Privacy policy
GDPR / UK GDPR / applicable Nepal privacy law — finalize with legal counsel.
Last updated: 18 September 2026 · Data controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS]
Data we collect
- Account: email, name, password hash
- Orders: buyer contact, attendee names, payment status (not full card numbers)
- Organisers: business contact, payout account references via payment providers
- Technical: IP address, device data for fraud prevention and rate limiting
How we use data
To process ticket orders, send transactional email (confirmations, reminders, refund updates), operate door scanning, and improve platform security. Marketing email only where you opt in at checkout.
Retention
Order and ticket records are retained for accounting and dispute resolution (typically 7 years unless law requires otherwise). You may request access or deletion subject to legal retention requirements — contact privacy@eventsmandu.com.
Processors
We use payment processors (Stripe, Khalti), email providers, and hosting infrastructure. Data may be processed in the UK, EU, or Nepal depending on service location.
Your rights
Depending on your location you may have rights to access, rectify, erase, or restrict processing. See also our Terms of service.