Privacy and Data Protection Policy (GDPR)

01. Identity of the Data Controller

The Data Controller of your personal data (within the meaning of Article 4(7) of Regulation (EU) 2016/679 — GDPR) is [CONFIGURARE NECESARĂ: DENUMIRE SOCIETATE S.R.L.], with its registered office at [CONFIGURARE NECESARĂ: SEDIU SOCIAL, BUCUREȘTI, ROMÂNIA], registered with the Trade Registry under no. [CONFIGURARE NECESARĂ: J40/.../2026], Fiscal Code (CUI) [CONFIGURARE NECESARĂ: CUI / CIF RO...].

For any questions, requests to exercise your GDPR rights, or privacy inquiries, you may contact our privacy team directly at: privacy@pastfiveclub.com (or by post at our registered office address, marked "Attn: GDPR Privacy").

02. Categories of Personal Data Collected (Data Minimization)

We enforce strict data minimization (Article 5(1)(c) GDPR): we do not require account registration or passwords to purchase a ticket, and we do not collect national identification numbers (CNP). Depending on your interaction with the platform, we collect only the following data categories:

• Event Bookings & Ticket Purchases (Orders): full name, email address, phone number (for urgent event updates), seat quantity, optional atelier notes (e.g., dietary sensitivities), billing details (for B2B corporate invoices: company name, CUI, Trade Registry no., address), and technical Stripe transaction identifiers (Session ID / PaymentIntent ID — never full card numbers).
• Digital Tickets, Transfers & Door Check-In (Tickets): ticket holder name and email, unique ticket code, HMAC-SHA256 cryptographic signature, check-in status and timestamp (checkedInAt), and, if a nominal transfer occurs, the recipient’s name and email.
• Waitlist Registrations (Waitlist): name, email address, optional phone number, target event edition, and requested seat count.
• Editorial Journal / Newsletter (Newsletter Subscribers): email address, optional first name, preferred language (RO/EN), consent timestamp, and an irreversible SHA-256 hash of the IP address strictly as audit proof of consent (Art. 7(1) GDPR).
• Private Event & Collaboration Inquiries: name, email address, organization (optional), and message content.
• Technical Security & Cookie Data: language preference, cookie consent state, and a transient hashed IP identifier used strictly for anti-abuse rate limiting.

03. Purposes of Processing and Legal Bases (Article 6(1) GDPR)

Every data processing activity within PASTFIVE CLUB relies on a specific, documented legal basis under Article 6(1) of the GDPR:

• Performance of a contract or pre-contractual steps — Art. 6(1)(b) GDPR: processing your booking, issuing and emailing QR digital tickets and Apple/Google Wallet passes, sending the transactional 24-hour event reminder email, executing guest-requested nominal ticket transfers, and notifying Waitlist registrants when a seat opens.
• Compliance with a legal obligation — Art. 6(1)(c) GDPR: issuing, recording, and archiving financial, accounting, and tax documents (including statutory reporting to the Romanian RO e-Factura system), pursuant to Romanian Accounting Law no. 82/1991, Fiscal Code Law no. 227/2015, and Order (OMFP) no. 2634/2015.
• Explicit consent of the data subject — Art. 6(1)(a) GDPR: sending our editorial journal and future edition invitations (Newsletter), as well as enabling optional analytics cookies. During checkout, the newsletter opt-in checkbox is always unticked by default and is never bundled with ticket purchase (Art. 7(4) GDPR).
• Legitimate interests of the Controller — Art. 6(1)(f) GDPR: safeguarding application security, preventing automated abuse via rate limiting, and performing cryptographic anti-fraud ticket verification at the door.

04. Data Retention and Storage Periods

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or as mandated by Romanian fiscal legislation:

• Financial, accounting, and paid order records (Orders & Invoices): 10 years (or 5 years for applicable simplified supporting schedules pursuant to Romanian Accounting Law no. 82/1991 and OMFP no. 2634/2015), calculated from the end of the financial year in which they were issued.
• Operational check-in and ticket records (Tickets): QR access tokens expire upon completion of the event edition. Operational attendance lists are kept for 90 days post-event (to handle any refund or dispute inquiries), after which non-fiscal operational details are anonymized.
• Waitlist Entries: Up to 60 days after the conclusion of the target event edition, after which entries are purged.
• Newsletter Subscribers: Until consent is withdrawn (via the one-click unsubscribe link in every email footer or by writing to privacy@pastfiveclub.com). Unconfirmed double opt-in requests are purged after 14 days.
• Technical Security & Rate-Limiting Logs: Rate-limiting counters are ephemeral (1–60 minutes in memory), and server security logs are retained for a maximum of 30 days.

05. Data Recipients, Processors (Subprocessors), and International Transfers

PASTFIVE CLUB never sells or rents your personal data to third parties. To operate the platform, we work strictly with vetted infrastructure providers (Data Processors under Article 28 GDPR) bound by Data Processing Agreements:

• Stripe Payments Europe, Limited (Dublin, Ireland — EEA): secure card, Apple Pay, and Google Pay payment processing. Where global Stripe Inc. infrastructure is involved, transfers are safeguarded by the EU-US Data Privacy Framework (DPF) and European Commission Standard Contractual Clauses (SCCs).
• Vercel Inc. (Web application and serverless compute hosting, configured for EU region — Frankfurt, Germany): application delivery and edge protection under Vercel’s Data Processing Addendum (DPA), EU-US Data Privacy Framework, and SCCs.
• Managed PostgreSQL Database Provider (Neon / Supabase / Vercel Postgres — EU Region Frankfurt eu-central-1): encrypted storage (at rest and in transit via TLS 1.3) for orders and tickets.
• Resend (Transactional Email Delivery): delivery of digital tickets, booking confirmations, and event reminders, governed by Standard Contractual Clauses (SCCs).
• Apple Inc. / Google LLC (Strictly user-initiated): only when the ticket holder voluntarily clicks "Add to Apple Wallet" or "Save to Google Wallet" on the ticket page.
• Romanian Public & Fiscal Authorities (ANAF / RO e-Factura): strictly to the extent mandated by Romanian tax law.

06. Your Rights under GDPR and Right to Lodge a Complaint with ANSPDCP

Under Articles 15–22 of Regulation (EU) 2016/679, you hold the following rights, which you may exercise free of charge at any time by writing to privacy@pastfiveclub.com (response timeframe: maximum 30 calendar days):

• Right of access (Art. 15 GDPR): obtain confirmation of whether your data is processed and receive an electronic copy of your personal data.
• Right to rectification (Art. 16 GDPR): correct inaccurate data or complete incomplete details (e.g., correcting a ticket holder name or email).
• Right to erasure / "Right to be forgotten" (Art. 17 GDPR): request deletion of waitlist entries, newsletter subscriptions, or operational records. Note: under Art. 17(3)(b) GDPR, erasure cannot override mandatory 10-year retention of fiscal invoices and accounting records under Romanian tax law.
• Right to restriction of processing (Art. 18 GDPR) and Right to data portability (Art. 20 GDPR) in a structured, machine-readable format (JSON/CSV).
• Right to object (Art. 21 GDPR) and Right to withdraw consent at any time (Art. 7(3) GDPR), without affecting the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint with the Supervisory Authority (Art. 77 GDPR): You have the right to file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, cod poștal 010336, București, România, website: https://www.dataprotection.ro/, email: anspdcp@dataprotection.ro.