Privacy Policy

This Policy explains how Held processes the personal data of guests who book tables or buy tickets through the platform, and of the people who run venue and organiser accounts, in line with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Croatian Act on the Implementation of the GDPR.

1. Who processes your data

TEHNO GRUPA d.o.o., OIB 26368307048, registered at Diračje 107/A, 51000 Rijeka, operates the Held platform and is the controller for the processing described in this Policy. Contact for any privacy question: [email protected].

The venue you book with (bar, club, festival, organiser) receives your data to welcome you and fulfil the reservation. For its own processing (e.g. the door list, its own records) the venue is an independent controller and responsible for it under its own privacy policy.

2. What data we process

• Contact details: name, email address, phone number.
• Reservation details: venue, date and seating, table, number of guests, any note you add, reference number, status (confirmed, cancelled, arrived).
• Ticket and entry details: ticket type, the name on the ticket, the QR code, and the time and device on which it was scanned at the entrance.
• Payment details: amount, time and the transaction identifier Stripe gives us. We never receive or store card details.
• Company invoice details (R1, optional): company OIB, name and address.
• Receipt details: receipt number and fiscal codes (JIR, ZKI).
• Technical data: IP address and browser data in server security logs; for visit statistics only a daily-rotated hash, without storing the IP address.

We do not ask for special categories of data (e.g. health) — please don’t put them in the note.

Door scanner: so entry works without signal, the event’s ticket list (name on the ticket, type, status) is stored temporarily on the venue staff’s device and is deleted automatically three days after its last refresh. Staff see only their own event’s tickets.

Venue and organiser accounts: for the people who open and run a venue account we process name, email address, hashed password, sign-in times, company details (name, OIB, address) and the record of accepting the Venue Terms (version, time, IP address and browser) — to perform the contract (Art. 6(1)(b)) and to prove it was concluded (Art. 6(1)(f)). We keep the acceptance record for the term of the contract and 5 years after it.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): taking and confirming the reservation, payment, sending the confirmation, reminders and notices of changes or cancellation, passing the reservation to the venue, handling cancellations and refunds.
• Legal obligation (Art. 6(1)(c)): issuing and fiscalising receipts, keeping accounting records, responding to authorities.
• Legitimate interest (Art. 6(1)(f)): system security and preventing abuse and fraud, handling complaints and disputes, anonymous statistics on visits to the platform.
• Consent (Art. 6(1)(a)): the visit identifier in your browser and Google Maps (see section 7). You can withdraw consent at any time.

We do not send you promotional messages or use your data for advertising. We do not make automated decisions or profile you within the meaning of Art. 22 GDPR.

4. Who receives your data

We do not sell your data. It is shared only with:

• The venue you booked with — name, contact details, number of guests, note and reservation details, to fulfil the reservation.
• Stripe Payments Europe, Limited (Ireland) — payment processing and payouts to the venue. Stripe may transfer data to Stripe, Inc. in the US under the adequacy decision (EU-US Data Privacy Framework) and standard contractual clauses. More: stripe.com/privacy.
• Hetzner Online GmbH (Germany) — server and database hosting in the EU.
• Infobip d.o.o. (Croatia) — sending email (confirmations, reminders, receipts).
• Croatian Tax Administration and FINA — receipt fiscalisation and e-invoices, as required by law.
• Our accountants — bookkeeping, under a duty of confidentiality.
• Google Ireland Limited — only if you consent to showing Google Maps (section 7).
• Competent authorities — where the law requires it.

Providers that process data on our behalf are bound by data processing agreements (Art. 28 GDPR).

5. How long we keep data

• Reservation and contact details: 3 years from the event date (the period for complaints and claims), after which they are automatically anonymised.
• Receipts and accounting records: 11 years, as required by Croatian accounting and tax law.
• Server security logs: up to 90 days.
• Visit identifier: deleted when you close the browser tab.

6. Your rights

You have the right to access your data, rectification, erasure, restriction, portability and to object to processing based on legitimate interest (Arts. 15–21 GDPR), and to withdraw consent without affecting earlier processing. Erasure is not possible for data we must keep by law (e.g. receipts).

Send requests to [email protected]. We reply within one month; for complex requests this may be extended by two further months, and we will tell you if so. To protect your data we may ask you to confirm your identity (e.g. by replying from the email used for the booking). Requests about processing at the venue are forwarded to the venue.

7. Cookies and browser storage

Without consent we only use what is strictly necessary for the site to work (Art. 5(3) of the ePrivacy Directive 2002/58/EC and Croatian e-communications law): the sign-in and selected-event cookies for venue staff, your chosen site language, and a record of your cookie choice.

Only with your consent:

• Visit counting — a random visit identifier in browser storage (sessionStorage), deleted when you close the tab. It contains no personal data and is not shared with third parties. Without consent the visit is counted with nothing stored in your browser.
• Google Maps — the location map on event pages loads from Google (Google Ireland Ltd.), which sets its own cookies. Without consent the map is not loaded; we offer a link to Google Maps instead.

You can give or withdraw consent at any time via “Cookie settings” in the page footer. We do not use advertising cookies or cookies that track you across other websites.

8. Security

Data is only transmitted encrypted (HTTPS) and stored on servers in the EU. Access is limited: venue staff see only their own venue’s reservations, and the admin area requires sign-in. We will notify AZOP of a personal data breach within 72 hours, and you without delay where the breach is likely to result in a high risk to your rights (Arts. 33 and 34 GDPR).

9. Minors

The platform is intended for adults. We do not knowingly collect data from anyone under 18; if we learn that this has happened, we will delete the data.

10. Complaints to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We recommend contacting us first so we can try to resolve it directly.

11. Changes

We may update this Policy; the date of the last change is shown at the top of the page. We will announce material changes on the website. See also the Terms of Service.