Privacy Policy
How Culpass acts as data controller or processor, what data it processes depending on your profile and what rights you can exercise.
Last updated:
This is a courtesy translation of the Spanish original. In case of any discrepancy, the Spanish version prevails.
1. Data Controller
In compliance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR/RGPD), and Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD), CULPASS, S.L. informs you of the following:
- Company name: CULPASS, S.L.
- NIF: B67902593
- Registered address: C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid)
- Email: sales@culpass.com
- Website: www.culpass.com
For any query regarding data protection you may contact sales@culpass.com with the subject “DATA PROTECTION”.
2. Who's Who
For the purposes of this Privacy Policy, the following definitions are used:
- Visitor: a natural person who browses www.culpass.com without needing to be registered.
- User / Buyer: a natural person who buys tickets or registers for an event through www.culpass.com, with or without a user account.
- Organiser: a natural or legal person who uses CULPASS services to create, manage and sell tickets to their events through the platform.
- Provider: a company, self-employed professional or individual who provides venues, products or services for holding events. Module under development.
3. How Culpass acts with your data: Data Controller and Data Processor
CULPASS's business model involves two distinct roles in terms of data protection.
CULPASS acts as Data Controller when it determines the purposes and means of the processing. This occurs when it handles data of Visitors and Organisers within the framework of its own relationship with them: registration on the platform, account management, invoicing, its own communications, web analytics and similar.
CULPASS acts as Data Processor when it processes data of Users who buy tickets on behalf of the Organiser and following its instructions. In that case, the Organiser acts as Data Controller for the data it has requested from Users through the event forms.
- If CULPASS processes your data as Data Controller, contact CULPASS to exercise your rights.
- If CULPASS processes your data as Data Processor on behalf of the Organiser, you must address your requests to the Organiser. CULPASS will provide the Organiser's contact details if you need them.
4. What data we process and how, depending on who you are
4.1. Visitors
When you browse www.culpass.com, CULPASS processes the following data as Data Controller:
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Technical browsing data: IP address, browser type, pages visited, date and time of access. | Platform security, usage analysis, service improvement and fraud detection. | Legitimate interest of CULPASS (art. 6.1.f GDPR). | 12 months. |
| Web analytics data collected through Google Analytics 4 (property G-4B0VSG67R1): browsing behaviour, page views, conversions and pseudonymised audience segments. | Analysis of website performance, improvement of user experience and measurement of conversions. | Consent (art. 6.1.a GDPR). Only active if the user accepts analytics cookies. | Maximum 14 months. Aggregated anonymised data, indefinitely. |
| Digital advertising and remarketing data collected through Google Ads. | Conversion tracking, remarketing and ad personalisation. | Consent (art. 6.1.a GDPR). Only active if the user accepts advertising cookies. | Generally 90 days for remarketing lists. |
| Data from cookies and similar tracking technologies. | As set out in the CULPASS Cookie Policy. | Consent for non-essential cookies. Technical cookies do not require consent. | Depends on each cookie. |
| Data provided through the contact form: name, email and message. | Handling enquiries and requests for information. | Consent (art. 6.1.a GDPR). | Until the enquiry is resolved plus 1 additional year. |
4.2. Users / Ticket Buyers
When a user buys tickets or registers for an event through CULPASS, two types of processing take place.
4.2.1. Processing by CULPASS as Data Controller
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Account registration data: first name, surname, email address and encrypted password. | Creation and management of the user account on the platform. | Performance of a contract / pre-contractual relationship (art. 6.1.b GDPR). | For the duration of the account and 5 years after its closure. |
| Purchase data: name, email, tickets purchased, amount and payment method. CULPASS does not store full card details; they are handled directly by Stripe. | Management and processing of the order, issuing of the ticket, purchase confirmation and after-sales support. | Performance of a contract (art. 6.1.b GDPR). | 5 years from the date the event is held. |
| Billing data: name or company name, NIF and address, when an invoice is requested. | Issuing of invoices and compliance with accounting and tax obligations. | Legal obligation (art. 6.1.c GDPR). | 6 years. |
| Purchase and event attendance history. | Management of the relationship with the user and platform usage statistics. | Performance of a contract and legitimate interest (art. 6.1.b and 6.1.f GDPR). | 5 years from each event. |
| Email address, if you consent to subscribe to the CULPASS newsletter. | Sending of commercial communications and CULPASS news. | Consent (art. 6.1.a GDPR). | Until consent is withdrawn. |
4.2.2. Processing by CULPASS as the Organiser's Data Processor
When you buy a ticket or register for an event, the Organiser receives your data as Data Controller. CULPASS acts solely as Data Processor, handling this data on behalf of and following the instructions of the Organiser.
The data that the Organiser receives and processes under its own responsibility is, as a minimum, that which the user provides during the purchase process: name and email address. The Organiser may configure custom forms to collect additional information needed for attendance, for example dietary restrictions, size or identity document number. We recommend consulting the privacy policy of the Organiser of each event.
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Purchase process data and additional data requested by the Organiser through the event forms. | Management of access to the event, attendee list and event-related communications. | The Organiser is the Data Controller. CULPASS acts as Data Processor under art. 28 GDPR. | 5 years from the date the event is held, after which CULPASS deletes or anonymises the data. |
4.2.3. Consent to communications from the Organiser and its collaborators
During the purchase process you will be offered the possibility of expressly consenting, by means of an optional, unticked box, to the event Organiser and its collaborators or partners sending you commercial communications.
- The Organiser is informed that the user has given consent.
- The Organiser is the Data Controller for this purpose. CULPASS acts only as a technical channel for collecting and transmitting the consent.
- The Organiser's collaborators or partners are third parties designated by the Organiser itself. To find out their identity, consult the Organiser's privacy policy.
- You may withdraw this consent at any time by contacting the Organiser or CULPASS.
Refusing to give consent will not prevent the purchase of a ticket.
4.3. Organisers
CULPASS processes Organisers' data as Data Controller, within the framework of the contractual relationship established in the specific terms and conditions for Organisers:
| Data / category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Registration and profile data: name or company name, NIF/CIF, public profile name, email address, telephone number and bank details for settlement of sales. | Registration and management of the Organiser account, identity verification and settlement of ticket sales revenue. | Performance of a contract (art. 6.1.b GDPR). | Term of the contract and 5 years after termination. |
| Tax and billing data: NIF/CIF, billing data and record of commissions. | Invoicing of service commissions and compliance with accounting and tax obligations and anti-money laundering rules. | Legal obligation (art. 6.1.c GDPR). | 6 years / 4 years depending on the applicable regulations. |
| Platform activity data: events created, sales generated and attendance statistics. | Provision of the platform service, performance analysis and service improvement. | Performance of a contract and legitimate interest (art. 6.1.b and 6.1.f GDPR). | 5 years from termination of the contract. |
| Communications with CULPASS: emails and support requests. | Management of the contractual relationship, customer service and resolution of incidents. | Performance of a contract (art. 6.1.b GDPR). | 5 years from termination of the contract. |
The Organiser, as Data Controller of the data of Users who buy its tickets, acts independently of CULPASS for those purposes.
4.4. Providers
CULPASS is developing a module for event service providers. Once it comes into operation, this Privacy Policy will be updated to include the processing of Providers' data.
4.5. Google Calendar integration (Google user data)
Providers may voluntarily connect their Google Calendar account to their CULPASS calendar. The connection only takes place when the Provider clicks «Connect Google Calendar» and grants the permissions on Google's consent screen, where each one can be accepted or declined separately. This section explains how CULPASS accesses, uses, stores and shares the data obtained through the Google APIs. CULPASS acts as Data Controller for this data.
| Permission requested | What CULPASS uses it for |
|---|---|
| View the list of your calendars (calendar.calendarlist.readonly). | Showing you your calendars so you can choose which ones you want to synchronise. |
| View the events of your calendars (calendar.events.readonly). | Importing the events of the calendars you have chosen and displaying them in your CULPASS calendar. |
| Create calendars owned by the application and manage their events (calendar.app.created). | Creating in your account a separate calendar called «Culpass Events» and keeping in it a copy of your CULPASS events. CULPASS cannot modify or delete any other calendar of yours with this permission. |
| Identifier and email address of your Google account (openid, email). | Knowing which Google account you have connected and showing you its address in the connection panel. |
4.5.1. Data we access
- Identifier and email address of the connected Google account, and the permissions you have granted.
- From the calendars you select: name, time zone, colour and whether it is your primary calendar.
- From the events of those calendars, within a period ranging from three months back to eighteen months ahead: title, start and end date and time, whether it is an all-day event, time zone and technical identifiers of the event. If you activate «Busy only» mode, CULPASS does not request or store the title and only knows the busy time slots.
- To discard events that do not take up your time, CULPASS checks at the time of import whether the event is cancelled, marked as «available» or declined by you. This data is not stored.
- An access token (refresh token) issued by Google, necessary to synchronise without asking you to log in each time.
CULPASS does not access the description, location, guest list, attachments or video call links of your Google events, nor any other service of your Google account.
4.5.2. How we use this data
Google data is used exclusively to provide you with the calendar functionality you have activated: showing your Google Calendar commitments alongside your CULPASS bookings, so that you can see your real availability and avoid overlaps, and keeping the copy of your CULPASS events in your Google Calendar up to date. Imported events are only visible to you in your own panel; they are not shown to companies, organisers or other users.
CULPASS does not:
- sell or transfer Google data to third parties;
- use Google data for advertising, remarketing, commercial profiling or market analysis;
- use Google data to develop, improve or train artificial intelligence or machine learning models;
- allow CULPASS personnel to read your Google data, unless you expressly authorise it to resolve an incident, it is necessary for security reasons or it is required by law.
4.5.3. What we write to your Google Calendar
If you grant the corresponding permission, CULPASS creates in your account a separate calendar called «Culpass Events» and copies your CULPASS events into it. Each copy contains the name of the event, its date and time, its status, the venue indicated in the proposal, the services you provide at that event and a link to the proposal in CULPASS. The client's name is never included. CULPASS does not modify or delete any other calendar or event in your account.
You can delete that calendar from Google Calendar at any time; CULPASS will respect that decision and will not create it again unless you request it from your panel.
4.5.4. Storage, retention and deletion
The data is stored on CULPASS servers hosted by Ionos Cloud, S.L. in the European Economic Area (EEA) and is always transmitted encrypted via HTTPS/TLS. The access token is stored with restricted access and is never recorded in logs. On each synchronisation, the imported events are replaced with the current ones from Google, so that an event deleted in Google also disappears from CULPASS.
You can withdraw access at any time by clicking «Disconnect» in your CULPASS panel. When you do so, CULPASS deletes the «Culpass Events» calendar from your Google account, revokes the token with Google and permanently deletes from its systems the connection and all imported events. You can also revoke access from your Google account settings (myaccount.google.com/permissions); in that case CULPASS deletes the connection and the imported events as soon as it detects the revocation, and you can delete the «Culpass Events» calendar yourself from Google Calendar.
4.5.5. Who we share this data with
CULPASS does not share the data obtained from Google with third parties. Only the following are involved: Google, where your calendars reside and to which the copies described in section 4.5.3 are sent at your instruction, and the hosting provider Ionos Cloud, S.L. as Data Processor. The data would only be disclosed to public authorities in the cases set out in section 6.3.
4.5.6. Compliance with Google's user data policy
CULPASS's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Culpass's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The legal basis for this processing is the performance of the contract for the use of the platform at the request of the Provider (art. 6.1.b GDPR), and it relies on the permission you expressly grant on Google's screen.
5. Post-event rating request
Once the event has been held, CULPASS may send you, as the Organiser's Data Processor and with its authorisation, a single email requesting a rating of your experience at the event and of the purchase process on the platform.
You will not receive more than one communication of this type per event. You may object by sending an email to sales@culpass.com .
6. Recipients of your data and international transfers
6.1. Culpass's data processors
- Hosting provider: Ionos Cloud, S.L. Web hosting provider. A data processing agreement is in place in accordance with article 28 GDPR.
- Payment processor: Stripe Payments Europe, Ltd. Processing of card payments, Apple Pay, Google Pay and bank transfer. Stripe does not store full card details on CULPASS systems. More information: stripe.com/es/privacy.
- Web analytics and digital advertising: Google Ireland Ltd. Provider of Google Analytics 4, property G-4B0VSG67R1, and Google Ads. The processing is carried out in accordance with Google's data processing terms and the safeguards of the EU-US Data Privacy Framework mechanism. More information: business.safety.google/privacy/.
6.2. The Organiser as a recipient of Users' data
The Organiser of each event receives data of Users who buy tickets for its events in its capacity as Data Controller. This disclosure is covered by the nature of CULPASS's intermediation service and by the contractual relationship of the ticket purchase.
6.3. Public authorities
CULPASS may disclose data to Judges, Courts, State Security Forces and Corps, the Spanish State Tax Administration Agency (Agencia Estatal de Administración Tributaria) or other competent authorities when there is a legal obligation or a court order.
6.4. International data transfers
As a general rule, CULPASS does not transfer personal data to countries outside the European Economic Area. Data hosting is carried out through Ionos Cloud, S.L., with servers in the EEA.
Google Ireland Ltd. may transmit data to servers in the United States within the framework of the Google Analytics 4 and Google Ads services. These transfers are covered by Standard Contractual Clauses approved by the European Commission and by the EU-US Data Privacy Framework mechanism. Stripe Payments Europe, Ltd. likewise has equivalent mechanisms in place.
You may request a copy of the applicable transfer safeguards by sending an email to sales@culpass.com .
7. Your data protection rights
As a data subject, you may exercise the following rights regarding the processing of your data:
- Access: to know what personal data CULPASS processes, for what purpose and where it comes from.
- Rectification: to request correction of inaccurate or incomplete data.
- Erasure: to request deletion of data when it is no longer necessary for the purpose for which it was collected.
- Restriction of processing: to request suspension of processing in certain circumstances.
- Portability: to receive data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
- Objection: to object to processing when it is based on CULPASS's legitimate interest.
- Withdrawal of consent: to withdraw consent given at any time.
- Not to be subject to automated decisions: not to be subject to automated individual decisions with legal or similarly significant effects.
How to exercise your rights: send a letter to CULPASS, S.L., C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid), or an email to sales@culpass.com , with the subject “DATA PROTECTION - EXERCISE OF RIGHTS”, attaching a copy of an identity document.
If you consider that the processing of your data infringes the regulations in force, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
When your data is processed by the Organiser as Data Controller, you must address your request directly to the Organiser. CULPASS will provide its contact details if you request them.
8. Retention periods for your data
| Data category | Retention period |
|---|---|
| Browsing data and web logs. | 12 months. |
| Pseudonymised Google Analytics 4 data. | Maximum 14 months. Aggregated anonymised data, indefinitely. |
| Advertising / remarketing data. | Generally 90 days. |
| User account registration. | Duration of the account and 5 years after its closure. |
| Ticket purchase data. | 5 years from the date the event is held. |
| Billing data. | 6 years. |
| Contractual data of Organisers. | Term of the contract and 5 years after termination. |
| Tax and accounting data of Organisers. | 6 years / 4 years. |
| CULPASS newsletter consent. | Until consent is withdrawn. |
| Consent to communications from the Organiser and collaborators. | Until revoked, managed by the Organiser. |
| Enquiries and communications with CULPASS. | 1 year after the enquiry is resolved. |
| Google Calendar connection: access token, Google account and selected calendars. | Until the Provider disconnects Google Calendar or revokes access from their Google account. |
| Events imported from Google Calendar. | For as long as the connection is maintained; they are replaced on each synchronisation and deleted on disconnection. |
9. Summary of legal bases for processing
- Performance of a contract (art. 6.1.b GDPR): management of ticket purchases, issuing of tickets, service communications, management of Organiser accounts and Google Calendar integration requested by the Provider.
- Consent (art. 6.1.a GDPR): CULPASS newsletter, analytics cookies with Google Analytics 4, advertising cookies with Google Ads and consent to communications from the Organiser.
- Legal obligation (art. 6.1.c GDPR): retention of invoices, accounting documentation, response to requests from tax authorities and compliance with anti-money laundering regulations.
- Legitimate interest of CULPASS (art. 6.1.f GDPR): platform security, fraud detection and prevention, internal statistical analysis, strictly necessary cookies and retention of records for the defence of claims.
10. Cookies and consent management (Consent Mode)
CULPASS uses its own and third-party cookies on the website. For full information on cookies, their purpose, duration and management, consult the Cookie Policy available in the footer of www.culpass.com.
10.1. Blocking prior to consent
www.culpass.com manages the flow of data to analytics and advertising tools according to the user's consent, obtained through a cookie banner with prior blocking. Until the user accepts the Analytics or Advertising categories, the parameters analytics_storage, ad_storage, ad_user_data and ad_personalization remain in a «denied» state.
While these parameters are denied, Google tags are not loaded, so no cookie from these tools is installed and the user is not identified.
This configuration complies with article 22.2 of Law 34/2002 on Information Society Services and Electronic Commerce (LSSICE) and article 6 of the GDPR.
10.2. Record of consent
CULPASS records the categories of cookies accepted by the user, the date of acceptance and the version of the banner in force, so that it can demonstrate consent before the Spanish Data Protection Agency in accordance with the principle of accountability (proactive responsibility).
The user may withdraw or modify their consent to cookies at any time by accessing the cookie preferences panel available in the footer of the website.
11. Social media
CULPASS may maintain profiles on social media. The processing of data of people who interact with those profiles will be governed by this Privacy Policy with regard to CULPASS's activity, and by the terms of use and privacy policies of the corresponding social network.
CULPASS has no control over the privacy practices of third-party platforms.
12. Security measures
CULPASS has adopted the technical and organisational measures necessary to guarantee the security of personal data, including encryption in transit via HTTPS/TLS, role-based access control, regular backups and security incident response procedures.
If a security breach occurs that may entail a risk to your rights and freedoms, CULPASS will notify the AEPD within the period established by the GDPR and, where appropriate, will notify you directly.
13. International buyers
The CULPASS platform is available for the purchase of tickets by people from any country. For the purposes of applicable legislation:
- The GDPR applies to the processing of data of people who are in the EU.
- For buyers resident in the EU, Regulation (EU) 1215/2012 guarantees the possibility of bringing proceedings before the courts of the Member State of residence.
- For buyers resident outside the EU, the parties submit to the jurisdiction of the Courts and Tribunals of Madrid, Spain.
14. Language
The language applicable to this Privacy Policy is Spanish. In the event of any discrepancy between versions in different languages, the Spanish version shall prevail.
15. Changes to this Privacy Policy
CULPASS reserves the right to modify this Privacy Policy to adapt it to changes in legislation, case law or the processing carried out. When the changes are significant, CULPASS will inform you through the usual means of communication.
The date of the last update appears in the header of the document.
16. Contact
For any question about this Privacy Policy or about the processing of your data:
- Email: sales@culpass.com (subject: “DATA PROTECTION”)
- Postal address: C/ Teresa Berganza, 76, 28200 San Lorenzo de El Escorial (Madrid)