Privacy policy

How your personal data is handled when you use aforena.com: who handles it, why, for how long, and your rights.

Last updated: October 17, 2026

1. Who is responsible for your data

It depends on what it's used for:

When you buy, join a guest list, book a table or become a member of a venue, the controller of that data is the organizer of that venue or event (its name is on its page and on your tickets). Aforena processes it on the organizer's behalf as a processor.
For organizers' and their teams' accounts, contacting us, platform security and usage statistics by country, the controller is Aforena:

Owner: Aforena
Email: aforenahq@gmail.com
Privacy email: aforenahq@gmail.com

2. What data we handle and why

Purchases, guest lists, tables and memberships

Where it comes from: From you when you buy or sign up, or from the venue's team (for example a promoter or the box office) when they add you or sell to you in person.
Purpose: Managing your order or booking, sending your tickets and QR code, door access control, helping you and handling refunds, and meeting accounting and tax obligations. The country you buy from is also used for Aforena's internal statistics (how many purchases come from each country).
Legal basis: Performing the contract you make with the organizer, and legal obligations; for the statistics, our legitimate interest in knowing where the platform is used from.
Data: Name, email, phone (if given), what you buy or book, amounts, the time you came in, the promoter who invited you and your booking notes. If you buy on the website, also the country you buy from, worked out from your connection at that moment (the IP address isn't kept with the order). We never see or store your card details: the payment provider receives them directly.
Who receives it: The organizer and its team (each promoter only sees the people they add); the payment provider; the hosting and email providers (Contabo GmbH (Alemania / Germany, UE / EU); Sendinblue SAS — Brevo (Francia / France, UE / EU)); and the authorities when the law requires.
How long: For as long as the relationship lasts and then blocked for the legal periods: order and billing data for 6 years (article 30 of the Spanish Commercial Code).

News and offers from the venue

Where it comes from: From you, when you tick the box to receive the venue's news.
Purpose: Emailing you news, events and offers from that venue, choosing who receives each email according to your relationship with it (events attended, tags it gave you, spend).
Legal basis: Your consent (article 6.1.a GDPR and article 21 LSSI). You can withdraw it at any time with the unsubscribe link in every email.
Data: Name, email, language and your history with the venue.
Who receives it: The organizer and the email provider (Sendinblue SAS — Brevo (Francia / France, UE / EU)).
How long: Until you unsubscribe or ask for your data to be deleted.

Organizer and team accounts

Purpose: Giving access to the back office, applying each role's permissions and recording who did each operation (for example, who sold a ticket or let someone in). We also count how many logins come from each country, without keeping who, for internal statistics. With your account we also keep the country you first logged in from and whether you chose the language yourself, so Aforena's team knows which language to help you in. If the venue uses the Wallet, its billing details are used to transfer its withdrawals and issue Aforena's invoices; for security, once saved, the company name, tax ID and IBAN are only changed by Aforena's team at the venue's request, and the change is recorded. To take payments online, the venue opens a payment account with the payment provider from the Wallet, and the provider pays its sales out to it directly.
Legal basis: Performing the contract with the organizer; for the statistics and the country of your first login, our legitimate interest in knowing where the platform is used from and in helping you in your language. To verify the venue's representative, the payment provider's legal obligation to identify its customers (anti-money-laundering rules).
Data: Name, email, password (stored encrypted) or, if you sign in with Google, the Google account data in section 4; language (and whether you chose it), role, activity on the platform, the country you log in from and that of your first login (worked out from your connection at that moment). If the venue uses the Wallet, also its billing details: name or company name, tax number, address (with the state or province in countries that ask for it), IBAN (in countries that use it) and invoice email. A tax number can only be on one Aforena venue. When opening the payment account, the venue also gives its representative's details (name, email, phone, date of birth, nationality, ID document and home address): Aforena sends them straight to the payment provider to verify their identity and doesn't keep them.
Who receives it: Aforena's team; the payment provider (Stripe Payments Europe, Ltd. (Irlanda / Ireland, UE / EU)), which gets the venue's and its representative's details needed to open and keep the payment account; and the hosting and email providers (Contabo GmbH (Alemania / Germany, UE / EU); Sendinblue SAS — Brevo (Francia / France, UE / EU)).
How long: While the account is active and then for the legal periods.

Contact, support and security

Purpose: Answering your questions (including the ones you write from Support in the back office, where we email you when we answer) and protecting the platform from abuse and fraud.
Legal basis: Your consent when you write to us or, if you write from the back office, performing the contract with the organizer; and our legitimate interest in keeping the platform secure.
Data: What you tell us; for back-office requests, also who writes each message and for which venue; and technical connection data (IP address, browser, time).
How long: As long as needed to help you; back-office requests are kept while the venue's account exists, so you can look them up; technical logs for up to 12 months.

Beta access requests

Where it comes from: From you, when you fill in the “Request access” form on our website.
Purpose: Reviewing your request, contacting you about it and, if approved, sending you your beta key.
Legal basis: Steps taken at your request before entering into a contract (article 6.1.b GDPR).
Data: Name, email, the name and type of your venue or promoter brand, city, phone (if you give it), your message, the page you came to the form from, and your IP address.
Who receives it: The Aforena team and our hosting and email providers (Contabo GmbH (Alemania / Germany, UE / EU); Sendinblue SAS — Brevo (Francia / France, UE / EU)).
How long: 12 months from your request. If you create an account, its data is then covered by the organiser accounts section.

3. Promoter links

If you reach a venue through a promoter's personal link, it is recorded that they referred you, to calculate their commission. Keeping it in your browser for 30 days needs your permission (see the cookie policy); without it, it only counts for that visit.

4. Signing in with Google

If you choose “Continue with Google” to create your account or log in to the Aforena back office, Google sends us, with your permission, this data from your Google account: your name, your email address (and whether it is verified), your profile picture and an identifier for your Google account. We do not receive your Google password and have no access to your email, contacts, files or any other data in your Google account.

Purpose: Creating your Aforena account or identifying you when you log in, showing your name and picture in the back office and writing to you about your account. Nothing else.
Legal basis: Performing the contract: giving you access to the account you ask for.
Who receives it: No one else. We do not sell it, use it for advertising or to train artificial intelligence models, or share it with third parties, except our hosting provider (Contabo GmbH (Alemania / Germany, UE / EU)), which stores it on our behalf, and the authorities when the law requires it.
How long: While you have the account. If you close it or ask us to delete it, we delete this data, except what the law requires us to keep.

You can disconnect Aforena from your Google account at any time at https://myaccount.google.com/connections and ask us to delete your data by writing to aforenahq@gmail.com.

Aforena's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5. Where your data is

Data is hosted on servers in the European Union (Contabo GmbH (Alemania / Germany, UE / EU)) and emails are sent through Sendinblue SAS — Brevo (Francia / France, UE / EU). Card payments are processed by Stripe Payments Europe, Ltd. (Irlanda / Ireland, UE / EU); if any of these providers processes data outside the EU, it does so with GDPR safeguards (such as the EU-US Data Privacy Framework or standard contractual clauses).

6. Minors

Many events have a minimum age. Children under 14 may not give us their data without their parents' or guardians' consent (article 7 of Spanish Organic Law 3/2018).

7. Security

We use encrypted connections (HTTPS), store passwords encrypted, QR codes are random secrets, back office access depends on each person's role, and we make daily backups.

8. Your rights

You can ask for access to your data, its correction or deletion, object to its processing, ask for it to be restricted or given to you in a portable format, and withdraw your consent at any time.

For a venue's data, contact its organizer; you can also write to aforenahq@gmail.com and we will pass it on. For data Aforena handles as controller, write to that same address. We will answer within one month.

If you think your rights have not been respected, you can complain to the Spanish Data Protection Agency: https://www.aepd.es

9. Changes

If we change this policy, we will publish the new version here with its date.