Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how Eventopia (operated by Laraben BV) collects, uses, and protects your personal data when you use our event-management platform at eventopia.be. This policy is available in English, Dutch, French and German.

1. Data Controller

Laraben BV
Zandvoordedorpstraat 149
8400 Oostende
Belgium
KBO / BTW: BE 0756.758.069
Email: [email protected]

Laraben BV is the data controller for all personal data processed through the Eventopia platform, except where an organizer acts as an independent controller for their own event (e.g. attendee lists, private event communications, and the organizer's own advertising tools and mailing list described in sections 6 and 8).

2. What Data We Collect

  • Account data: name, email address, password hash, phone number (optional) and, if you turn on two-factor authentication, its encrypted secret and recovery codes.
  • Profile data: organization, role (organizer, customer, provider, venue, agency), profile picture.
  • Payment data: billing address, invoice details, payment method metadata. Card numbers are never stored on our servers — you enter them on the payment page of our payment provider (Mollie, or Stripe when it is used), which processes them (see section 6).
  • Event attendance data: tickets purchased, entry/scan timestamps, check-in status.
  • Cashless wallet / RFID data: top-up transactions, bar purchases, refund history, wristband token identifiers.
  • Communication data: messages exchanged between organizers, artists, venues, and customers through in-platform messaging.
  • Technical data: IP address, browser type, device identifiers, pages visited, referrer. Your IP address is also stored in our security logs whenever you sign in or out, and whenever a sign-in to your account fails (see section 5).
  • Cookies: see section 8.

3. Legal Basis for Processing

  • Contract (art. 6.1.b GDPR): creating your account, processing ticket orders, delivering tickets, running cashless payments at events.
  • Legal obligation (art. 6.1.c): invoicing, VAT compliance, anti-fraud checks, retention of financial records.
  • Consent (art. 6.1.a): marketing communications, non-essential cookies (the event-page statistics and the organizer's marketing tools, section 8), passing your purchase to an organizer's advertising tools, and adding you to an organizer's mailing list (section 6). You may withdraw consent at any time.
  • Legitimate interest (art. 6.1.f): platform security, abuse and fraud prevention, the activity log and support access described in section 5, service improvement.

4. Retention Periods

  • Account data: kept while your account is active. Deleted within 90 days after account closure, unless retention is required for legal reasons. Orders and invoices are kept for the period below, also after an account is deleted.
  • Order, invoice and payment records: 7 years (Belgian accounting law).
  • Ticket and scan logs: 24 months after the event.
  • RFID / wallet transactions: 24 months (for refund support and dispute handling).
  • Marketing consent data: until you unsubscribe, plus 24 months for proof of consent.
  • Server logs, security events and the activity log (including IP addresses): 12 months. Activity-log entries are then deleted automatically (see section 5).
  • Event-page statistics (visits with IP address and browser type; scrolling, clicks and time on the page): 12 months, then deleted automatically.

5. Activity Log & Support Access

To keep accounts and payments secure and to be able to investigate problems, Eventopia keeps an activity log: a record of who did what on the platform, and when. It contains:

  • Sign-ins: every sign-in, sign-out and failed sign-in attempt, with the IP address it came from. For a failed attempt with an email address that has no account, we keep that address only in masked and hashed form.
  • Changes to accounts, teams, events, ticket types, discount codes, orders, refunds, bar items, venues, customer accounts and wallet settings: which fields changed, with the old and the new value. Wallet balances and the contact details on orders are not part of it.
  • Actions such as publishing an event, refunds, transferring or resending tickets, connecting a Mollie or Stripe account, changes to team members and fee settings, support access to an account (see below), kiosk top-ups, and platform maintenance and updates.

Passwords, two-factor secrets, access tokens, API keys, card data and ticket barcodes are never recorded. Anything that looks like a secret is replaced by "[redacted]" before it is saved.

  • Why, and on what basis: security, fraud prevention and support. We rely on our legitimate interest (art. 6.1.f GDPR) in detecting and investigating account misuse and fraud, and in being able to establish what happened to an order, a refund or an account. You can object to this processing (section 7).
  • Who can see it: only Eventopia's platform administrators (Laraben BV). Organizers, team members and customers have no access to the activity log.
  • How long: entries are deleted automatically after 12 months.
  • If you delete your account: existing entries are kept until their 12 months have passed, because they may be needed to investigate misuse of that account, but they are pseudonymised: your name, email address and IP address are replaced by "[deleted]". What happened remains visible; who did it does not.

Support access to your account

To solve a problem or answer a support request, Eventopia's platform administrators can open your account and see and use the platform as you do. Every session is recorded: which administrator, which account, when the session started and ended, and the administrator's IP address and browser. Everything done during the session is marked in the activity log as done by an administrator. A session ends automatically after a limited time (currently 60 minutes).

During such a session the administrator cannot change your password, email address or two-factor settings, delete your account, invite or remove team members, or connect or manage a Mollie or Stripe account. Platform administrators' own accounts cannot be opened this way.

You do not receive an automatic notification when support opens your account. You can ask us at [email protected] whether and when this happened.

6. Third-Party Processors

We share personal data only with the service providers below. Those that process data on our behalf are bound by a data-processing agreement:

  • Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, the Netherlands) — our payment provider: processes the online payments on Eventopia, for tickets, cashless wallet top-ups, bar and table orders, and booking payments. Laraben BV collects the payment through Mollie Connect, and Mollie pays the share of the organizer (or, for a booking, of the artist, agency or supplier) out to their connected Mollie account. Mollie receives the data needed for the payment (for example your email address, your payment details and the amount) and, from those who connect a Mollie account, the identity and bank details Mollie requires. For fraud prevention and its own legal obligations, Mollie acts as an independent controller. Mollie privacy policy
  • Stripe Payments Europe, Ltd. (Ireland) — alternative payment provider, when used: the platform administrator can have payments processed by Stripe instead of Mollie. Stripe then processes the card and online payments; Laraben BV collects the payment through Stripe, and Stripe pays the organizer's share out to the organizer through Stripe Connect. Stripe receives the data needed for the payment (for example your email address, your payment details and the amount) and, from organizers who connect a Stripe account, the identity and bank details Stripe requires. For fraud prevention and its own legal obligations, Stripe acts as an independent controller. Stripe privacy policy
  • OVH SAS (France) — hosting of our servers and database. OVHcloud privacy policy
  • Cloudflare, Inc. (USA) — CDN, DNS and security / DDoS protection. All traffic to eventopia.be passes through Cloudflare, including your IP address. Cloudflare privacy policy
  • Postmark (ActiveCampaign, LLC, USA) — sending transactional emails such as tickets, order confirmations and password resets. Postmark receives your name, email address and the content of those emails. Postmark privacy policy

We do not sell personal data. Cloudflare and Postmark are US companies and may process personal data in the United States. Those transfers rely on the EU-US Data Privacy Framework, for a provider certified under it, and/or on the European Commission's Standard Contractual Clauses. Mollie and Stripe may also transfer data outside the EEA, under the safeguards described in their privacy policies.

On behalf of the organizer, with your consent

An organizer can connect their own marketing tools to their event. For those tools, and for the data they receive, the organizer is an independent controller. The companies below receive data only in these cases, and only with your consent:

  • Meta Platforms Ireland Ltd. (Ireland) — the organizer's Meta Pixel on their event page, and the purchase sent through the Meta Conversions API (section 8), only if you allowed marketing cookies.
  • Google Ireland Ltd. (Ireland) — the organizer's Google Analytics 4 on their event page (section 8), only if you allowed marketing cookies.
  • TikTok Technology Ltd. (Ireland) — the organizer's TikTok Pixel on their event page (section 8), only if you allowed marketing cookies.
  • Mailchimp (The Rocket Science Group LLC, an Intuit company, USA) — your name and email address are added to the organizer's mailing list only if you tick the box for the organizer's newsletter ("Keep me posted about news and events from …") at checkout. You can unsubscribe with the link in the organizer's emails.

Without that consent, none of these companies receives anything about you from Eventopia. These companies may process data outside the EEA, under the safeguards described in their own privacy policies. For data already in an organizer's tools, you can also contact the organizer.

7. Your Rights Under GDPR

You have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erasure ("right to be forgotten") — subject to legal retention obligations.
  • Restriction of processing in certain circumstances.
  • Data portability — receive your data in a structured, machine-readable format.
  • Object to processing based on legitimate interest or for direct marketing.
  • Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email [email protected]. We respond within 30 days.

8. Cookie Policy

This section lists every cookie and every item of browser storage that eventopia.be uses, what it is for and how long it stays. Our own pages use no advertising cookies. Only on an event's page, and only if you allow marketing cookies, can the advertising tools of that event's organizer be loaded (see "Marketing" below).

Strictly necessary

These are needed for the site to work and to keep it secure, so they do not need your consent and cannot be switched off. We use them only for that purpose.

  • eventopia-session — keeps you signed in and remembers your cart and your checkout during your visit. Expires 120 minutes after your last activity.
  • XSRF-TOKEN — protects forms against cross-site request forgery (CSRF). Expires 120 minutes after your last activity.
  • remember_web_… and remember_customer_… — only if you tick "Remember me" when signing in: keeps you signed in on this device. Stays for 400 days or until you sign out.
  • laravel_maintenance — only for Eventopia platform administrators: lets them reach the site while it is closed for maintenance. Expires after 12 hours.
  • cookie_consent — remembers which of the optional categories below you allowed (statistics, marketing), so the banner does not ask again on every page. Stays for 6 months.
  • __cf_bm and, when a security check is shown, cf_clearance — set by Cloudflare, our security and CDN provider (section 6), to tell people from bots and to block attacks. __cf_bm expires after 30 minutes, cf_clearance after the period set in our Cloudflare configuration (30 minutes by default). When a waiting room is placed in front of a very busy ticket sale, Cloudflare also sets __cfwaitingroom to keep your place in the queue, for as long as the queue lasts.
  • Browser storage (not cookies: this stays on your device and is not sent to us automatically): flux.appearance keeps the display theme (until you clear it); last_portal remembers which portal you last opened from the account menu (until you clear it); retry_order lets you retry a failed payment (deleted when you close the tab). On devices used by event staff, the ticket scanner keeps the ticket list and unsent scans (eventconnect-scanner) and a device identifier (scanner_device_id), so tickets can be checked without a connection. The administration panels keep display settings, such as a collapsed sidebar, in the same way.

Only with your consent

These are only used for the category you allow in the cookie banner: with "Accept all", or with the switch for that category under "Choose". Both switches are off until you turn them on. If you reject, or do not answer, nothing below is set and nothing is measured.

Statistics

  • Event-page statistics — on event pages, a script of our own records your visits, how far you scroll, how long you stay and which buttons you click. Each record is linked to your session cookie (and to your account if you are signed in) and stored on our own servers together with your IP address and browser type. Organizers see the results for their own events as statistics. Nothing is sent to other companies, and the script stores nothing in your browser.
  • referral_code (30 days) and utm_params (7 days) — remember which referral or campaign link brought you to Eventopia, so that the referral or campaign can be credited for your visit. Without your consent this is kept only for the current visit, in the session, and these cookies are not set.

Marketing

The organizer of the event you view can measure your visit and purchase with their own advertising tools. These load only on the page of an event whose organizer has set one up, never on other pages of eventopia.be, and never before you allow marketing. They are the organizer's tools: the organizer decides to use them and is responsible for them as an independent controller, and the company behind each tool receives your visit directly from your browser (section 6).

  • Meta Pixel (Meta Platforms Ireland Ltd.) — records that you viewed the event page, for the organizer's advertising on Facebook and Instagram. Sets _fbp (90 days) and, when you arrive from a Facebook or Instagram ad, _fbc (90 days).
  • Google Analytics 4 (Google Ireland Ltd.) — measures your visit to the event page for the organizer. Sets _ga and _ga_… (2 years).
  • TikTok Pixel (TikTok Technology Ltd.) — records that you viewed the event page, for the organizer's advertising on TikTok. Sets _ttp (13 months).
  • Purchase measurement (Meta Conversions API) — not a cookie: if you had allowed marketing when you ordered, and the organizer uses it, we send Meta the purchase (amount, tickets and an order reference) with your email address and phone number in hashed form (SHA-256), so the organizer can measure their advertising. Without your marketing consent nothing is sent.

Payment page: payments are completed on a page hosted by our payment provider (Mollie, or Stripe when it is used), which sets its own cookies there for fraud prevention. These are covered by that provider's privacy policy.

You can change or withdraw your choice at any time with "Cookie settings" at the bottom of our public pages, or with the button below. After a withdrawal the statistics stop immediately, the organizer's tools are no longer loaded, and the referral cookies are deleted on your next page view; the banner also deletes the marketing cookies listed above. You can also delete cookies and browser storage in your browser settings.

9. Contact

For privacy questions, data access requests, or complaints:
[email protected]

10. Supervisory Authority

If you believe your privacy rights have been violated, you can lodge a complaint with the Belgian Data Protection Authority:

Gegevensbeschermingsautoriteit (GBA / APD)
Drukpersstraat 35, 1000 Brussel
Email: [email protected]
Website: gegevensbeschermingsautoriteit.be

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-platform notice. The "Last updated" date at the top of this page always reflects the current version.

← Back to Home