: Chat messages and forum posts stay, so a conversation stays readable, but the author becomes "Verwijderd". Venue reviews also stand in the name of "Verwijderd". Your ratings and write-ups of nights, questions and answers, token prices and corrections stay under an empty account without a name, e-mail address or photo. Badges and checklists are deleted.
Kept, without your name: Orders, tickets, payouts and Pre-Buy orders we must keep for seven years for the tax authorities. We detach those from your name and e-mail address where we can, and they are deleted after those seven years.

The security log, reports and moderation decisions follow their own period from the article above (12 and 24 months), because we must be able to trace misuse. Door scans and tickets from another shop belong to the organiser and follow their period.

Your account remains in the database backups for at most 8 days; after that it is gone from there too.

Settle this first. If you are the last owner of an organisation, you can delete your account once you have made someone else an owner in the organiser portal, or once the organisation is closed (mail us). If a payout from resold tickets is still on its way to you, you can delete once it is paid: after that there is no address or account left to send it to.

Tickets for a night to come. After deleting you can no longer reach them. Pass them on or put them on resale first. If you delete your account anyway, we first show which tickets they are and ask whether you understand: tickets you bought from us then lapse without a refund (as the terms say: a ticket is personal, and not being able to go gives no right to money back), in Wallet and on a screenshot too, and a ticket on resale comes off it. A ticket from another shop stays valid with that shop.

Stripe. If you linked a Stripe account for resale payouts, we detach it and ask Stripe to close it. What the tax authorities need (each payout with the reference of its transfer) we keep for seven years without your name. What Stripe itself keeps about you falls under Stripe's own privacy statement.

14Cookies and local storage

PartyPPL sets nineteen cookies of its own, all needed for something you do yourself: staying logged in, your preferences, your text size, the organisation you picked in the portal, whether you opened the portal from the iPhone app, an invitation you opened (on an affiliate link only once you choose it yourself), signing in with Apple, logging in on support.partyppl.nl, pay.partyppl.nl and gaming.partyppl.nl, contacting support without an account, and for our own team logging in on admin.partyppl.nl, marketing.partyppl.nl and server.partyppl.nl. No third-party cookies, no trackers. The statistics work without a cookie.

Which they are exactly, what sits in your browser and app and for how long is on the cookie page.

15How we secure your data

The platform follows the Dutch NCSC security baseline:

everything over HTTPS, with HSTS and a strict Content Security Policy;
session tokens are only stored hashed in the database; the token itself sits in an httpOnly cookie;
passkeys and two-factor authentication for everyone; administrators must show a second factor, a passkey that asks for your fingerprint, face or PIN or a code from an authenticator app; the TOTP secret is encrypted, recovery codes hashed;
tokens for widgets, the API and Apple TV are kept only as a hash;
an origin check on every change and rate limits on logging in, uploading and messages;
uploads are checked on their real file type, and photos are stripped of their metadata;
fonts come from our own server;
administrator actions are logged in the server log.

Found a vulnerability? See Security.

16What we do about a data breach

We stop the breach: close access, replace keys, revoke sessions.
We record what happened, which data it affects, for how many people and with what consequences. Including breaches we do not have to report.
If there is a risk to your rights, we report it to the Dutch Data Protection Authority within 72 hours of discovery.
If the risk is high, we tell you directly, in plain language, with what you can do yourself.
We fix the cause and say what we changed.

Spot something that looks like a breach? Report it through Security or info@partyppl.nl.

17Children

PartyPPL is not for people under 18. At your first login we ask for your date of birth; under 18 you cannot do anything social or buy anything. If an account turns out to belong to a minor, we delete it.

How that works and what you can do as a parent is on Age and safety.

18What we do not have yet

An honest list beats a nicer story:

No Data Protection Officer.
No certification and no external audit or penetration test.
No separately signed data processing agreements. We rely on our suppliers' standard terms.
No EU region for the traffic through Cloudflare. Our database and files are in the EU; the standby copy and the Umami archive are on our second server in Canada.
No complete export: see the article on your rights.
No fixed period for organisers' guest lists and an organisation's Chamber of Commerce extract, for mail in our mailboxes and for the data of an app that registered with us (name, return addresses, IP address), and no period in days for the system log with our own lines.
No legal review of this statement.

If anything changes, it will say so here.

19Changes to this statement

We update this statement as the platform changes. The date at the top is that of the last change; at the bottom is what changed. For a substantive change we let you know in the app or by e-mail.

This statement was written in Dutch. The English version is a translation; where they differ, the Dutch text prevails.

What changed

19 October 2026: added what Stripe sees with Apple Pay and Google Pay (Stripe.js in your browser) and when paying at the door (Tap to Pay), Apple Maps in the apps, our channel in the PartyPPL Discord and the check of VAT numbers with the European Commission (VIES). New: marketing mail as a purpose of its own, only with your consent (off until you turn it on), with the data we use to pick recipients, how you turn it off and how long we keep which mail you received (24 months); the count per source a visit comes from and of addresses that do not exist, without a cookie; new channels of our own (Threads, TikTok, YouTube, X, LinkedIn) with their numbers as totals; trends and search figures from YouTube, Spotify, Google and Bing, fetched from our server; Claude for our marketing team's weekly proposal, with counts without people (the article on AI names that exception); a passkey as the second factor for administrators; the daily copy of files in the backups; gaming.partyppl.nl falls under this statement, with the cookies for logging in there and for our team on marketing.partyppl.nl and server.partyppl.nl. Corrected: which data the download still lacks.
Every retention period checked again against the code.
New: Spotify's player for a PartyPPL playlist, which only loads after your tap.
New: the Apple apps (widgets, Live Activity, Apple Wallet, Apple TV, alarms, Siri, Visual Intelligence, Apple Intelligence on your iPhone).
New: Claude by Anthropic for completing public event data, and our posts on social media.
Added: every recipient with where it is based, the automatic check of public text, and what does and does not disappear when you delete your account.
Corrected: we have not set an EU storage location; the YouTube preview image loads before you click.
New: a private profile hides where you are going and have been from everyone, friends included; with a public profile friends see your coming nights and everyone sees where you have been; nobody sees "Interested" or sensitive nights; photo tags come with a notification and "Remove me".
New: Pre-Buy. The names per ticket go to the organiser's ticket shop, only to buy the ticket in a name.
Retention periods set for everything we keep, from the security log (12 months) to orders (7 years); a daily task clears what is past its period.
Deleting your account is now complete: what the law lets us keep we detach from your name and e-mail address; the rest we erase or anonymise at once.
We strip metadata such as location and device from photos when they are uploaded.
New: Subprocessors with per party the purpose, data, location and safeguard, and the data processing agreement for organisers.
Since 30 September 2026 our database and files are on a server of our own at OVHcloud in Germany, no longer at Cloudflare. Cloudflare is still in front for DNS, CDN and security. New in the list: the web server log and the backups, with their periods.
1 October 2026: the ticket export for organisers no longer has names and e-mail addresses; the buyer's e-mail address is only on the door list.
1 October 2026: what organisers see about visitors as a group is always a group of at least ten people, rounded.
5 October 2026: we keep database backups for 8 days instead of 15; OVHcloud also makes a daily backup of the server, kept for at most 7 days.
5 October 2026: direct messages between two people. Only the two of you read along, our team neither unless one of you reports a message. Each message is deleted 12 months after it was sent.
1 October 2026: new retention periods for the group chat (12 months after the night), API usage (13 months) and insights for organisers (25 months); the daily counts go from 400 days to 25 months.
1 October 2026: a new account no longer gets a home town filled in for it; you choose one yourself, or leave it empty. If your account got Amsterdam filled in before and you do not live there, change it in your settings.
1 October 2026: "Your night". A scan of your ticket at the door proves you were there; that shows as "Was there" under your review or report of that night, and the day after you get a page only you can see. Giving respect to reviews and reports.
1 October 2026: search lines that found nothing are kept as text for 90 days, without an account; clicks to the ticket shop are counted per night. Artists who manage their profile see their fans only as groups of at least ten.
7 October 2026: we keep the web server's access log (IP address, time, page requested, browser) for at most 7 days, for security and troubleshooting, on the basis of legitimate interest. Before, it rolled over by size and went back about nine hours.
12 October 2026: we also measure visits with Umami, which we run ourselves on a statistics server of our own at OVHcloud in Canada. Without a cookie, without storing your IP address and without following you from day to day; counts go after 25 months. Canada has an adequacy decision of the European Commission. Our own statistics stay as they were.
16 October 2026: added the cookie for contacting support without an account; there are seven.
16 October 2026: the still image of a video and the cover of a set now come from our own server, no longer from YouTube, SoundCloud or Mixcloud.
16 October 2026: a continuous standby copy of the database and the files on our second server at OVHcloud in Canada, for when our server in Germany fails.
16 October 2026: Umami is switched off. The site no longer loads the script and sends nothing to it; the counts from 12 to 16 October 2026 sit in a closed archive on our second server and go at the latest 25 months after collection. That server now also makes smaller versions of pictures and the share cards of the site. Our own statistics without a cookie stay as they were.
17 October 2026: an eighth cookie, which ties logging in on support.partyppl.nl to your browser; 'sign out everywhere else' now also disconnects your connected apps and tvs.
17 October 2026: we count visits, scans and clicks per campaign (links and QR codes on posters and flyers), without an account, cookie or IP address.
17 October 2026: corrected: with "near me" your position travels, rounded to about a kilometre, in the address of the agenda; this said before that it did not go to our server.
17 October 2026: deleting your account now says beforehand what happens to your tickets for nights to come and asks whether you understand; it is not possible while you are the last owner of an organisation or a payout is still on its way to you; a Stripe account for payouts is detached and closed.
17 October 2026: new: applying to PartyPPL, for a vacancy or open, without an account. What we ask, what for, who sees it and how long we keep it: 4 weeks after the procedure, a year with your consent.
17 October 2026: YouTube videos on PartyPPL Media play in our own player, in YouTube's privacy-enhanced mode (youtube-nocookie.com). Before you tap play, still nothing loads from YouTube; after your tap, the player also loads a script from youtube.com.
17 October 2026: we work under the trade name PartyPPL, with the same Chamber of Commerce number, VAT number and address as before; the controller is the same business as before. For privacy questions there is now privacy@partyppl.nl (info@ keeps working).
17 October 2026: added what the platform already did: connected apps (OAuth and MCP), questions to support and our own mail server (mail to partyppl.nl no longer passes through Cloudflare), support's answers through Resend, the mailboxes in the backups, the ninth cookie `ppl_in_app`, what we record when you accept terms on behalf of an organisation or with an API token, and the services without visitor data (MET Norway, PDOK, Ticketmaster). Google Firebase is listed for the Android app, which does not exist yet.
17 October 2026: the digest mails, including the weekend mail on Friday, are off until you turn them on yourself; for existing members too, because a box that was already ticked is not consent. We keep when you said yes. A ticket alert now has an unsubscribe link of its own for that night only, and an unsubscribe link works for 120 days.
17 October 2026: the affiliate programme. If you sign up through an affiliate's link, we keep that with the link together with an encrypted fingerprint of your e-mail address, without an IP address or device; the affiliate sees only numbers. The link is the ordinary invitation link; the `ppl_inv` cookie is only set there when you choose the link yourself, and if you open more than one link, the last one counts. Clicks on such a link are counted per day, without a cookie.
17 October 2026: bounces and complaints. If our mail does not arrive or you mark it as spam, we put your address on a list and stop mailing it, except a login code you ask for yourself. Basis: legitimate interest; kept 24 months after the last report.
17 October 2026: invoices and bookkeeping on pay.partyppl.nl: PartyPPL's invoices to organisers with the data that has to be on them, the VAT check in VIES, who sees it (the administrators, and of an organisation only Owner and Finance), a session of its own of at most 12 hours that ends when you log out on partyppl.nl, with two cookies of its own (so eleven), and the retention of seven years after the financial year.

Questions about this text? Mail info@partyppl.nl.Tous les documents juridiques Retour en haut