Privacy and compliance
Your data, under the GDPR
Short and clear. The full story is in the privacy statement.
Who is responsible
For your account, your tickets, the chat and the rest of the platform PartyPPL is the controller. PartyPPL is the trade name of the business registered with the Netherlands Chamber of Commerce under number 97359866.
For a few things we do for organisers, such as guest lists, door scans and exports, the organiser is responsible and we are the processor. Our data processing agreement covers that.
Your rights
- Access and portability: in Settings you download your data as a JSON file. That download is not complete yet; what is missing is in the privacy statement, and we send it on request.
- Erasure: in Settings with Delete account. What does and does not disappear is in the privacy statement.
- Correction you mostly do yourself in your profile.
- For everything else, objection and restriction included: mail privacy@partyppl.nl. We answer within a month, and it is free.
- Not satisfied? You can file a complaint with the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.
Who processes data for us
The main parties. The full list, with the safeguard for transfers outside the EEA, is on Subprocessors.
| Party | Country | What for |
|---|---|---|
| OVHcloud | Germany | Our server: database, files, chat, backups, logs and our own mail server; when it is busy an extra server with a copy that only reads |
| OVHcloud | Canada | The standby server: a continuous copy, the encrypted backups, resizing pictures |
| Cloudflare | United States | DNS, proxy and CDN: all web traffic passes through it |
| Stripe | Ireland | Payments and payouts |
| Resend | United States | Sending our mail, such as login codes and tickets |
| Apple | Ireland and United States | Push notifications to the app and updates of Wallet passes |
| Anthropic | United States | Only public data about events, artists and organisers, for the agenda |
For Canada an adequacy decision of the European Commission applies. For the United States the EU-US Data Privacy Framework where the supplier is certified, otherwise standard contractual clauses.
How long we keep it
- Your account
- Until you delete it
- Orders, tickets and payouts
- 7 years, for the tax office, without your name where possible
- Security log
- 12 months
- Audit log of our team
- 24 months
- Access logs of the web server
- 7 days
- Backups
- At most 8 days, then gone there too
Every period is in the privacy statement.
Cookies
We only set our own cookies, needed for something you do yourself, such as staying logged in. No third-party cookies, no trackers. Which ones they are is on the cookie page.
Our suppliers and their certifications
Part of the security lies with the parties we build on. Their certifications are theirs, not PartyPPL's: PartyPPL itself holds no certification. We only name what the supplier publishes itself, for the product we use.
OVHcloud
Our servers run at OVHcloud: VPS machines in Germany and Canada, and when it is busy a Public Cloud server in Germany.
- ISO/IEC 27001
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701 (Public Cloud)
OVHcloud is certified for ISO/IEC 27001, 27017 and 27018. The VPS and Public Cloud Compute are in the list of certified services, and according to OVHcloud the certification covers all its datacentres outside the United States. For ISO/IEC 27701 Public Cloud Compute (our server 3) is in the list, the VPS is not. OVHcloud also has SOC 1 and SOC 2 Type 2 reports; which services they cover, the page does not say.
www.ovhcloud.comCloudflare
DNS, proxy and CDN for all our addresses.
- ISO/IEC 27001
- SOC 2 Type II
- PCI DSS Level 1
Cloudflare is certified for ISO/IEC 27001 (27018 and 27701 too), has a SOC 2 Type II report and meets PCI DSS Level 1 as a service provider for part of its products, its CDN and DNS among them.
www.cloudflare.comStripe
Payments and payouts.
- PCI DSS Level 1
- SOC 1
- SOC 2 Type II
Stripe is certified as a PCI DSS Service Provider Level 1 and has SOC 1 and SOC 2 Type II reports.
docs.stripe.comResend
Sending our mail.
- SOC 2 Type II
Resend has a SOC 2 Type II report.
resend.comApple
Push notifications to the app.
- ISO/IEC 27001
- ISO/IEC 27018
Apple's push service (APNs) falls under Apple's certification for ISO/IEC 27001 and 27018. Apple Wallet and Sign in with Apple are not on that list, so we do not name them here.
support.apple.comAnthropic
Only public agenda data, through the API.
- ISO/IEC 27001
- ISO/IEC 42001
- SOC 2 Type II
Anthropic is certified for ISO/IEC 27001 and ISO/IEC 42001 for its commercial products, the API among them, and has a SOC 2 Type II report.
support.claude.com
Checked on the suppliers' own pages on 18 October 2026. A supplier's certification says something about how that supplier works, not about our own code. For our own measures, see the overview.