Privacy Policy

CASALUNA AB

Privacy Policy

tickets.casaluna.se

Version 1.0 • Effective date: June 29 2026

This document governs the purchase of tickets and the processing of personal data via tickets.casaluna.se.

Important Notice

By completing a purchase on tickets.casaluna.se you confirm that you have read and agreed to these Terms & Conditions and Privacy Policy. Please read them carefully before proceeding.

DISCLAIMER: This document is a legal draft prepared for CasaLuna AB. It should be reviewed by a qualified Swedish lawyer before publication.

Company	CasaLuna AB
Org.nr	559556-0391
Registered address	Torggatan 32, 43135 Mölndal
Contact e-mail	info@casaluna.se
Ticket platform	tickets.casaluna.se
Governing law	Sweden
Supervisory authority (data)	Integritetsskyddsmyndigheten (IMY), www.imy.se

PART B — PRIVACY POLICY

This Privacy Policy explains how CasaLuna AB ("we", "us") collects, uses, stores, and shares your personal data when you visit or purchase through tickets.casaluna.se. It is issued in accordance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679.

P1	Data Controller

Controller	CasaLuna AB
Org.nr	559556-0391
Address	Torggatan 32, 43135 Mölndal, Sweden
E-mail	info@casaluna.se
DPO	CasaLuna AB does not currently designate a mandatory Data Protection Officer (DPO) pursuant to Art. 37 GDPR. Privacy queries may be directed to info@casaluna.se.

P2	Personal Data We Collect

We collect the following categories of personal data, depending on the type of ticket or add-on purchased and the fields required by the Event organiser:

Identification data	First name, last name
Contact data	E-mail address, telephone number
Event-specific data	Dance role (leader/follower), gender (optional), country of residence, city of residence
Identity verification	Passport number or national ID (masked to last 3 digits in public-facing views; collected only when required by the Event)
Payment data	Payment is processed exclusively by Stripe. CasaLuna AB receives only an Order reference, payment status, and the last 4 digits of the payment method. CasaLuna AB never sees or stores full card details.
Technical/usage data	IP address, browser type, session identifiers, page interactions (for platform security and fraud prevention)
Communications data	E-mail correspondence and support requests sent to CasaLuna AB
QR/check-in data	QR code identifier, check-in timestamp and operator (for event access management)

P3	Purposes and Lawful Bases for Processing

We process your personal data on the following lawful bases under Article 6 GDPR:

Purpose	Lawful Basis	Details
Ticket purchase, order fulfilment, confirmation e-mail, PDF ticket delivery	Art. 6(1)(b) — Contract performance	Necessary to perform the purchase contract
Attendee check-in at the Event	Art. 6(1)(b) — Contract performance	Verify admission entitlement
Payment processing via Stripe	Art. 6(1)(b) — Contract performance	Stripe processes payment on our behalf under its own regulated service
Fraud detection and platform security	Art. 6(1)(f) — Legitimate interests	Our legitimate interest in preventing fraudulent activity and protecting Customers
Accounting, tax and legal compliance records	Art. 6(1)(c) — Legal obligation	Swedish Bokföringslagen (1999:1078) requires retention for 7 years
Sending marketing e-mails about future events	Art. 6(1)(a) — Consent	Only where you have opted in. Consent is freely given and may be withdrawn at any time by unsubscribing
Customer support and dispute resolution	Art. 6(1)(f) — Legitimate interests	Our legitimate interest in resolving queries and protecting our legal position

P4	Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected:

Order and payment records	7 years from the end of the financial year in which the transaction occurred (Bokföringslagen 1999:1078 §§ 7–8)
Attendee and event data	2 years from the Event date, unless a longer period is required by law or for pending disputes
Check-in logs	1 year from the Event date
OTP / magic-link tokens	Automatically invalidated and purged within 24 hours of issuance
Marketing consent records	Until consent is withdrawn, plus 1 year for evidential purposes
Vault API tokens	Immediately upon revocation; never stored in plain text (SHA-256 hash only)
Technical/log data	Up to 90 days, for security and platform stability purposes

P5	Third-Party Data Processors and Recipients

We share your personal data with the following categories of third parties, solely to the extent necessary to deliver our services. All processors are bound by data processing agreements compliant with GDPR Chapter 28:

Processor / Recipient	Country / Transfer Basis	Purpose
Stripe Technology Europe, Limited	Ireland (EEA)	Secure payment processing. Stripe does not receive attendee personal data beyond what is required for fraud prevention.
Resend (Functional Software, Inc.)	USA — Standard Contractual Clauses (SCCs)	Transactional e-mail delivery (order confirmations, OTP codes, PDF tickets)
Vercel Inc.	USA — Standard Contractual Clauses (SCCs)	Platform hosting and edge network. Data is served from EU data centres where available.
Neon Inc. (database)	USA — Standard Contractual Clauses (SCCs)	Managed PostgreSQL database. Data encrypted at rest and in transit.
Venue operators	Sweden	Check-in verification; shared only with the operator of the specific Event attended.
Promoters / affiliates	Sweden / EEA	Only aggregate sales statistics; no individual personal data is shared.
Legal / regulatory authorities	Sweden	Where required by law (e.g. Skatteverket, police, courts).

We do not sell, rent, or otherwise commercially share your personal data with third parties for their own marketing purposes.

P6	Your Rights Under GDPR

As a data subject under GDPR, you have the following rights in relation to your personal data:

Right of access (Art. 15)	You may request a copy of the personal data we hold about you and information about how we process it.
Right to rectification (Art. 16)	You may request correction of inaccurate or incomplete personal data. Attendee details may also be corrected via the "My Tickets" portal before the applicable deadline.
Right to erasure (Art. 17)	You may request deletion of your personal data where we no longer have a lawful basis for processing it. This right is subject to overriding legal obligations (e.g. accounting records).
Right to restriction (Art. 18)	You may request that we restrict processing of your data in certain circumstances (e.g. while accuracy is contested).
Right to data portability (Art. 20)	Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
Right to object (Art. 21)	You may object to processing based on our legitimate interests at any time. You have an unconditional right to object to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3))	Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing. To unsubscribe from marketing e-mails, click the "Unsubscribe" link in any marketing e-mail or contact info@casaluna.se.

To exercise any of these rights, please contact us at info@casaluna.se with the subject line "GDPR Request". We will respond within 30 calendar days. We may request proof of identity to verify the request.

You also have the right to lodge a complaint with the Swedish Data Protection Authority (IMY) at any time:

Authority	Integritetsskyddsmyndigheten (IMY)
Website	www.imy.se
E-mail	imy@imy.se
Telephone	+46 8 657 61 00

P7	International Data Transfers

Some of our data processors are located outside the European Economic Area (EEA), primarily in the United States. Where personal data is transferred outside the EEA, we ensure an adequate level of protection by relying on:

Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Decision 2021/914/EU); and/or
Adequacy decisions issued by the European Commission, where applicable.

You may request a copy of the relevant transfer mechanisms by contacting info@casaluna.se.

P8	Cookies and Tracking Technologies

The Platform uses cookies and similar technologies. We categorise them as follows:

Strictly necessary	Session cookies required for the Platform to function (e.g. authentication state, cart state). No consent required.
Performance / analytics	If used, these cookies collect anonymised information about how visitors use the Platform. We will request consent before setting these.
Third-party	Stripe may set cookies required for fraud detection and payment security. These are governed by Stripe's own Privacy Policy.

You can control or delete cookies via your browser settings. Disabling strictly necessary cookies may impair Platform functionality. Our cookie consent banner (where required by the ePrivacy Directive) allows granular control over non-essential cookies.

P9	Children's Privacy

The Platform is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without verifiable parental or guardian consent. If you believe we have inadvertently collected such data, please contact info@casaluna.se and we will delete it promptly.

P10

Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified via a prominent notice on the Platform and/or by e-mail (where we hold your address). The effective date at the top of this document indicates when the policy was last revised. Continued use of the Platform after such notice constitutes acceptance of the updated policy.

P11

Contact and Privacy Queries

For any questions about this Privacy Policy or to exercise your data subject rights, please contact:

CasaLuna AB	Privacy enquiries
E-mail	info@casaluna.se
Address	Torggatan 32, 43135 Mölndal, Sweden
Response time	Within 30 calendar days of receipt of your request

Version: 3 · Published: 2 July 2026