AforenaPrivacy policy
How your personal data is handled when you use aforena.com: who handles it, why, for how long, and your rights.
Last updated: October 16, 2026
1. Who is responsible for your data
It depends on what it's used for:
- When you buy, join a guest list, book a table or become a member of a venue, the controller of that data is the organizer of that venue or event (its name is on its page and on your tickets). Aforena processes it on the organizer's behalf as a processor.
- For organizers' and their teams' accounts, contacting us and platform security, the controller is Aforena:
- Owner
- Aforena
- aforenahq@gmail.com
- Privacy email
- aforenahq@gmail.com
2. What data we handle and why
Purchases, guest lists, tables and memberships
- Where it comes from
- From you when you buy or sign up, or from the venue's team (for example a promoter or the box office) when they add you or sell to you in person.
- Purpose
- Managing your order or booking, sending your tickets and QR code, door access control, helping you and handling refunds, and meeting accounting and tax obligations.
- Legal basis
- Performing the contract you make with the organizer, and legal obligations.
- Data
- Name, email, phone (if given), what you buy or book, amounts, the time you came in, the promoter who invited you and your booking notes. We never see or store your card details: the payment provider receives them directly.
- Who receives it
- The organizer and its team (each promoter only sees the people they add); the payment provider; the hosting and email providers (Contabo GmbH (Alemania / Germany, UE / EU); Sendinblue SAS — Brevo (Francia / France, UE / EU)); and the authorities when the law requires.
- How long
- For as long as the relationship lasts and then blocked for the legal periods: order and billing data for 6 years (article 30 of the Spanish Commercial Code).
News and offers from the venue
- Where it comes from
- From you, when you tick the box to receive the venue's news.
- Purpose
- Emailing you news, events and offers from that venue, choosing who receives each email according to your relationship with it (events attended, tags it gave you, spend).
- Legal basis
- Your consent (article 6.1.a GDPR and article 21 LSSI). You can withdraw it at any time with the unsubscribe link in every email.
- Data
- Name, email, language and your history with the venue.
- Who receives it
- The organizer and the email provider (Sendinblue SAS — Brevo (Francia / France, UE / EU)).
- How long
- Until you unsubscribe or ask for your data to be deleted.
Organizer and team accounts
- Purpose
- Giving access to the back office, applying each role's permissions and recording who did each operation (for example, who sold a ticket or let someone in).
- Legal basis
- Performing the contract with the organizer.
- Data
- Name, email, password (stored encrypted) or, if you sign in with Google, the Google account data in section 4; language, role and activity on the platform.
- How long
- While the account is active and then for the legal periods.
Contact, support and security
- Purpose
- Answering your questions and protecting the platform from abuse and fraud.
- Legal basis
- Your consent when you write to us and our legitimate interest in keeping the platform secure.
- Data
- What you tell us and technical connection data (IP address, browser, time).
- How long
- As long as needed to help you; technical logs for up to 12 months.
3. Promoter links
If you reach a venue through a promoter's personal link, it is recorded that they referred you, to calculate their commission. Keeping it in your browser for 30 days needs your permission (see the cookie policy); without it, it only counts for that visit.
4. Signing in with Google
If you choose “Continue with Google” to create your account or log in to the Aforena back office, Google sends us, with your permission, this data from your Google account: your name, your email address (and whether it is verified), your profile picture and an identifier for your Google account. We do not receive your Google password and have no access to your email, contacts, files or any other data in your Google account.
- Purpose
- Creating your Aforena account or identifying you when you log in, showing your name and picture in the back office and writing to you about your account. Nothing else.
- Legal basis
- Performing the contract: giving you access to the account you ask for.
- Who receives it
- No one else. We do not sell it, use it for advertising or to train artificial intelligence models, or share it with third parties, except our hosting provider (Contabo GmbH (Alemania / Germany, UE / EU)), which stores it on our behalf, and the authorities when the law requires it.
- How long
- While you have the account. If you close it or ask us to delete it, we delete this data, except what the law requires us to keep.
You can disconnect Aforena from your Google account at any time at https://myaccount.google.com/connections and ask us to delete your data by writing to aforenahq@gmail.com.
Aforena's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
5. Where your data is
Data is hosted on servers in the European Union (Contabo GmbH (Alemania / Germany, UE / EU)) and emails are sent through Sendinblue SAS — Brevo (Francia / France, UE / EU). Card payments are processed by Stripe Payments Europe, Ltd. (Irlanda / Ireland, UE / EU); if any of these providers processes data outside the EU, it does so with GDPR safeguards (such as the EU-US Data Privacy Framework or standard contractual clauses).
6. Minors
Many events have a minimum age. Children under 14 may not give us their data without their parents' or guardians' consent (article 7 of Spanish Organic Law 3/2018).
7. Security
We use encrypted connections (HTTPS), store passwords encrypted, QR codes are random secrets, back office access depends on each person's role, and we make daily backups.
8. Your rights
You can ask for access to your data, its correction or deletion, object to its processing, ask for it to be restricted or given to you in a portable format, and withdraw your consent at any time.
For a venue's data, contact its organizer; you can also write to aforenahq@gmail.com and we will pass it on. For data Aforena handles as controller, write to that same address. We will answer within one month.
If you think your rights have not been respected, you can complain to the Spanish Data Protection Agency: https://www.aepd.es
9. Changes
If we change this policy, we will publish the new version here with its date.