Privacy notice
Who is responsible for your data
Harshitha Alla, a private individual in Stockholm, organises Desi Dhamaal and decides what happens to the personal data described here - the person the law calls the data controller. There is no company behind the event: "Desi Dhamaal" is the name of the night, not a registered business. The way to reach the organiser about anything on this page, including the rights set out at the bottom, is [email protected].
What we collect, and when
Nothing at all until you buy a ticket. Browsing this site does not require you to give us anything, and the site sets no cookies of its own. One thing does leave your browser without you doing anything: the page's typefaces are fetched from Google, which is described under "Who else processes it" below.
When you buy a ticket:
- Your name and email address. You enter them on the payment page and we store them, because the tickets are sent to that address and the name is how we find your order at the door.
- Your payment details and billing address. These go to our payment provider, not to us. We never see or store your card number.
- Your order. How many tickets, which ticket type, the amount paid, the time of the purchase, and a reference for the payment.
- Your tickets. One code per ticket, and whether it has been scanned at the door yet - including when it was scanned.
- A scrambled form of your internet address. When a checkout starts we store a one-way hash of the IP address it came from - not the address itself. It is there to stop one person opening dozens of checkouts at once and holding the whole event's seats hostage, and it is the only thing that lets us count those attempts without keeping a list of who was browsing. It is deleted with everything else 30 days after the event.
Visitor counting on this site uses Cloudflare Web Analytics, which is cookieless and does not build a profile of you or follow you to other sites.
At the event. We photograph and film every edition, and the pictures and clips go on this site and on our Instagram - the photos of past editions on the front page and the trailer are exactly that. If you come, you may appear in them. If you would rather not be in a published photo, tell whoever is holding the camera on the night, or email [email protected] afterwards and we will take the picture down.
Why we may hold it
- To give you what you paid for. Issuing the ticket, emailing it, re-sending it if you ask, admitting you at the door and refunding you if we have to cancel. This is us performing the contract you entered into when you bought.
- To run the door and keep the night safe. Knowing which codes have been used stops the same ticket admitting several people. This is our legitimate interest in the event working.
- To keep the sale from being attacked. The hashed internet address above exists only to cap how many checkouts one source can hold open at a time, so that a single script cannot make the night read "sold out". This is our legitimate interest in preventing abuse of the service and keeping it available to real buyers.
- To show what the night is like. Publishing photos and film from the event is our legitimate interest in telling people about it; you can object at any time and we will remove the picture.
- To answer you. If you email us about your order we keep that exchange until it is resolved.
We never sell your details, never pass them to advertisers, and do not send marketing email to ticket buyers.
Who else processes it
Four companies handle parts of this on our behalf. They may only use the data to provide their service to us. A fifth, Google, receives something without doing anything for us at all, which is set out after them.
- Stripe - takes the payment, collects your name, email and billing details on its own checkout page, and holds the payment record. Stripe serves European customers through its Irish entity and is part of a US-headquartered group, so some of the data is processed in the United States.
- Resend - sends the ticket email. Your name and email address pass through Resend, a US company, in order to deliver that message.
- Cloudflare - hosts this site, the ticket server and the database the orders are stored in, and counts visitors.
- Sentry - receives reports of errors on the ticket server, stripped of request contents, names, email addresses and ticket codes, so we can fix them.
Photos and film we publish on Instagram are, once posted, also held by Meta under its own terms.
Google Fonts. The typefaces on this site and on the ticket pages are loaded from Google's font service rather than from our own server. Your browser fetches them directly from Google, which means Google is told your IP address and which browser you are using every time you open one of those pages - including the page your ticket is on. No cookie is set and we get nothing back from it; it is a convenience in how the site is built, not a choice about your data.
Technical records
The ticket system keeps a log of the stages each purchase, ticket email and door scan went through, so we can fix problems and help with a missing ticket. Those records hold the time, what happened and a reference to the order - never your name, email address or ticket code. Errors on the ticket server are reported to Sentry with the request contents stripped. Nothing runs in your browser to report on you.
How long it is kept
Thirty days after the event, the ticket system erases the personal details on every order by itself: your name, your email address, any note an organiser wrote on the order, and the scrambled internet address from the checkout. This runs for every order, including guest-list and door entries that never had an email address on them.
The order and ticket rows themselves stay, so we keep a record of how many tickets were sold, of which type, for how much, and how many were scanned. Those rows are stripped of your details rather than made anonymous: our payment provider holds its own record of the same purchase, so wherever a reference to it is still attached on our side the two could be matched back up.
Stripe keeps its own record of the payment for as long as its own retention and legal obligations require, which is outside our control.
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, or object to a use we base on legitimate interest.
Email [email protected] from the address you bought with and say what you want. We will answer within a month.
One thing worth knowing: if you ask us to erase your details before the event, we can do that, but your ticket email cannot then be re-sent and we cannot look your order up at the door - so bring the ticket you already have.
If you think we have handled your data badly and we have not put it right, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), at imy.se.