Privacy Policy
Last updated: 22 September 2026
Introduction
This policy explains how we collect, use, and protect your personal data, in accordance with the General Data Protection Regulation (GDPR) and the Romanian legislation in force.
Who the controller is
The controller of your personal data is BALAS TUDOR-DAN Persoană Fizică Autorizată (PFA), CUI 52667245, Trade Register No. F2025039075003, with its registered office at Cluj County, City of Cluj-Napoca, Strada Soporului, Nr. 8, Bl. A1, Scara 2, Etaj 10, Ap. 125, trading as Mingle Society ("we", "the platform") at minglesociety.ro.
You can reach us at contact@minglesociety.ro or on +40 770 738 778, and the full identification details are on the Legal Information page. We have not appointed a data protection officer; requests go to the address above.
The data we collect
We collect the following personal data:
- Name and email address (at registration, or when buying a ticket without an account), and the participant name given when a ticket is purchased
- Phone number. Mandatory at ticket checkout: it is a contractual requirement, because it is the organizer's only way to reach you on the day of the event, and without it the order cannot be placed. Optional in your user profile, where it only pre-fills the checkout field.
- Payment information (processed exclusively by Stripe -- we do not store card data)
- Browsing data (cookies essential to the operation of the platform; only if you accept audience measurement, aggregate technical data sent automatically by your browser — page visited, referrer, device and browser type, country; and only if you accept marketing, the advertising data described under Data sharing)
Why we process your data, and on what basis
Each purpose is listed with the legal ground it actually rests on. The two are paired deliberately: a purpose with no ground, or a ground claimed for a purpose it does not fit, gives you a right you cannot exercise or hides one you have.
| Purpose | Legal basis |
|---|---|
| Managing your user account | Performance of the contract — art. 6(1)(b) GDPR. Creating an account is a contract with us, not something you consent to; you cannot withdraw it while keeping the account. |
| Processing your order, with or without an account | Performance of the contract — art. 6(1)(b) GDPR. The ticket is the contract; the order data is needed to perform it and to prove it. |
| Processing ticket purchases, and passing your details to the organizer of that event | Performance of the contract — art. 6(1)(b) GDPR. |
| Transactional communications about your orders (confirmation, reminder, cancellation, refund) | Performance of the contract — art. 6(1)(b) GDPR. These are not marketing and cannot be unsubscribed from while an order is live. |
| The "new events" email digest, and the city and category preferences it is matched against | Consent — art. 6(1)(a) GDPR and art. 12 of Law 506/2004. Off by default; you turn it on in your profile and can turn it off at any time, without affecting anything else. |
| Audience measurement, used to improve the platform | Consent — art. 6(1)(a) GDPR and art. 4(5) of Law 506/2004. Nothing is measured until you accept the cookie banner; ignoring it counts as a refusal. |
| Measuring a paid advertising campaign for one event, run by our partner Calmly through Meta, and Meta's use of the same data to show you ads | Consent — art. 6(1)(a) GDPR and art. 4(5) of Law 506/2004. The Marketing category is off by default and separate from audience measurement: accepting one does not accept the other. |
| Platform security and fraud prevention | Legitimate interest — art. 6(1)(f) GDPR. |
| Keeping accounting and tax records of purchases | Legal obligation — art. 6(1)(c) GDPR, with art. 25 of Law 82/1991. |
Where the basis is consent, you may withdraw it at any time and it is as easy to withdraw as it was to give. Doing so does not affect the lawfulness of what was processed beforehand, and it does not affect anything in the rows above it.
Data sharing
Your personal data may be shared with the following service providers:
- Stripe (payment processing)
- Resend (sending transactional emails)
- Neon (database hosting)
- Vercel (web platform hosting)
In addition, when you buy a ticket, the organizer of that event receives the participant name given at checkout, your email address and your phone number. This is done for the sole purpose of organising and running the event you signed up for (attendee list, check-in at the venue, communications about that event). The data is passed only to the organizer of the event for which you bought the ticket, and for this use the organizer acts as an independent controller of your data, responsible for it under the GDPR.
Only if you accept the Marketing category
If — and only if — you accept the Marketing category in the cookie banner, this site also sends data about your visit to the following recipients:
- Meta Platforms Ireland Limited (Ireland), through the Meta pixel: an advertising identifier stored in a cookie on your device, the address of the page you are on and of the page you came from, your IP address and browser details, and, when you complete a purchase, the event, the ticket type, its price and the currency. Meta is not our processor: it receives this data under its business terms with Calmly and uses it, as its Privacy Policy describes, to provide measurement and to target and deliver ads, including ads shown to you outside this site.
- Calmly, our advertising partner, which pays for a campaign promoting one event and runs it from its own Meta advertising account, to which the pixel belongs. Calmly sees the results of the campaign in that account.
- Google Ireland Limited, which serves the Google Tag Manager script that loads the Meta pixel. Loading it sends Google your IP address and browser details; Tag Manager itself sets no cookie.
- Amazon Web Services, whose servers in the United States host a helper script that Meta's pixel template fetches. Fetching it sends those servers your IP address and browser details.
We decide whether the pixel loads on this site and on which pages, and it never loads on account, organizer, administration or sign-in pages, nor for organizer or administrator accounts. You can address any request about this data to us, and we will pass on to Calmly or Meta whatever concerns data they hold. You can withdraw your consent at any time from the Cookie settings link at the bottom of every page; how to delete the cookie and opt out of ad targeting is explained in the Cookie Policy.
Apart from the situations described above, we do not sell your personal data. The only sharing for marketing purposes is the advertising measurement described above, which happens only with your consent, and your name, email address and phone number are never sent to it, whether in clear or in hashed form.
Transfers outside the EEA
The four service providers in the first list above are, or are part of, groups established in the United States, and some of the processing therefore takes place outside the European Economic Area. If you accept the Marketing category there are three more routes, all to the United States: Meta Platforms Ireland Limited may transfer the data it receives to Meta Platforms, Inc.; Google Ireland Limited may transfer the technical data from loading Tag Manager to Google LLC; and your browser fetches Meta's helper script directly from Amazon Web Services servers there. We make no other transfers outside the EEA.
These transfers rely on the safeguards required by Chapter V GDPR — the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified under it, and otherwise the Standard Contractual Clauses adopted by the European Commission, agreed in each provider's data processing or data transfer terms. Meta Platforms, Inc., Google LLC and Amazon Web Services, Inc. are all on the Data Privacy Framework List. You may ask us for a copy of the safeguard relied on for a particular provider, at the address above.
If you are an event organizer
Everything above describes the data of people who BUY tickets. If you publish events, we also process data about you, and some of it is published.
To submit a paid event you give us your legal name, CUI, Trade Register number, registered office and IBAN. Your legal name, CUI, Trade Register number and registered office are shown to buyers — on the event page, in the checkout panel, on the confirmation page and in the confirmation email — because you are the seller of the ticket and OUG no. 34/2014 requires a trader to be identified to the consumer. For a PFA or an individual enterprise, that information is personal data as well as fiscal data. The legal basis is performance of our contract with you (art. 6(1)(b)) together with our legal obligation to identify the seller (art. 6(1)(c)).
The public contact details you enter in your fiscal details page are published on the same surfaces, on that basis. If you leave them blank we do not publish your account address; buyers are given ours instead and we pass the message on.
Your identification data is also sent to Stripe, which verifies it in order to pay you (KYC). We keep the fiscal records for the period accounting law requires, which outlives your account.
Storage duration
Your account data is kept for as long as the account exists; upon a deletion request it is deleted within 30 days. Order data (participant name, phone, email) is kept for the period accounting law requires, whether or not you have an account, because the ticket is a fiscal document. Audience-measurement data follows a separate lifecycle: it comes from visitors who may have no account, is held only in aggregate form, and is retained by the provider for the period stated in its own documentation. It is not linked to your account and is therefore not affected by deleting it.
Marketing data has a lifecycle of its own too. The Meta cookie stays on your device for 90 days, renewed each time the pixel runs, unless you delete it; Meta's business terms allow it to keep the event data it receives for up to two years; and we take the pixel off the site once the event the campaign promotes has taken place. Deleting your account does not reach data already held by Meta or Calmly.
Your rights
In accordance with the GDPR, you have the following rights regarding your personal data:
- The right of access to your personal data
- The right to rectification of inaccurate data
- The right to erasure of data ("the right to be forgotten")
- The right to restriction of processing (art. 18) -- to have us hold your data without using it, while a dispute about its accuracy or about our legitimate interest is being resolved
- The right to data portability
- The right to object to data processing
- The right to withdraw consent at any time, where consent is the basis (see the table above), without affecting the lawfulness of what was processed beforehand
- The right to lodge a complaint with ANSPDCP, the Romanian Data Protection Authority -- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, dataprotection.ro
To exercise these rights, please contact us at the email address below.
Cookies
The cookies the platform sets itself are only those necessary for it to work correctly (authentication, session, chosen language) plus one cookie that records your answer to the cookie banner. Anything else depends on that answer, which you give separately for two categories, and nothing optional loads until you choose:
- Statistics.We measure visitor numbers in aggregate form through the Vercel Web Analytics service. Vercel Inc., acting as our processor, receives technical data sent automatically by your browser (page visited, referrer, device and browser type, country). According to the provider's documentation the service stores no cookies and creates no persistent identifier for you.
- Marketing. The Meta pixel, loaded through Google Tag Manager, sets an advertising cookie and reports your visit, and any purchase you complete, to Meta, as described under Data sharing. Its data can be used to show you ads outside this site.
The legal basis for both is your consent, which you can withdraw at any time from the Cookie settings link at the bottom of every page, as easily as you gave it. The cookies and scripts involved, with their durations, are set out in the Cookie Policy.
Contact
For questions about your personal data, you can contact us at: