Last updated on 4 August 2026
The Company/We/Us, BASH B.V., located on Leidsegracht 38, 1016 CM Amsterdam. The Company is registered with the Chamber of Commerce (Kamer van Koophandel) under number 80666566.
You, the person whose Personal Data we process, whether you use BASH as a User, Guest, or Organiser.
Privacy Policy, this document on how the Company treats Personal Data.
GDPR, Regulation (EU) 2016/679, the General Data Protection Regulation. This Privacy Policy refers to definitions of article 4 of the GDPR.
BASH, the online social platform provided by the Company to Consumers and Organisers to use for, and in relation to, attending and organising events.
The Terms, the Company’s Terms & Conditions.
Relevant Legislation, GDPR and other relevant laws and regulations, such as the Telecommunications Act (Telecommunicatiewet) for the use of cookies.
User, a natural person, legal entity, or partnership who has a User profile on BASH.
Guest, a natural person, legal entity, or partnership who attends an event via BASH by buying a ticket or RSVP’ing without having a User profile on BASH.
Consumer, a Guest or User when attending an event or using other event-related services from a specific Organiser on BASH.
Organiser, any natural person, legal entity, or partnership who is using the event hosting features of BASH in any form.
a.
Users can host an event from their User account directly acting as the same natural person or legal structure. When using the event hosting features, they are then acting as an Organiser, when using any other features, they are acting as a User.
b.
Users may also create an Organisation Page for the same or separate natural person, legal entity, or partnership from which they can host events as that party. The Accepting Party is an Organiser when doing anything on or from the Organisation Page.
This is our Privacy Policy. It discusses in which capacity the Company operates, how the data is processed, stored and protected, and which privacy rights you can invoke.
If there is a substantial modification you will be notified.
This Privacy Policy should be read in line with the Relevant Legislation and the Terms.
The Privacy Policy applies to the BASH online services: the website and the app. The Company processes your Personal Data, as defined by the GDPR, in order to provide BASH to you. Your Personal Data is treated in accordance with the Relevant Legislation.
The Company has two possible capacities: either we process your data as a Controller or as a Processor (both defined by the GDPR). We act as a Controller where we determine the purposes and means of processing, mainly when we provide BASH to you. We act as Processor where we process Personal Data on behalf of an Organiser and in accordance with that Organiser’s documented instructions, so mainly when the Organiser uses BASH to organise their events. We are responsible for keeping these roles distinguished and making sure that we process the Personal Data in the right capacity, and the right stipulations thereof.
For clarity, “data processing” applies to both capacities as the Company processes data in both capacities.
All sections of this Privacy Policy apply to Personal Data where the Company acts as Controller. Where we act as Processor, the Organiser is mainly responsible for managing your rights and upholding applicable law. We will provide assistance to the Organiser where required to facilitate such cases. For any Personal Data related questions, you may contact us through the support button or the details below, and we will assist you or forward the request to the Organiser.
BASH is a social event platform. Therefore, when you, as a User, purchase a ticket, RSVP to an event, comment, react, or otherwise interact on BASH, your name and profile picture will by default be displayed as part of the social features. Furthermore, your User profile may be recommended to others, we may send birthday notifications to your friends on BASH, and we may send show information in-app and send notifications about the events you interact with to your friends on BASH. You can manage certain visibility, recommendation and notification preferences in your User account settings. The available settings may depend on the feature and may not allow all visibility or recommendations to be disabled.
We process this information to provide BASH’s social event features and to make participation and activity visible as part of the platform.
The Company processes Personal Data on the basis of the following grounds of the GDPR:
a.
if you have given your consent;
b.
for the performance of an agreement with you;
c.
to fulfil a legal duty;
d.
for a legitimate interest of ours, after your interests have been weighed up.
We ensure that the processing of your Personal Data is adequate, relevant and limited to what is needed for the purposes for which the Personal Data is processed.
The table below tells you (1) what Personal Data is being processed, (2) for what purposes, and (3) on what bases we process it. For this table,* means that we are the Processor, and ** that we are the Controller.
(Personal) Data | Purpose(s) | Legal basis |
|---|---|---|
Organisers* Providing and improving BASH: • Organisation Page name • First and last name • Email address • Phone number • Organiser Interaction on Organisation Page, events, and dashboard | The Company uses these Data: • To provide and improve BASH as a social event platform, which entails but is not limited to: • account and organisation management; • organiser verification, contact and support; • providing social event, ticketing, audience, and dashboard features; • platform analytics; • debugging and service improvement. | The Company processes these Data on the basis of: • Performance of a contract • Legitimate interest |
Financial admin and security: • Company details • Chamber of Commerce number • VAT number • IBAN • Payment details | • For invoicing and financial administration • For security and fraud prevention • To handle disputes chargebacks and legal claims | • Performance of a contract • Legal duty • Legitimate interest |
Consumers* Providing BASH event/ticket services: • First and last name • Email address • Phone number • Event/ticket interaction data • Any other data requested from the Consumer by the Organiser through BASH • Payment data • Technical identifiers | The Company uses these Data: • To provide access to BASH as a social event platform, which entails, but is not limited to: • process tickets, RSVPs, entry management, event communication, and other event-related services on behalf of the Organiser, in accordance with the Organiser’s instructions; • identify Consumers; • send event-related notifications to the Consumer on behalf of the Organiser. | The Company processes these Data on the basis of: • The Organiser as the controller determines the applicable legal basis. We process this data as Processor on behalf of the Organiser, in accordance with the Organiser’s instructions and the Data Processing section of the Terms. |
Consumers** Maintaining and improving BASH: • Event interaction data • IP address • Device/browser data • Technical identifiers • Error logs • Security logs | The Company uses these Data: • To analyse platform usage to improve functionality, reliability, and Consumer experience, using aggregated or pseudonymised data where reasonably possible • To debug and perform service improvement • For Security and fraud prevention • To handle disputes, chargebacks and legal claims | The Company processes these Data on the basis of: • Legitimate interest • Consent (for non-essential tracking) |
Users* Providing BASH: • Correspondence or chats with you • Name • Account data • Ticket/order data • Basic event interactions • Notification preferences • Device/push tokens | The Company uses these Data: • To provide BASH as a social event platform, which entails, but is not limited to: • ticketing features; • event features; • calendar features; • notifications. | The Company processes these Data on the basis of: • Performance of a contract |
Maintaining BASH: • Interaction on BASH, including events joined • IP address • Device/browser data • Technical identifiers • Error logs | • To optimising BASH on the basis of data analysis • For Security and fraud prevention • To debug and perform service improvement • To handle disputes, chargebacks and legal claims | • Legitimate interest |
Personalisation: • Name • Birthday • Profile Picture • Location data (GPS) • Interaction on BASH, including events joined | • To provide social event and event visibility features, including showing participation, activity, and profile information to other Users or Guests where applicable • For Feed personalisation • To send birthday notifications | • Legitimate interest • Consent (for non-essential tracking/personalisation) |
Job Applicants* Application data: • First and last name • E-mail address • Phone number • Location of main residence • Curriculum vitae | The Company uses these Data: • To assess and process your application | The Company processes these Data on the basis of: • Legitimate interest |
How does the Company receive your Personal Data?
We receive Personal Data directly from you when you submit information, log in, or interact on BASH, whether that is on the platform itself or on an event of an Organiser. Or when the Organiser imports your Personal Data.
The Company shall not store your Personal Data longer than the period in which we need them for the purposes meant under 4. Please be aware that the data that your input to and usage of BASH provides the Company with data to provide, secure, maintain, and improve BASH. We keep limited data as laid out in this Privacy Policy to use it for those purposes in an integral and continuous manner. The following is a list of the categories of Personal Data and the (functionally defined) retention periods:
Category of Personal Data | Retention period |
|---|---|
Organiser data | We retain your contact information for as long as your Organisation Page is active. After you delete your Organisation Page, we are legally required to keep invoice, financial data, and accounting records for tax purposes for seven years and we may retain limited data needed for fraud-prevention and security as well. All data that is not essential will be deleted with your Organisation Page. |
Consumer Data | Where we process Consumer data on instruction of the Organiser, we retain that data for as long as necessary to provide the relevant services to the Organiser and in accordance with the Organiser’s instructions. After the relevant services end or when instructed by the Organiser, all Personal Data will be deleted, returned, or anonymised, unless retention is required or permitted by law, including for tax, accounting, security, fraud-prevention, dispute, chargeback or legal-claims purposes. Where we process Consumer Data for our own purposes, we retain only the data necessary for those purposes for the applicable retention period. We may continue to use aggregated or anonymised data for analytics and product improvement after account deletion, provided this data can no longer identify the Consumer. |
User Data | We retain Personal Data from your User account for as long as your User account is active. After your User account is deleted, all Personal Data will be deleted unless retention is required or permitted by law, including for tax, accounting, security, fraud-prevention, dispute, chargeback or legal-claims purposes. We may continue to use aggregated or anonymised data for analytics and product improvement after account deletion, provided this data can no longer identify the User. |
Job Applicants | We retain applicant data for as long as the hiring process lasts. The hiring process ends when the position has been filled or the search has been stopped. After the hiring process ends, we delete the data within four weeks, unless you consent to us keeping your details for longer in case we might want to hire you later on for up to one year. |
The Company does its utmost to protect your Personal Data in line with article 32 of the GDPR, by taking technical and organisational security measures to protect your data against manipulation, loss, destruction and access by unauthorised persons. These security measures are constantly improved in line with technological developments.
We constantly check our security measures for effectiveness, and if necessary adjust the process. These measures are designed to protect your Personal Data and support availability and resilience.
If a data breach or another incident occurs where your Personal Data is at high risk, you will be notified without undue delay as per article 34 GDPR.
Only persons that need access to Personal Data will have access, and we make sure they are bound by confidentiality.
The Company may share your Personal Data with Third Parties who process Personal Data for us. These are often Processors (or Sub-processors if we are acting as a Processor), in which case they will process data in accordance with our instructions. We may share your Personal Data with the following kinds of Third Parties:
a.
Service Providers
The Company shares your data with the following kinds of services, they enable us to provide and operate BASH.
Category | Purpose of sharing data | Categories of data shared |
|---|---|---|
Data analytics services | Data analysis for product improvement | Usage data, interaction data, event/page views, device and browser data, technical identifiers, and limited Consumer or Organiser identifiers where needed for analytics |
Hosting services | Run the BASH online services | User account data, Organisation Page data, event data, ticket/order data, messages, technical data and server logs |
Customer support tools | Providing customer support to Consumers and Organisers | Consumer and Organiser identifiers, contact data, support messages and relevant account, event, ticket or order information. |
Financial tools | Bookkeeping | Consumer and Organiser contact data, invoice data, transaction amounts, VAT/tax information and payment references. |
Ticket providers | Provide ticket sales from third-party ticket platforms | Organiser contact and financial data, Consumer payment interactions and payment related data. |
Payment providers | To process payments, payouts, refunds, chargebacks and fraud checks within BASH’ own ticket provider. | Organiser contact and financial data, Consumer payment interactions and payment related data. |
Messaging providers | To provide notifications | Consumer and Organiser contact data, push notification tokens, notification preferences, message content and delivery metadata. |
Marketing conversion tools | To track marketing efforts | Consumer interaction, cookie identifiers, pixel identifiers, device and browser data, IP address, page views, referral data, campaign data and conversion events, such as sign-ups or ticket purchases, only when valid consent has been obtained. |
b.
Competent Authorities
The Company discloses Personal Data to law enforcement authorities and other public authorities to the extent required by law or essential for the prevention, detection or prosecution of criminal offences and fraud.
c.
Auditors and Advisors
The Company may engage auditors and professional advisers to meet our legal, regulatory and statutory responsibilities. We have contractual arrangements and security mechanisms to protect data and meet our standards of data protection, confidentiality and security.
Data Transfer
Personal Data may be transferred outside the European Economic Area where necessary for providing BASH. In such cases we ensure appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission. You may contact us for further information about these safeguards.
Links
BASH may contain links to other websites. We are not responsible for the content or privacy protection of these websites. Therefore, we advise you to always read the privacy policy of the website in question.
You have the following rights, the Company will do its utmost to apply these rights within a reasonable time period (usually a month under the GDPR):
•
you may ask us to receive your stored Personal Data;
•
you may ask us to correct, restrict, or delete your Personal Data;
•
you may ask us for a copy of your Personal Data. This copy can also be passed on - at your request - to other parties so that you no longer have to do this yourself;
•
you may object to the processing of your Personal Data when:
•
the processing is based on a legitimate interest process;
•
the processing is for direct marketing purposes, in which case we will have to stop processing immediately;
•
where we process your Personal Data based on consent, you may withdraw your consent at any time;
•
you may file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), if you think we are processing your Personal Data unlawfully.
The Company uses essential cookies, and may, with your consent, use additional cookies. Some cookies may involve the processing of Personal Data, which is handled in line with this Privacy Policy. For the Company’s cookie policy, please read the full Cookie Notice here.
In the event that you wish to exercise these rights, or if you have other questions or remarks regarding the Privacy Policy, you can email us at legal@bash.social.