Data controller
[Club legal name], [address]. Contact: [email address].
Data we collect
Account: email address and, when signing in with Google or Facebook, the name provided by that service. Passwords are encrypted by our authentication provider; the club cannot see them.
Orders: items, quantities, seat number, amounts and dates. Bar staff see the order number, seat and items, but not your name or email address.
Payment: processed by Stripe, which receives your email address for the receipt. The club never receives card numbers.
Emails: your email address is used to confirm your account, reset your password and send your order confirmations. The site sends no newsletters or marketing emails.
Preferences: display language.
Technical data: as with any website, our hosting providers record the IP address, date and requested page in technical logs, and our authentication provider keeps a sign-in log (date, action, email address), for security and to keep the service running. To block abuse (sign-in, sign-up, forgotten password), the server also counts attempts per email address and per IP address, in memory only.
Purposes and legal bases
Managing accounts, orders and payments: performance of the contract.
Keeping accounting records: legal obligation.
Service security (abuse prevention): legitimate interest.
Recipients and processors
Your data is never sold or used for advertising. It is processed on the club's behalf by:
- Supabase (authentication, database and images), data hosted in the European Union (Ireland);
- Railway (website and server hosting), servers in the European Union (Netherlands);
- Resend (sending emails), from the European Union (Ireland);
- Google or Facebook, if you choose to sign in with them.
Payment is processed by Stripe Payments Europe, Limited (Ireland), which also processes some data on its own behalf (fraud prevention, legal obligations) under its own privacy policy.
Transfers outside the European Union
These providers are American companies or belong to American groups: even when data is hosted in the European Union, it may be accessed from the United States (support, maintenance). These transfers are covered by the European Commission's standard contractual clauses and, for certified companies, by the EU–US Data Privacy Framework.
Retention
Account: until it is deleted.
Orders: [period to confirm, e.g. 10 years for accounting records]; they are no longer linked to you once your account is deleted.
Technical logs: 7 days at most. Anti-abuse counters: one hour at most, in memory, never stored.
Cookies
The site only uses strictly necessary cookies, which need no consent: the session cookie, which keeps you signed in (page scripts cannot read it), and the language cookie, which remembers your language.
Your cart is stored on your device (the browser's local storage) until you order.
No advertising or analytics trackers are used, and no scripts or fonts are loaded from third-party sites. The payment page is Stripe's, on its own site, where Stripe's cookie policy applies.
Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection. You can delete your account at any time from “My account”, or write to [email address].
You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).