Privacy Policy

1. Data Controller

2. Personal Data We Collect

2.1 Account and Profile Data

When you register, we collect:

• First and last name
• Email address
• Password (stored encrypted, never in plain text)
• User role (Dancer or Organizer)
• Profile photo (optional, only if uploaded)
• Public display name (optional)
• City / location (optional)

2.2 Booking and Transaction Data

When you book or sell events, we collect:

• Events booked and tickets purchased
• Order amounts, currency, and payment status
• Booking confirmations and QR ticket codes
• Refund requests and outcomes
• Payout history (for Organizers)

We do not store full credit card numbers or sensitive payment details. All card data is processed and stored exclusively by Stripe.

2.3 Event Listing Data (Organizers)

• Event title, description, location, dates, and pricing
• Uploaded images and videos
• Ticket variants, availability, and spot counts
• Promo codes and discount rules
• Stripe Connect account ID and verification status

2.4 Communication Data

• Messages sent between Dancers and Organizers via the Platform messaging system
• Emails exchanged with Hulaya support
• Notification preferences

2.5 Technical and Usage Data

We automatically collect the following when you use the Platform:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and referring URLs
• Access timestamps and error logs
• Cookie data (see our Cookie Policy)

2.6 Newsletter Data

If you subscribe to our newsletter, we collect your email address and, where provided, your name. Newsletter communications are managed via Mailchimp. You can unsubscribe at any time using the link in every newsletter email.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR and Swiss DSG:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to operate your account, process bookings and payments, and provide Platform services.
• Legal obligation (Art. 6(1)(c) GDPR): Processing required to comply with applicable laws (e.g. financial record retention, anti-fraud obligations).
• Legitimate interests (Art. 6(1)(f) GDPR): Processing for fraud prevention, Platform security, analytics (aggregated), and service improvement.
• Consent (Art. 6(1)(a) GDPR): Processing for optional services such as newsletter subscriptions and analytics cookies, where you have given explicit consent.

4. How We Use Your Data

We use your personal data to:

• Create and manage your account
• Process event bookings, payments, and payouts
• Send transactional emails (booking confirmations, receipts, notifications)
• Enable messaging between Dancers and Organizers
• Provide customer support
• Detect, prevent, and investigate fraud or abuse
• Improve and maintain Platform functionality
• Comply with legal obligations
• Send newsletters and marketing communications (only with your consent)
• Display event locations on the map

We do not use your personal data for automated decision-making or profiling in ways that produce legal or similarly significant effects.

5. Third-Party Services and Data Sharing

We share your data with trusted third-party service providers only to the extent necessary to operate the Platform. We do not sell your personal data to any third party.

We may also disclose personal data if required to do so by law, court order, or government authority, or to protect the rights, property, or safety of Hulaya or its users.

6. International Data Transfers

Some of our service providers are located outside Switzerland and the European Economic Area (EEA), including in the United States. Where data is transferred to countries without an adequate level of data protection, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the Swiss Federal Data Protection and Information Commissioner (FDPIC)
• Other legally approved transfer mechanisms

By using the Platform, you acknowledge that your data may be transferred to and processed in countries outside your country of residence.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

• Account data: Until you delete your account, plus any legally required retention period
• Booking and financial records: 10 years from the transaction date, as required by Swiss accounting law
• Messages: Up to 24 months after the last activity, unless required longer for legal claims
• Technical logs: Up to 12 months
• Newsletter data: Until you unsubscribe
• Cookie data: Per our Cookie Policy

After retention periods expire, data is securely deleted or anonymised.

8. Your Rights

Under the Swiss DSG and GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations
• Right to restriction: Request that we restrict processing of your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent (e.g. newsletter, analytics cookies)

To exercise any of these rights, contact us at support@hulaya.com. We will respond within 30 days. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU/EEA, with your local Data Protection Authority.

9. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:

• HTTPS encryption for all data in transit (TLS)
• HTTP Strict Transport Security (HSTS) with preloading
• Encrypted storage of passwords (bcrypt hashing via Supabase Auth)
• Access controls limiting data access to authorised personnel
• Regular security reviews and dependency updates

Despite our measures, no method of transmission over the internet is 100% secure. You are responsible for maintaining the security of your account credentials.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals as required by law.

10. Children’s Privacy

The Platform is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided personal data without parental consent, we will take steps to delete such data promptly.

If you believe a child under 16 has registered on the Platform, please contact us at support@hulaya.com.

11. Cookies

We use cookies and similar tracking technologies to operate the Platform. For detailed information about which cookies we use, their purpose, and how to manage them, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or by posting a prominent notice on the Platform. The “Version” date at the top of this page indicates when this Policy was last revised. Continued use of the Platform after changes are published constitutes acceptance of the revised Policy.

13. Contact

For any questions, requests, or complaints regarding this Privacy Policy or our data processing practices, please contact us:

Swiss supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch