Privacy
Under the GDPR (EU 2016/679) and the LOPDGDD (LO 3/2018). Last updated: 26 October 2026.
1. Who is responsible
For a ticket purchase, the controller is the Seller of that night, named on the event page, at checkout and on the ticket. The website, the ticketing system and the customer list are run jointly by the two people below as joint controllers (art. 26 GDPR). They have agreed that requests about your data go to one contact point, and you can exercise your rights with either of them.
- Tommaso Ruzzi, self-employed (trabajador autónomo), NIE Z5570951B, Avenida del Acueducto 20, 2.º D, 40002 Segovia, Castilla y León, Spain
- Francesco Maza, self-employed (trabajador autónomo), NIE Z4437110R, Plaza Colmenares 7, 40001 Segovia, Castilla y León, Spain
- Contact point: elendusk88 [at] gmail [dot] com
The same two people, as joint controllers, handle the applications sent through the Join us page.
No Data Protection Officer is appointed: it is not required at this scale.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, phone (optional) | Selling and sending your ticket, entry at the door | Contract, art. 6(1)(b) |
| Payment data (handled by Stripe; card details never reach us) | Payment, fraud prevention, chargebacks | Contract; legitimate interest in preventing fraud, art. 6(1)(f) |
| Orders and tickets (QR token, time of entry) | Entry control, accounting and tax | Contract; legal obligation, art. 6(1)(c) |
| Guest list: name, email, the promoter link you signed up through, QR token, time of entry | Putting you on a night’s list, sending your QR code, entry at the door | Contract, art. 6(1)(b): you ask to be on the list. The promoter sees how many people signed up through their link and came in, never who. |
| Emails about similar nights | Occasional news to people who bought a ticket | Legitimate interest (Recital 47) under LSSI art. 21.2. Object at checkout, through the link in every email, or at elendusk88 [at] gmail [dot] com. |
| Ambassador code on your order (the link you bought through) | Paying the ambassador’s commission | Legitimate interest. The code identifies the ambassador, not you. Ambassadors see a first name and an initial, never your email or phone. If stored in a cookie, only with your consent (see cookies). |
| If you are a promoter: name, email, phone, Instagram, university and year, IBAN or Bizum number, the terms you accepted, your sales and payments, login codes | Running your promoter account, paying your commission, keeping the payment records | Contract, art. 6(1)(b); legal obligation for the payment records, art. 6(1)(c). Payment details only with your consent at the moment you give them, and only to pay you. |
| If you apply to join the team: the roles you chose, name, email, phone (optional), Instagram, university and year, city, a link to your work, your message, and when you confirmed you are 18 or over | Reading your application, contacting you about it and choosing who joins the team | Steps you asked for before a possible collaboration, art. 6(1)(b). Never used for marketing. |
| Aggregate page views and speed (Vercel, cookieless) | Knowing which pages are used and how fast they load | Legitimate interest; no cookies or device identifiers |
3. Processors
Stripe (payments), Vercel (hosting), Supabase (database), Resend (email), Airtable (customer list) and Sentry (error monitoring), under art. 28 GDPR agreements. We do not sell personal data.
4. Transfers outside the EU
Where a provider processes data in the United States we rely on the EU-U.S. Data Privacy Framework or the 2021 Standard Contractual Clauses.
5. How long we keep it
- Orders and tickets: up to 6 years (tax and accounting).
- Guest list sign-ups: up to 12 months after the night.
- Support emails: 24 months.
- Marketing preferences: until you change them.
- Promoter accounts: while the account is open. Payment records: up to 6 years (tax). Login codes: valid 10 minutes, stored only as a keyed hash, deleted the next time you ask for one or when the account is closed.
- Applications to join the team: deleted 6 months after the last change if they did not lead to working together (not answered, or not accepted). If you join, kept while you work with us.
- Technical logs: up to 12 months.
6. Your rights
Access, rectification, erasure, restriction, portability and objection, and withdrawing consent: write to elendusk88 [at] gmail [dot] com with proof of identity. We answer within one month. You can complain to the AEPD (www.aepd.es).
7. Under 18s
Nocturna is for people aged 18 or over. Tickets held by under 18s are cancelled and entry is refused.