Privacy Policy
Last updated: 26 May 2026
Data controller: VNE bv, VAT BE0476.930.984, Lebeke 94, 9450 Haaltert, Belgium.
4. Subprocessors
ClearTix processes personal data in two distinct roles, each with its own subprocessors.
4.1 When ClearTix acts as data controller
(your account and billing data as Organizer)
| Subprocessor | Country | Purpose | Transfer mechanism | Adequacy |
|---|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Hosting (servers + DB) | None — within the EEA | n/a |
| Hetzner Object Storage | Finland or Germany (EU) | Uploads (logos, headers, ticket attachments) | None — within the EEA | n/a |
| Stripe Payments Europe Ltd | Ireland (EU) | Billing for the ClearTix subscription | None — within the EEA | n/a |
| Stripe, Inc. | USA | Underlying processing by the parent company | EU-US Data Privacy Framework (European Commission adequacy decision dated 10/07/2023, ref. C(2023) 4745) + SCCs as secondary basis | DPF — certified; verify every 6 months via dataprivacyframework.gov |
| Cloudflare, Inc. | USA | DNS resolution only (no proxy, no CDN, no TLS termination) | DPF + SCCs; does not process request content | DPF — certified; verify every 6 months |
ClearTix performs a documented Transfer Impact Assessment (TIA) for every US transfer. If a DPF certification is withdrawn, we activate the documented fallback plan.
4.2 When ClearTix acts as processor on behalf of an Organizer
(attendee and ticket data)
The Organizer is the data controller and chooses the payment provider via OAuth (Stripe Connect or Mollie). The Organizer is the contractual counterparty of that provider and must list it in their own privacy policy. ClearTix only routes payment requests; ClearTix is not a counterparty in the PSP relationship.
ClearTix's own subprocessors in this role remain Hetzner and Cloudflare (DNS-only), as listed above.
4.3 When ClearTix becomes data controller over data from §4.2
For certain processing activities, ClearTix itself determines purpose and means even though the data was originally collected through the Organizer: security logs (art. 32 GDPR), fraud-detection signals, audit logs (accountability obligation art. 5(2)), and anonymised usage statistics. In that role, ClearTix is the data controller, relying on legitimate interest (art. 6(1)(f) GDPR) as the legal basis. A Legitimate Interest Assessment is documented. This hybrid position follows from art. 28(10) GDPR.
11. Automated decision-making (art. 22 GDPR)
ClearTix does not take decisions that produce legal effects or similarly significant effects on you based solely on automated processing. Specifically:
- Rate limiting (a maximum number of requests per minute/hour) is applied automatically based on technical signals (IP address, request frequency). A rate limit blocks temporarily and cannot lead to permanent account suspension.
- Fraud signals (anomalous payment patterns, repeated failed authentication attempts, anomalies) generate an internal notification to a ClearTix staff member. All account suspensions, fraud-based ticket cancellations, or refusals are exclusively assessed and executed by a ClearTix staff member within one working day.
- You always have the right to obtain human intervention, to express your point of view and to contest a decision (art. 22(3) GDPR). Send your request to [email protected].
12. Contact
Privacy contact point: [email protected] — managed by Wesley Veldeman. This is a contact point for privacy questions and exercising data-subject rights; it is not a formal DPO designation within the meaning of art. 37 GDPR (ClearTix is not subject to the DPO obligation).