CROWDSURFR ApS, CVR 45005682, Baldersgade 4, 4., 2200 Copenhagen N, Denmark is the data controller for the personal data described in this policy. This policy explains what CrowdSurfr collects, why we use it, who receives it, how long we keep it and the rights available to you.
1. Data we collect
Depending on how you use CrowdSurfr, we may process account details such as email address, phone number, name and authentication identifiers; event activity such as ticket claims, waitlists, favourites and rewards; ticket identifiers and validation records; device/app information needed for security, diagnostics and notifications; communications with support; and transaction information if paid services are introduced. We do not need your password in readable form and do not store it ourselves.
2. Why we use data and legal bases
We process data to create and secure accounts, provide tickets and event features, perform contracts or take steps at your request, operate customer support, prevent fraud and abuse, comply with legal obligations, and improve service reliability. Where required, optional marketing, tracking or certain notifications are based on consent. Security and service-improvement processing may rely on our legitimate interests where those interests are not overridden by your rights.
3. Event organisers
Where necessary to provide event access, verify a ticket, manage capacity or resolve an event issue, relevant ticket or attendee information may be made available to the organiser or venue for that event. We aim to limit the information to what is necessary for the stated purpose.
4. Service providers
We use service providers for functions such as cloud hosting, databases, authentication, email/SMS delivery, crash/security monitoring and, where applicable, payments. These providers process data under contractual and legal safeguards. We may also disclose information when required by law or necessary to establish, exercise or defend legal claims.
5. International transfers
Some providers or their subprocessors may process data outside the European Economic Area. Where this occurs, we use an applicable lawful transfer mechanism, such as an adequacy decision or approved contractual safeguards, and assess additional protections where required.
6. Retention
We keep personal data only for as long as needed for the purposes described here. Account and ticket data is generally retained while the account or relevant event relationship remains active and then deleted or anonymised unless a longer period is required for fraud prevention, accounting, legal claims or another legal obligation. Backup copies may remain for a limited technical retention period before being overwritten.
7. Your rights
Subject to the GDPR and applicable Danish law, you may have rights to access, correct, erase or restrict your personal data, object to certain processing, receive portable data and withdraw consent at any time for future processing based on consent. You can initiate account deletion in the app or contact privacy@crowdsurfr.com.
8. Complaints
Contact privacy@crowdsurfr.com if you have privacy questions or wish to exercise a right. You also have the right to complain to a competent supervisory authority. In Denmark, the supervisory authority is Datatilsynet (the Danish Data Protection Agency).
9. Security
We use technical and organisational measures intended to protect personal data, including access controls, authenticated sessions, encrypted network transport and database access rules. No system can guarantee absolute security, so please protect your device and account credentials as well.
10. Children
CrowdSurfr is not intended to collect personal data from children in circumstances where parental consent is legally required without obtaining the required consent. Individual events may impose higher age limits.
11. Automated decisions and profiling
CrowdSurfr does not currently make decisions producing legal or similarly significant effects solely through automated processing. If that changes, this policy and the user experience will be updated as required by law.
12. Changes to this policy
We may update this Privacy Policy when our service, providers or legal obligations change. Material changes will be communicated appropriately and the effective date will be updated.