Draft document pending legal review.
Controller
[COMPANY NAME], [ADDRESS], contact: ticketwelcome@proton.me. Data Protection Officer: [IF APPLICABLE].
Data we process
- Order contact data: first name, last name, email (no customer account is created).
- Order data: tickets purchased, amounts, delivery details.
- Payment data: processed by Stripe; we receive only the payment status and the last digits of the card.
- Support requests.
- Analytics data, only if you consent.
Purposes and legal bases
- Performing your order (contract).
- Fraud prevention and security (legitimate interest).
- Accounting and tax obligations (legal obligation).
- Newsletter and analytics (consent, withdrawable at any time).
Processors
Stripe (payments), Resend (email), [HOSTING PROVIDER] (hosting), [STORAGE PROVIDER] (file storage), Google Analytics (only with consent), Sentry (error monitoring).
Retention
Order and accounting data: [10 years]. Order contact data: as long as needed for the order and its after-sales, then [3 years]. Analytics: [14 months].
Your rights
Access, rectification, erasure, restriction, portability, objection, and complaint to your supervisory authority (in France: CNIL). Contact ticketwelcome@proton.me.
International transfers
[DESCRIBE TRANSFERS AND SAFEGUARDS, e.g. EU–US Data Privacy Framework / standard contractual clauses].