Version 2.0 — 22 July 2026
TicketPlan considers the protection of personal data important. This Policy explains what data we process, why, where processing takes place, how long data is retained and what rights you have.
It applies to the TicketPlan app, app.ticketplan.nl, ticketplan.nl and related services.
TicketPlan is the controller. For privacy questions and requests, email privacy@ticketplan.nl or use the contact page.
Registered and former Users, website visitors, Friends and recipients of shared Admission Tickets, and other people whose data appears in a Ticket added by a User.
Name, username, email address, password hash, registration date, language, settings, Account and subscription status.
The Ticket or forwarded email and attachments; Event name, date, time and location; organiser or provider; seat, booking and order details; QR, barcode, data matrix or other admission codes; names and other data contained in the Ticket; corrections and selected images.
Friend requests and friendships, profile discoverability, Event visibility, which accepted Friends attend a visible Event, and assignment and receipt of an individual Admission Ticket.
IP address, login time, device and app version, FCM device token, security and error data, and reminder, calendar and crash-reporting preferences.
Subscription type and status, trial period, platform, transaction and subscription references. TicketPlan does not receive complete payment-card or bank details.
| Purpose | Legal basis |
|---|---|
| Provide the Account, Tickets, sharing, social features, reminders, calendar and subscription | Performance of the contract |
| Security, fraud and abuse prevention | Legitimate interests |
| Investigate technical errors and improve the Service with data minimisation | Legitimate interests; crash reporting can be disabled |
| Administration, legal requests and claims | Legal obligation or legitimate interests |
| A separate optional purpose | Consent, where expressly requested |
We do not rely on consent for core features where processing is necessary to perform the contract. Consent for an optional purpose can always be withdrawn for the future.
During registration we present an unticked checkbox:
I agree to the Terms and Conditions and confirm that I have read the Privacy Policy.
We record the date, time and document versions. This demonstrates that the documents were presented; it is not blanket GDPR consent. Optional consent is requested separately.
Tickets and forwarded emails are stored and substantively processed on TicketPlan's own infrastructure in the Netherlands. Ticket content is not sent to external AI providers or other external processors for recognition, extraction, enrichment or model training.
Automated techniques recognise details such as Event name, date, time, location and individual Admission Tickets. Users can review and correct results.
Ticket content is not used for advertising, sold, or used to train external or general AI models. No solely automated decisions producing legal or similarly significant effects are made.
A Ticket may contain another person's name, email address, customer number, booking information or personal admission code. TicketPlan then receives that information through the User.
We process it only to store, recognise, manage and — following a deliberate choice — share the relevant Admission Ticket. Depending on the situation, this is based on performance of the Service and legitimate interests in shared ticket management, balanced against the other person's rights.
The User must be authorised to provide the data, limit it to what is necessary and refer the other person to this Policy unless a legal exception applies.
TicketPlan remains responsible for its own GDPR obligations. The person can exercise rights through privacy@ticketplan.nl. We may request information first to protect Accounts and admission codes.
Accepted Friends see only configured information about a visible Event. Admission Tickets and codes remain private. Only after deliberate assignment does one Friend receive the necessary Ticket information and code. Friends of Friends are not shown.
Crash reporting through TicketPlan's own GlitchTip instance and website analytics through its own Umami instance run on TicketPlan infrastructure. Ticket content is not included. Crash reporting can be disabled in the app.
Strictly necessary data may be disclosed to competent authorities or professional advisers where legally required or necessary for a legal claim. We do not sell personal data.
Ticket content is processed in the Netherlands and is not transferred outside the European Economic Area. Some other providers, including Google, Apple and RevenueCat, may process data outside the EEA and must use a valid transfer mechanism and appropriate safeguards, such as an adequacy decision or standard contractual clauses.
After Account deletion, active Account and Ticket data are erased. Technical logs may remain for up to 30 days. Data may be retained longer for a legal obligation, security incident or dispute.
Measures include HTTPS/TLS, secure password hashing, access controls, protection of Tickets and admission codes, separation of Event visibility and Admission Ticket sharing, security logs and limited internal access. No system is completely secure. We follow applicable breach-notification duties.
We use necessary session cookies and local storage for login, security, language, theme and preferences.
Umami runs on our own infrastructure for aggregated visitor statistics without advertising profiles or cross-site tracking.
Public pages currently load technical files and fonts through jsDelivr and Google Fonts. These providers may receive technical information such as an IP address. We request prior consent for non-essential cookies or similar technologies where required by law.
Depending on the circumstances, you have rights of access, rectification, erasure, restriction, portability, objection, source information and withdrawal of optional consent for the future.
Send requests to privacy@ticketplan.nl. We normally respond within one month and may request information to verify identity and protect other people.
You may also complain to the Dutch Data Protection Authority.
TicketPlan is intended exclusively for persons aged 16 or older. Persons under 16 may not create an Account or use the Service. TicketPlan does not independently verify age or identity during registration. Contact us if you believe TicketPlan processes personal data relating to someone under 16; TicketPlan will investigate the report and delete the data where there is no valid legal basis or statutory retention obligation.
We notify registered Users in advance of material changes through the Service or by email. We request separate consent before starting a new optional purpose requiring it. The current version is always available here.