Privacy Policy

Who is responsible for your data

The controller of personal data on raavve is:

• MIKOŁAJ BRZOSTOWSKI, a sole proprietorship registered in CEIDG
• ul. Gabriela Narutowicza 32/5, 41-200 Sosnowiec, Poland
• NIP: 6443543429
• REGON: 381001493

raavve is the name of the service. The controller is the business named above.

For privacy requests, email privacy@raavve.pl.

We have not appointed a data protection officer. Use the same address for questions, corrections and GDPR requests.

This policy is published in Polish and English. If the versions differ, the Polish version prevails.

When we collect data

What we collect depends on what you use.

• The site: IP address, session identifier, browser data and security logs, so the service stays up. We may infer your city from the IP address via ipwho.is, IPLocate or ip-api, or store a city you pick. Legal basis: GDPR Article 6(1)(f).
• Account: email address, a hash of your password, and data passed by Google or Facebook if you sign in with those services. Accounts are for people aged 18 or over. Legal basis: GDPR Article 6(1)(b).
• Order: email, name, phone if you provide it, order number, payment status and invoice details if you ask for an invoice. Payments are handled by Stripe, including cards, BLIK and Przelewy24. We do not store the full card number. Legal basis: GDPR Article 6(1)(b) and (c).
• Contact, bug report, event suggestion, profile claim or illegal-content report: email, the message and the correspondence. Forms are checked with Google reCAPTCHA. Legal basis: GDPR Article 6(1)(b) and (f).
• Newsletter: email address, language and signup source. Signup is single-step. After a valid form and reCAPTCHA, the address is added to a Resend list. We do not send a separate confirmation email. Legal basis: GDPR Article 6(1)(a). You can withdraw consent with the link in a message or by emailing privacy@raavve.pl.
• Favourites and followed events, pages and venues are visible only on your account. We do not publish a public user profile.
• The catalogue of events, artists, venues, festivals and collectives is based on organiser materials, data submitted to the service and our own editing. If that content includes a natural person’s data, the legal basis is GDPR Article 6(1)(f). Send corrections to privacy@raavve.pl.
• Messages with a seller, when chat is enabled, are handled by TalkJS. Legal basis: GDPR Article 6(1)(b).
• Search uses Algolia. The query and technical request data go to Algolia so it can return results. Legal basis: GDPR Article 6(1)(b) and (f).
• Analytics only after consent: Google Tag Manager, tags in that container including Microsoft Clarity (session recordings and heatmaps), plus Vercel Analytics and Speed Insights. Those scripts do not load until you accept. Reject leaves them off. Checkout, sign-in, account and the newsletter field are masked in Clarity recordings. Legal basis: GDPR Article 6(1)(a).
• Event map: if we show an embedded Google map, the iframe loads immediately. Google then receives your IP address and the page URL, without waiting for analytics consent. If the map is only a link, Google receives that data after you click.
• Advertising: we do not use a Meta pixel or Google Ads tags. If we turn them on, they will load only after a separate marketing consent. Until then, advertising storage, ad user data and ad personalisation stay denied in Google consent mode. Turning advertising on will be described in this policy and in cookie settings.

Providing data is voluntary. Without account data you cannot create an account. Without order data we cannot take an order. Without an address on a report we cannot reply.

We do not make solely automated decisions that produce legal effects or similarly significantly affect you. reCAPTCHA may reject a form that looks like spam. You can then email privacy@raavve.pl.

Who receives data

Data goes only where it is needed to run the service:

• Vercel — storefront hosting and, after analytics consent, Vercel Analytics and Speed Insights
• Railway — backend hosting in eu-west (Amsterdam, European Economic Area)
• MinIO — media files
• Stripe — payments, including cards, BLIK and Przelewy24, and refunds
• Resend — newsletter and transactional email
• Google — Tag Manager and analytics after consent, reCAPTCHA, maps and Google sign-in
• Microsoft — Clarity after analytics consent
• Algolia — search
• TalkJS — messages, when chat is enabled
• Meta Platforms — only if you sign in with Facebook; ad measurement only after a future, separate marketing consent
• ipwho.is, IPLocate and ip-api — city lookup from the IP address
• accounting, the bank and public authorities — when the law or a claim requires it

Providers acting on our behalf process data only as needed for their service.

We do not sell personal data.

Data outside the EEA

The backend runs on Railway in Amsterdam, in the European Economic Area.

The storefront runs on Vercel. Google, Microsoft, Vercel, Algolia, Stripe, Resend, TalkJS and Meta may process data outside the EEA, including where part of the infrastructure is in Europe.

We then use an adequacy decision or standard contractual clauses.

How long we keep data

• Account: until you delete it, and afterwards for as long as claims or legal duties require.
• Orders and payments: for fulfilment, then for the period required by tax and accounting rules and by limitation of claims.
• Correspondence and reports: until the matter is closed and the limitation period ends.
• Newsletter: until you withdraw consent.
• Technical logs: for as long as we need them for security and diagnostics.
• Cookies: as described in the cookies section and in your browser settings. Analytics consent expires after 12 months.

Cookies

Necessary cookies run without a separate consent, because they are required for the service you ask for:

• raavve_analytics_consent — stored analytics choice, up to 12 months
• raavve:manual-city:v1 — chosen city, up to 30 days
• NEXT_LOCALE — site language, up to 12 months
• _medusa_jwt — account session, up to 7 days, httpOnly cookie
• _medusa_cart_id — cart, up to 7 days, httpOnly cookie

After you accept analytics, cookies from Google Tag Manager and its tags, Microsoft Clarity and Vercel Analytics may be set. Advertising cookies stay off.

Stripe, Google reCAPTCHA and an embedded Google map may set their own cookies when you pay, submit a form or view the map.

You can change the choice on Cookie settings. Details are in the Cookie policy.

Your rights

You can:

• access your data
• ask for correction
• ask for erasure
• ask for restriction of processing
• ask for portability
• object to processing based on GDPR Article 6(1)(f)
• withdraw consent

Withdrawing consent does not affect processing that was lawful before the withdrawal.

We cannot always delete data immediately if we must keep it for accounting, complaints or claims.

Send requests to privacy@raavve.pl.

You can lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Security

We use technical and organisational measures appropriate to the risk, including encrypted transport, access limits and masking of sensitive fields in analytics recordings.

No transmission over the internet is completely secure.

People under 18

raavve is not directed at people under 18. We do not knowingly collect their data. If you believe we have collected data of a person under 18, email privacy@raavve.pl.

Changes

We publish the new version on this page with an updated date.

If a change affects a purpose that relies on consent, we will ask for consent again.

Contact

Questions about this policy and data requests:

privacy@raavve.pl