This Privacy Policy explains how Guestlist handles personal data when you buy a ticket, host an event or otherwise use the Guestlist platform (the "Platform"). We collect only what we need to sell and deliver tickets, and we never sell your data.
1. Who is responsible
The controller of your personal data is Webhook, a sole proprietorship (eenmanszaak) established in the Netherlands, which operates Guestlist.
- Address: Zoetendaal 14, 4761 TN Zevenbergen, the Netherlands
- Chamber of Commerce (KvK): 42005752
- Privacy questions and requests: hello@guestlist.ee
Hosts decide who may attend their events and receive the guest list for their own event. For what a Host does with that list outside the Platform, the Host is responsible.
2. What data we collect
When you buy a ticket
- your name;
- your email address;
- your phone number;
- the tickets you purchased: the event, ticket type, price, ticket codes and whether and when each ticket was checked in at the door.
Your card details are entered directly with Stripe. Guestlist never sees or stores your full card number.
When you host an event
- your name, email address and password (stored in hashed form only);
- your bank account number (IBAN) for payouts, stored encrypted;
- the events and ticket types you create, your sales and your payouts.
When you visit the Platform
Like any website, our servers process technical data such as your IP address and browser type, to deliver pages, keep the Platform secure and prevent abuse such as repeated login attempts.
If you accept analytics cookies, Google Analytics records which of our public pages you visit, how you got there, and general information about your device, browser and approximate location (country or city). It does not see the pages for checkout, your tickets, the door scanner or Host accounts. We cannot identify you from this data, and we do not use it for advertising.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing your order and payment | Performance of a contract (art. 6(1)(b)) |
| Sending your order confirmation and delivering your tickets by email | Performance of a contract (art. 6(1)(b)) |
| Checking tickets at the door and showing the Host their guest list | Performance of a contract (art. 6(1)(b)) |
| Running Host accounts and paying out ticket income | Performance of a contract (art. 6(1)(b)) |
| Keeping financial records | Legal obligation (art. 6(1)(c)) |
| Security and fraud prevention | Legitimate interest (art. 6(1)(f)) |
| Measuring how visitors use our public pages, if you accept analytics cookies | Consent (art. 6(1)(a)) |
We do not use your data for advertising, and we do not send marketing emails.
4. Who we share it with
We share personal data only with the service providers we need to run the Platform, under data processing agreements:
- Stripe processes payments and payouts. Stripe is an independent controller for the payment data it handles; see stripe.com/privacy.
- Resend delivers our emails, such as order confirmations and tickets.
- Hetzner hosts our servers and database.
- Cloudflare checks that people choosing tickets are not automated scripts (Cloudflare Turnstile), so bots cannot hold every ticket of an event. It processes technical data such as your IP address and browser details for this check, and does not use cookies for it.
- Google provides Google Analytics, only if you accept analytics cookies. Google signals and ad personalisation are switched off.
The Host of an event you buy a ticket for can see your name, email address, phone number, ticket type and check-in status, so they can manage their guest list and contact you about the event.
We may also disclose data when the law requires us to.
5. Where your data is stored
Our servers and database are hosted by Hetzner within the European Union. Some of our service providers, such as Stripe, Resend, Cloudflare and Google, may process data outside the EU. Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. How long we keep it
- Ticket and order data: for as long as the Host's event exists on the Platform, and in any case as long as needed for the event and any refunds or disputes afterwards.
- Host account data: until you delete your account.
- Financial records, such as payments and payouts: 7 years, as required by Dutch tax law.
- Analytics data: 14 months in Google Analytics, after which Google deletes it.
7. Security
All traffic to the Platform is encrypted. Passwords are hashed, bank details are encrypted, and Hosts can protect their account with two-factor authentication or a passkey. Door scanners are protected with a secret link and a PIN.
8. Cookies
We use cookies that are strictly necessary for the Platform to work: a session cookie to keep you logged in and protect forms, and a cookie that keeps an unlocked door scanner unlocked on that device. These do not need your consent.
On our public pages we ask whether you accept analytics cookies. Only if you accept do we load Google Analytics, which sets the _ga cookies to count visits and tell repeat visitors apart, for up to 2 years. Your browser stores your choice (not in a cookie). You can change it at any time: with "Cookie settings" at the bottom of our pages, in the account menu if you host events, or right here. Withdrawing consent removes the analytics cookies. We do not use advertising cookies.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted ("right to be forgotten");
- restrict or object to how we use your data;
- receive your data in a portable format.
To use any of these rights, including deleting your data, email hello@guestlist.ee from the address you used with us. We will respond within one month. We may need to keep some data where the law requires it, such as financial records.
Hosts can also delete their account themselves in their settings.
If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own EU country.
10. Children
Host accounts are for people aged 16 and over. Guests under 16 should only buy tickets with the permission of a parent or guardian.
11. Changes
We may update this Privacy Policy. The date at the top shows when it last changed. We will email Hosts about significant changes.