1. Who we are and how to reach us
This Policy is the information notice required by Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR"). It explains how we process the personal data of natural persons who use the VIBE mobile application for iOS and Android (the "App"), the website at vibevents.eu and the related backend services at api.vibevents.eu (together, the "Service").
1.1 Controller
"VIBE", "VIBE." and "Flintworks" / "Flintworks Studio" are brand and product names only. They are not registered legal entities. The controller is always Horváth Dávid E.V.
1.2 Hosting provider
The backend, the database and uploaded files are hosted on infrastructure provided by:
1.3 Data protection officer
We have not appointed a data protection officer (DPO). We are a single-person sole trader; our core activity is not the large-scale regular and systematic monitoring of data subjects, and we do not process special categories of data on a large scale, so we consider that Article 37(1) GDPR does not require a DPO. All data protection questions go to support@flintworks.hu.
2. Scope of this Policy
2.1 This Policy covers processing carried out by us as controller in connection with the App and the backend Service, including the operator admin panel used to run them.
2.2 It does not cover:
- •Third-party ticket sellers. When you follow a "get tickets" link, you leave the Service. What Cooltix, OneTicket, Resident Advisor or any other seller does with your data is governed by their own privacy policies and their contract with you. We are not the merchant of record and receive no purchase or payment data from them.
- •Venues, organisers and artists you interact with in the physical world.
- •Apple, Google, Meta and your operating system where they act as independent controllers for your device, your app store account, and your sign-in identity with them.
- •Other users who read your public content.
2.3 The Service is intended only for people aged 18 or over (Section 16).
3. Principles we apply
We process personal data lawfully, fairly and transparently; only for the purposes described here (purpose limitation); only to the extent needed for those purposes (data minimisation); we correct or delete inaccurate data without delay (accuracy); we keep data no longer than needed (storage limitation); and we protect it with appropriate technical and organisational measures (integrity and confidentiality). We are accountable for demonstrating this.
4. Short glossary
- •Personal data — any information relating to an identified or identifiable natural person.
- •Processing — anything done with personal data: collection, storage, use, disclosure, erasure, and so on.
- •Controller — the party that decides why and how personal data is processed. For the Service, that is us.
- •Processor — a party that processes personal data on our instructions, for example our hosting or analytics provider.
- •Third country — a country outside the European Economic Area (EEA).
- •NAIH — Nemzeti Adatvédelmi és Információszabadság Hatóság, the Hungarian supervisory authority.
5. Where the data comes from
| Source | Examples |
|---|---|
| Directly from you | Registration details, profile fields, reviews and ratings, tags and notes, imported ticket files, lineup screenshots, support and rights-request emails |
| From your device, with your permission | Approximate or precise location, photos you pick, push notification token |
| Generated by your use of the Service | Saves, follows, RSVPs, attendance and verification records, product analytics events, session replay recordings, server logs |
| From sign-in providers | Apple, Google or Meta send us a signed token containing an identifier and, usually, an email address; a name is normally sent only on your first sign-in |
| From third-party and public sources | Event, venue, artist and ticket-offer catalog data. This is information about businesses and public figures and their events, not about you as a user, although a publicly performing artist may be a natural person |
We do not buy personal data, and we do not build advertising profiles or sell data.
6. What we process, why, on what basis, and for how long
Each block below is one processing purpose. Legal-basis references are to Article 6(1) GDPR.
6.1 Creating an account and signing you in
Who: everyone who registers. Purpose: creating your account, authenticating you, keeping you signed in, and protecting the account.
| Data | Legal basis | Retention |
|---|---|---|
| First name, last name, email address, account creation date | Art. 6(1)(b) — performance of the contract (the Terms) | Until you delete your account or ask us to delete it |
| Password, stored only as a bcrypt hash — we never see or store your plain password | Art. 6(1)(b) | Same as above |
| Sign-in provider (Apple / Google / Facebook) and the provider's user identifier for you | Art. 6(1)(b) | Same as above; deleted if you unlink or delete the account |
| Refresh tokens issued for your sessions (server-side records), and access/refresh tokens held in your device's app storage | Art. 6(1)(b), and Art. 6(1)(f) — our legitimate interest in session security | Refresh tokens are rotated on each use and deleted on sign-out; device tokens are cleared when you sign out |
How it works. You can register with an email address and a password, or use Sign in with Apple, Google Sign-In or Facebook Login. With a sign-in provider we verify the signed token the provider issues, then create or link your account. If the email address in that token already belongs to an existing account, we link the two rather than creating a duplicate. Access tokens are short-lived; a longer-lived refresh token keeps you signed in and is replaced each time it is used.
Providing this data is necessary to have an account. Without it the Service cannot be used in a signed-in state.
6.2 Your profile and social visibility
Who: signed-in users. Purpose: showing your profile, and letting other users see limited "who's going" information where you allow it.
| Data | Legal basis | Retention |
|---|---|---|
| Name, main city | Art. 6(1)(b) | Until changed or account deleted |
| "Show that I'm attending" setting | Art. 6(1)(a) — consent, expressed through the in-app setting | Until you change it or delete the account |
| Social-proof display derived from your name (initials shown next to events you are attending) | Art. 6(1)(a), through the same setting; Art. 6(1)(f) for aggregate attendee counts that do not identify you | While the setting is on and the event record exists |
How it works. If you enable public attendance, other users can see that someone with your initials is attending an event. Turning the setting off stops this. Aggregate counts ("42 going") do not identify individual users.
6.3 Maps, search and location
Who: users who grant location permission. Purpose: showing the map and nearby events, radius search, setting your main city, and verifying that you were at a venue.
| Data | Legal basis | Retention |
|---|---|---|
| Device location (latitude/longitude) used to render the map and to sort or filter results near you | Art. 6(1)(a) — consent given through the operating system permission prompt | Used in the moment; not stored as a location history by us |
| Latitude/longitude sent to the server to check whether you are inside the geofence of a venue for attendance verification | Art. 6(1)(b) / Art. 6(1)(a) | Evaluated on receipt; the raw coordinates are not persisted. Only the outcome is stored (see 6.5) |
| City name derived from your location (reverse geocoding) and stored as your main city, and city-level signals used for "typical crowd" style aggregates | Art. 6(1)(a) / Art. 6(1)(f) | Until you change your main city or delete your account |
| Map tile and style requests made by your device to our maps provider | Art. 6(1)(f) — legitimate interest in providing a functioning map | Handled by Mapbox under their own policy |
How it works. Location is requested through your device's operating system, and you can withdraw it at any time in your device settings; the affected features then stop working or fall back to manual choices. We store city-level strings, not a trail of coordinates. Coordinates used for geofenced attendance verification are checked against the venue position and discarded — what remains is the fact that a check succeeded or failed.
6.4 Ticket wallet
Who: users who import tickets. Purpose: storing tickets you already hold so you can find them in the App, and grouping them by event.
| Data | Legal basis | Retention |
|---|---|---|
| The ticket file you import (typically a PDF), stored on our server's file system in a per-user folder | Art. 6(1)(b) | Until you delete the ticket or your account |
| The barcode/QR payload extracted from the ticket | Art. 6(1)(b) | Same as above |
| Ticket metadata: event name, date, venue, seat/category, order or reference data present in the file, wallet grouping, transfer-related fields | Art. 6(1)(b) | Same as above |
How it works. Ticket files are private to your account and are not shown to other users. A ticket in the wallet is a convenience copy: it is not issued, validated or guaranteed by us.
Staff access. Our operator staff can access wallet records through the admin panel where this is necessary to provide support, to fix a technical problem, or where we are legally required to. See 6.10.
Note on the file contents. A ticket PDF issued by a seller may itself contain personal data (your name, order number, sometimes an address). We do not extract more than we need for the wallet, but the original file is stored as you supplied it.
6.5 Attendance and attendance verification
Who: users who mark themselves as attending, or verify attendance. Purpose: keeping your going/attended list, unlocking the ability to rate what you attended, and reducing fake ratings.
| Data | Legal basis | Retention |
|---|---|---|
| RSVP / "I'm going" records linked to your account and an event | Art. 6(1)(b) | Until you remove the RSVP or delete your account |
| Attendance verification records: which method was used (ticket in wallet, or location check) and the result; a reference to the ticket used, where relevant | Art. 6(1)(b), and Art. 6(1)(f) — legitimate interest in the integrity of ratings | Retained with the attendance record |
Attendance records in the App are for the Service only. They have no evidentiary value towards venues, organisers or any third party.
6.6 Ratings, reviews, tags and other content you post
Who: users who post content. Purpose: publishing your content, and building the aggregate ratings and tag summaries shown on event, venue and artist pages.
| Data | Legal basis | Retention |
|---|---|---|
| Event and venue ratings, per-dimension venue scores (sound, crowd, lineup, door, bar wait, safety), performance ratings for artists | Art. 6(1)(b) | Until you delete the item or your account |
| Review text and private notes | Art. 6(1)(b) | Same as above |
| Vibe tags you submit for a venue | Art. 6(1)(b) | Same as above |
| Aggregate figures computed from the above (averages, counts, most-used tags) | Art. 6(1)(f) — legitimate interest in providing useful aggregated information | Aggregates may survive deletion of the underlying item where they can no longer be linked to you |
Please do not post special-category data. Reviews are not the place for information about anyone's health, sex life, sexual orientation, religion, politics, ethnicity or trade union membership — yours or anyone else's. We do not intend to process special categories of data and will remove such content when we become aware of it.
6.7 Saves, follows and discovery
| Data | Legal basis | Retention |
|---|---|---|
| Saved events, followed artists and similar lists | Art. 6(1)(b) | Until you un-save/un-follow, or delete your account |
| Use of these signals to order or highlight content for you inside the App, and to decide whether to send you a relevant prompt | Art. 6(1)(f) — legitimate interest in a useful product | Same as above |
Follower counts shown on artist pages are aggregate numbers, not lists of names.
6.8 Push notifications
Who: users who allow notifications. Purpose: sending service-related prompts.
| Data | Legal basis | Retention |
|---|---|---|
| Expo push token and platform (iOS/Android) for your device | Art. 6(1)(a) — consent given through the notification permission; Art. 6(1)(f) for delivery and error handling | Until you sign out, revoke the permission, or the token becomes invalid |
| Records of notifications sent to you and their outcome | Art. 6(1)(f) — legitimate interest in not sending duplicates and in diagnosing delivery failures |
What we actually send today: prompts to rate an event you attended, prompts to rate a venue's dimensions, and prompts to confirm attendance. These are triggered by your own activity (for example an event you RSVP'd to that has just ended). We do not currently send marketing or promotional push notifications.
Honest note on preferences. The notification preference switches visible in the profile screen (recommendations, followed artists, low ticket alerts) are not yet functional — they do not currently save a preference. Notifications can be turned off entirely in your device settings, and that does work. We will make the in-app controls work before we send anything beyond the transactional prompts above.
6.9 Community lineup submissions processed by AI
Who: users who upload a lineup screenshot. Purpose: reading event and lineup information out of an image so it can be added to the catalog.
| Data | Legal basis | Retention |
|---|---|---|
| The image file you upload, stored on our server | Art. 6(1)(b) / Art. 6(1)(a) | Retained with the submission record; no automatic deletion after extraction today, and not deleted automatically if you delete your account (see 10.5) |
| The image contents sent to Google's Gemini vision model for text extraction | Art. 6(1)(b) / Art. 6(1)(a) | Processing at Google is governed by Google's terms for that API |
| The structured draft extracted from the image, linked to your user account | Art. 6(1)(b) | Until the submission is deleted; kept, with the link to you removed, if you delete your account (see 10.6) |
| Your account identifier, so we can attribute and moderate the submission | Art. 6(1)(f) — legitimate interest in moderation and abuse prevention | With the submission record |
How it works. When you submit a lineup screenshot, the server reads the stored image and sends it to Google's Gemini API, which returns extracted text as structured data. Any personal data visible in the image — names, faces, handles, anything in a screenshot of a social media post — is sent to Google as part of that image. Please do not upload images containing other people's personal data that you have no basis to share, and do not upload screenshots of private messages. Extracted results may be inaccurate and may be reviewed, edited or rejected by us before anything is published.
6.10 Operating the Service, support and administration
| Data | Legal basis | Retention |
|---|---|---|
| Access by our staff, through an admin panel, to user records including profile data, ratings and reviews, attendance and ticket wallet entries, where necessary to provide support, to moderate, or to fix problems | Art. 6(1)(f) — legitimate interest in operating and supporting the Service; Art. 6(1)(b) where support is part of providing it | Access is not permanent storage; any records created are kept as described elsewhere in this Section |
| Correspondence you send to support@flintworks.hu, including your email address and whatever you write | Art. 6(1)(b) and Art. 6(1)(f); Art. 6(1)(c) where the request is a statutory data protection request | |
| Administrator accounts (usernames and hashed passwords for our own staff) | Art. 6(1)(f) — legitimate interest in secured operations | While the person needs access |
Staff access is limited to what an operational task requires. We are a very small team, and every person with admin access is bound to confidentiality.
6.11 Product analytics and session replay (PostHog)
Who: users of production builds of the App. Purpose: understanding how the App is actually used, finding where it breaks or confuses people, and prioritising work.
| Data | Legal basis | Retention |
|---|---|---|
| A distinct analytics identifier and product events (screens opened, actions taken, app version, platform) | Art. 6(1)(f) — legitimate interest, as currently implemented. | PostHog's retention for our project |
| Person traits: your email address and your name, attached to the analytics profile when you sign in | — see the honesty note below | Until deleted from PostHog on request |
| Session replay recordings of your interaction with the App, with all text inputs masked and all images masked |
Where it goes. We use PostHog on its EU Cloud (eu.i.posthog.com), so the analytics data is stored in the European Union. PostHog acts as our processor.
When it is on. Analytics is disabled in development builds and is enabled by default in production builds of the App where an analytics key is configured. Session replay is enabled together with analytics, with text-input and image masking turned on. When you sign out, we reset the analytics identity on your device.
Honest disclosure — no consent toggle today. The App currently has no in-app control to opt out of analytics or session replay, and we do not ask for consent before starting them in production builds. We are disclosing this as our actual practice rather than describing a control that does not exist. We intend to add an in-app analytics setting.
6.12 Security, abuse prevention and legal claims
| Data | Legal basis | Retention |
|---|---|---|
| Server and infrastructure logs generated when your device contacts our API, which may include IP address, timestamps and request metadata | Art. 6(1)(f) — legitimate interest in security, availability and abuse prevention | Short operational retention |
| Records used to detect and act on manipulation of ratings, fake attendance, scraping or account abuse | Art. 6(1)(f) | As long as needed for the investigation and any consequence |
| Records kept to establish, exercise or defend legal claims, and to demonstrate compliance | Art. 6(1)(f), and Art. 6(1)(c) where a law requires the record | |
| Records of data protection requests and of any personal data breach | Art. 6(1)(c) — legal obligation under Articles 5(2), 30 and 33 GDPR |
6.13 What we do not do
- •We do not sell personal data.
- •We do not run advertising networks in the App, and we do not use the advertising identifier (IDFA/AAID). App Tracking Transparency tracking is not requested, and advertiser-ID collection in the Facebook SDK is disabled.
- •We do not bill end users, so we hold no payment card data, no billing addresses and no invoices for use of the Service. The accounting-retention rules that apply to invoices therefore do not apply to us here.
- •We do not send marketing emails or marketing push notifications today.
- •We do not knowingly process special categories of personal data.
7. Device permissions
The App asks your operating system for the following. You can grant or withdraw each one in your device settings at any time; where you withdraw one, the related feature stops working.
| Permission | What it is used for |
|---|---|
| Location (while in use) | Map, nearby/radius search, reverse-geocoding your main city, geofenced attendance verification (6.3) |
| Photo library | Choosing images you upload, including community lineup screenshots (6.9) |
| Camera | Declared for image capture; current flows use the photo library |
| Notifications | Delivering the transactional prompts described in 6.8 |
| Files / documents and share sheet | Importing ticket files into the wallet (6.4) |
Microphone and motion. No feature in the Service uses the microphone or motion sensors, we do not request those permissions, and we do not collect audio or motion data.
8. Who receives your data
We share personal data only with the parties below, and only for the purposes stated. Most of them act as our processors and handle the data on our instructions under a contract meeting Article 28 GDPR. Some act as independent controllers for their own part of the interaction — where they do, their own privacy policy governs.
| Recipient | Role | What they receive | Where they process it |
|---|---|---|---|
| VPS4You Kft. (Hungary) | Processor — hosting of the server, database and uploaded files | All server-side data: account records, tickets and uploaded files, ratings, attendance, logs | Hungary / EU |
| PostHog (EU Cloud) | Processor — product analytics and session replay | Analytics identifier, email and name, product events, masked session recordings | EU (eu.i.posthog.com); vendor is US-headquartered |
| Mapbox | Processor / independent controller for its own service — map tiles and styles | Map requests from your device, which reveal the area you are viewing, plus technical request data | US and other locations |
| Expo (Expo Push Service) | Processor — push notification delivery | Push token, notification content | US |
| Apple (APNs) | Push delivery infrastructure | Push token, notification payload | US and global |
| Google (FCM) | Push delivery infrastructure | Push token, notification payload | US and global |
| Apple (Sign in with Apple) | Independent controller for the sign-in | The sign-in event; Apple returns a signed token with an identifier and email to us | US and global |
| Google (Google Sign-In) | Independent controller for the sign-in | As above | US and global |
| Meta / Facebook (Facebook Login) | Independent controller for the sign-in | As above | US and global |
| Google (Gemini API) | Processor — AI extraction of text from lineup screenshots | The uploaded image and its contents (6.9) | US and global |
| Ticket sellers — Cooltix, OneTicket, Resident Advisor and others | Not our processors. Outbound destinations only | Nothing is sent by us. You leave the App and deal with them directly. A ticket PDF you import may contain data they put in it | Per their own policies |
Also possible: competent authorities, courts, or our professional advisers, where we are legally obliged to disclose data or need to establish or defend a legal claim. Where the Service is transferred to a successor of the business, data may be transferred with it; we would notify you in advance.
We do not share your personal data with venues, organisers or artists in an identifiable form. What they may see are aggregate figures.
9. Transfers outside the EEA
Some of the processing described above involves transfers of personal data to countries outside the European Economic Area, principally the United States. We are not claiming otherwise. Specifically:
| Transfer | Trigger | Intended safeguard |
|---|---|---|
| Sign in with Apple / Google Sign-In / Facebook Login | You choose a third-party sign-in | The provider's own transfer framework — these providers act largely as independent controllers |
| Mapbox | Map usage | Standard Contractual Clauses and/or the provider's certification |
| Expo Push, Apple APNs, Google FCM | Push notification delivery | Standard Contractual Clauses and/or the provider's certification |
| Google Gemini API | AI extraction from lineup screenshots | Google Cloud/AI terms and their transfer framework |
| PostHog EU Cloud | Analytics | Data is stored in the EU, but the vendor is US-headquartered, so support access or sub-processing from outside the EEA is possible |
Where a transfer to a third country occurs, it must rest on a valid Article 46 GDPR mechanism — an adequacy decision (including, where the recipient is certified, the EU-US Data Privacy Framework), or Standard Contractual Clauses with supplementary measures where needed.
You may request information about the safeguards applying to a specific transfer by writing to support@flintworks.hu.
10. How long we keep data
10.1 The honest general rule. For account-linked data, the default is: we keep it until you delete it in the App, until you delete your account, until you ask us to delete your account or that data, or until the purpose it was collected for ends — whichever happens first. Deleting your account from Profile → Settings → Delete Account happens immediately and cannot be undone, and takes the data linked to it with it — subject to the carve-outs in 10.5 and 10.6. Beyond that, our systems apply very few automatic deletion timers.
10.2 Specific points already fixed by how the Service works:
- •Raw location coordinates used for the map and for geofenced attendance checks are not stored as a location history. Only city-level strings and verification outcomes persist.
- •Passwords are only ever held as a bcrypt hash. Deleting the account deletes the hash.
- •Refresh tokens are rotated on each use, and are deleted on sign-out.
- •Push tokens are removed when they become invalid or when you sign out.
- •Analytics identity is reset on your device when you sign out; data already sent to PostHog is deleted on request or according to PostHog's project retention.
10.3 Still to be set. Most of the following retention periods are not yet finalised and are being decided. Where a point has since been settled, the table says so:
| Item | Status |
|---|---|
| Inactive accounts (deletion after a period of no sign-in) | Not set — no automatic deletion today |
| Ticket files and QR payloads after the event has passed | Not set — kept until you delete the ticket, or delete your account in the App |
| Ratings, reviews and other content after account deletion — delete or anonymise | Decided — deleted with the account; unlinkable aggregates may remain (see 10.6) |
| Community lineup screenshots after extraction | Not set — no automatic purge today; anonymised rather than deleted if you delete your account (see 10.6) |
| Server logs and notification delivery records | Not set |
| Analytics events and session replays in PostHog | Vendor default; not explicitly set by us |
10.4 Backups. Data removed from the live system may persist in backups until those backups expire on their normal cycle. It is not used for anything else in the meantime.
10.5 Files on disk. Uploaded ticket files and screenshots are stored on the server's file system. Deleting a database record does not delete the underlying file automatically today. When you delete your account, the database records go immediately, but the files behind them are not deleted with them: they stay on our server until we remove them manually, and we do not currently run that cleanup on a fixed schedule. [ENGINEERING — automate this.]
10.6 What account deletion removes, and what survives. Deleting your account deletes your user record, and with it the data attached to it — profile fields, sign-in provider links, sessions and refresh tokens, imported tickets, RSVPs, saved events, followed artists, and the ratings and reviews you wrote. Some things do not disappear, and you should know about them before you delete:
- •Community lineup submissions are kept with the link to you removed. If you submitted a lineup screenshot, the submission record and the extracted draft survive, with the reference to your account cleared, so the lineup data remains available for the event it belongs to.
- •Ticket transfer records are kept with the link to you removed. If you transferred a ticket to another user, or received one from them, their ticket keeps the transfer record with the reference to your account cleared.
- •Aggregates stay. Averages, counts and most-used tags already computed from your ratings remain, because in aggregated form they are no longer attributable to you.
- •Files on disk and backups lag. See 10.4 and 10.5.
- •Data held outside our database is not reached by the in-app control. Analytics events already sent to PostHog, records held by our email provider, server logs, and queued background jobs may still contain your identifiers until they age out or we remove them. Write to support@flintworks.hu if you want us to chase these down as well.
11. Profiling and automated decision-making
11.1 No automated decisions with legal effect. We do not make decisions about you that produce legal effects or similarly significantly affect you, based solely on automated processing, within the meaning of Article 22 GDPR. Nothing in the Service decides your access to money, employment, credit, or any legal entitlement.
11.2 But there is automated processing that shapes what you see. We do not claim otherwise:
- •Product analytics measures how you use the App at the level of an individual, identified profile (6.11).
- •Session replay records interaction sequences (6.11).
- •What you save, follow and RSVP to influences the ordering and highlighting of content in the App, and can trigger a prompt or notification (6.7, 6.8).
- •Aggregated signals from many users produce venue and crowd characterisations shown to everyone.
- •An AI model automatically extracts information from images you upload (6.9).
11.3 You can object to processing based on our legitimate interest, including the personalised ordering and the prompts, under Section 13.
12. Security
We use technical and organisational measures appropriate to the risk, and we describe them without overclaiming:
- •Passwords are stored only as bcrypt hashes, never in plain text or in a reversible form.
- •Authentication uses short-lived access tokens with longer-lived refresh tokens that rotate on every use and are invalidated on sign-out.
- •Traffic between the App and the production API is protected with TLS.
- •Access to production systems and the admin panel is limited to people who need it for an operational task, using individual credentials.
- •We select infrastructure providers on the basis of their reliability and their security commitments.
- •We monitor for problems and act on vulnerabilities we become aware of.
No system is perfectly secure. We do not guarantee that the Service cannot be compromised, and we ask you to use a strong, unique password and to keep your device secure.
If you discover a security problem in the Service, please report it to support@flintworks.hu. We will not pursue good-faith security researchers who report responsibly and do not access or exfiltrate other users' data.
13. Your rights
Under Articles 15–22 GDPR you have the right to:
| Right | What it means |
|---|---|
| Information and access (Art. 15) | Ask whether we process your data, what we process, and receive a copy |
| Rectification (Art. 16) | Have inaccurate data corrected and incomplete data completed |
| Erasure (Art. 17) | Have your data deleted where one of the grounds in Article 17 applies |
| Restriction (Art. 18) | Have processing limited while a dispute about accuracy or lawfulness is resolved |
| Portability (Art. 20) | Receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible |
| Objection (Art. 21) | Object at any time to processing based on our legitimate interest, on grounds relating to your particular situation. We stop unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims |
| Withdraw consent (Art. 7(3)) | Where processing rests on consent, withdraw it at any time. This does not affect the lawfulness of processing before withdrawal |
| Complain (Art. 77) and seek a judicial remedy (Arts. 78–79) | See Section 14 |
13.1 How to exercise them — the current process
Send an email to support@flintworks.hu from the email address registered to your account.
We must be honest about the current state of the product:
- •You can delete your account yourself in the App, from Profile → Settings → Delete Account. It takes one confirmation and works the same whether you created the account with an email address or through Apple, Google or Facebook. The deletion is immediate — there is no grace period and no way to undo it in the App. Read 10.6 first: some data survives with the link to you removed, and some data held outside our database is not reached this way. You can still ask us to delete your account by email if you prefer.
- •There is no in-app data export today. A portability copy is produced manually on an emailed request.
- •Other things you *can* do yourself in the App, besides deleting the account itself: edit profile fields, turn public attendance on or off, delete a ticket from your wallet, un-save and un-follow, and sign out.
- •Notification permission and location permission can be withdrawn in your device settings, which does take effect immediately.
13.2 Deadlines
We aim to respond within 15 days of receiving your request. Where a request is complex or you have made several, we may need longer, and in any case we will respond within 30 days, telling you at that point if a further extension is needed under Article 12(3) GDPR and why.
13.3 Identity checks
We may ask you for information reasonably needed to confirm your identity before acting on a request — normally that the request comes from the email address on the account. We will not ask you for identity documents, your mother's name, or any other data we do not already hold, unless we have a genuine and documented doubt about who is asking.
13.4 Limits
Erasure may be refused or partially refused where we must keep data to comply with a legal obligation, or to establish, exercise or defend a legal claim. Where content has already been aggregated into statistics that can no longer be linked to you, those statistics may remain. We will tell you if we rely on any of these grounds, and why.
14. Complaints
14.1 To us first, if you are willing. Write to support@flintworks.hu, or by post to Horváth Dávid E.V., 7631 Pécs, Kiss János utca 36., Hungary. Tell us what happened, when, and what you would like us to do. We will investigate and give you a reasoned written answer within 30 days; if the investigation genuinely needs longer, we will tell you and answer within three months at the latest. Your complaint data is used only to handle the complaint.
14.2 To the supervisory authority. You can lodge a complaint with the Hungarian supervisory authority at any time, whether or not you contacted us first:
If you live or work in another EEA country, or the alleged infringement happened there, you may complain to that country's supervisory authority instead.
14.3 To the courts. You may also bring a claim before the courts. In Hungary, a data protection action may be brought before the regional court (*törvényszék*) with jurisdiction over our seat or over your place of residence, at your choice.
15. Personal data breaches
If a personal data breach occurs, we record it, begin investigating without delay, and involve our hosting and other providers where their systems are affected. We document what happened and when, what data and how many people were affected, the likely consequences, and the measures taken.
Where the breach is likely to result in a risk to the rights and freedoms of natural persons, we notify NAIH within 72 hours of becoming aware of it, in line with Article 33 GDPR. Where the breach is likely to result in a high risk to you, we will also inform you directly without undue delay, in line with Article 34.
If you become aware of a breach or a security weakness affecting the Service, please tell us immediately at support@flintworks.hu.
16. Children
The Service is for adults aged 18 and over, because it concerns nightlife venues and events that are generally restricted to adults. We do not knowingly collect personal data from anyone under 18. There is currently no age-verification step beyond the confirmation you give when you accept the Terms.
If you believe a person under 18 has created an account, contact support@flintworks.hu and we will investigate and delete the account and its data where the report is confirmed.
17. Changes to this Policy
We may update this Policy — for example when we add a feature, change a provider, or when the law changes. The current version is always published in the App and made available in the App, with the "Effective date" and "Last updated" fields at the top showing when it last changed.
Where a change is material — a new purpose, a new category of recipient, a new transfer, or a change of legal basis — we will give notice in advance in the App or by email to the address on your account, normally at least 15 days before it takes effect, and, where the change requires your consent, we will ask for it.
18. Contact
Horváth Dávid E.V. 7631 Pécs, Kiss János utca 36., Hungary Support, privacy, data protection rights and incidents: support@flintworks.hu
Terms of Service: Terms of Service This Privacy Policy: available in the App
*VIBE and Flintworks are brand names of Horváth Dávid E.V. No data protection officer has been appointed — see Section 1.3.*