Preamble
This privacy policy describes how Yzyflow SRL (hereinafter “Yzyflow”) collects, uses and protects the personal data of its users. The scope of this notice depends on the nature of your interactions with our services: whether you purchase an admission ticket, top up your virtual wallet (cashless) via our apps and kiosks, or simply browse our digital interfaces.
Yzyflow is committed to processing your data in strict compliance with the General Data Protection Regulation (GDPR) and applicable Belgian legislation.
1. Nature and source of the information collected
As part of its services, Yzyflow processes the information of Users (Participants, event staff or Administrators) as follows:
- Direct collection: When you create an account or use our interfaces, we collect identification data (surname, first name, gender, date of birth) and contact data (email, address, telephone). For virtual wallet services (Cashless & Top-up), we record the top-up history as well as the details of purchase transactions.
- Collection and synchronisation via third-party systems: Where the Organiser uses external tools (ticketing platforms, accreditation systems, database managers or third-party CRMs), information may be transmitted to us through API integrations, data feed synchronisation or file imports (such as CSV/Excel). These transfers are strictly limited to the data needed to configure access to the Yzyflow platform, to assign rights (access, credits) and, more broadly, to ensure the proper technical and organisational running of the event.
- Public interactions and reviews: We may process data published on public forums or social media where our services are mentioned, as well as content (text, images) voluntarily submitted when posting reviews or comments.
- Technical data: We automatically collect information about the use of our tools, such as the IP address, device identifier (Device ID), connection logs and, subject to your express consent, geolocation data.
Note on financial data: Yzyflow does not store any bank details. Transactions are carried out using encrypted protocols by our PCI-DSS certified providers, ensuring the integrity and confidentiality of your payment information.
2. Purposes, legal bases and retention
In accordance with the GDPR, each processing operation is based on a specific legal basis and a limited retention period:
- Performance of the contract (Ticketing & Cashless): Processing necessary to deliver your admission tickets and manage your virtual money. Data is kept for the duration of the contractual relationship, then archived for 10 years to meet tax and accounting obligations.
- Technical support and monitoring: Processing based on our legitimate interest in resolving your payment incidents. Retained for the time needed to resolve the ticket + 2 years.
- Security and fraud detection: Use of IP address and location to prevent purchases by bots or payment fraud. Retained for 10 years as legal evidence.
- Marketing, communications and personalisation: Based on your express consent (opt-in). To ensure our messages are relevant, we may create a user profile based on your favourites and purchase history. Data is kept for 3 years after your last active contact.
- Technical maintenance (logs): Data retained for a maximum of 6 months.
- Statistical use: Yzyflow irreversibly anonymises consumption data. These aggregated reports no longer allow any individual to be identified and are kept indefinitely to improve our services.
Inactivity and deletion: Your account and associated data are deleted or irreversibly anonymised after 7 years of inactivity. If you request deletion of your account, it will take effect within a maximum of 90 days, subject to the statutory retention obligations mentioned above.
3. Recipients, processors and data sovereignty
As a European company, Yzyflow strives to work primarily with local and European partners in order to ensure maximum digital sovereignty and to minimise the environmental impact of its infrastructure.
Your data is disclosed only to the third parties necessary for the technical and commercial delivery of the services:
- Hosting and infrastructure: Hetzner Online GmbH (Germany) hosts our servers and databases within the European Union, ensuring secure storage that meets the strictest security standards.
- Customer relationship management and support (CRM): Odoo (Belgium/Europe) is used for administrative management, technical support and user assistance. Your identity and contact data are processed there to respond to your support requests, manage your support tickets and follow up the contractual relationship.
- Payment solutions and financial flows: Vivabank (Greece) processes the monetary flows linked to ticket purchases and virtual wallet top-ups. It acts as a secure intermediary for payment validation and fraud prevention.
- Communications and application maintenance: Google Firebase and OneSignal allow us to monitor app performance, detect bugs in real time and send push notifications.
- Successors: In the event of a sale, merger or restructuring of the company Yzyflow, your information may be transferred to the successor, which will be required to inform you of any change concerning the data controller.
Data segregation: Yzyflow applies a policy of strict segregation between Organisers. Data collected on behalf of Organiser A is under no circumstances shared with or accessible to Organiser B.
4. Data transfers outside the European Union
Although Yzyflow favours processing data within the European Economic Area (EEA), certain specific technical services (such as push notifications via Firebase/OneSignal) may involve transfers to servers located outside the EU.
5. Use of cookies and tracking tools
We use cookies to optimise your user experience:
- Technical cookies (essential): Keep your session open and secure your shopping basket.
- Performance cookies: Allow us to detect bugs and optimise the speed of the app.
- Analytics cookies: Used to understand how users navigate our interfaces in order to improve their usability.
You can manage your preferences via the management tool on our interfaces or via your browser settings.
6. Your rights and remedies
You have the right of access, rectification, objection and erasure (“right to be forgotten”) of your personal data. You can exercise these rights or withdraw your marketing consent at any time by contacting us at: [email protected].
If you consider that the processing of your data infringes the provisions of the GDPR, you have the right to lodge a complaint with the Data Protection Authority (DPA): Rue de la Presse 35, 1000 Brussels ([email protected]).