Privacystatement
Version 1.1
Version 1.1 — last amended: 7 July 2026
This is a translation of the Dutch original. In the event of any discrepancy, the Dutch version prevails.
Bilenti, with its registered office at Wiltonstraat 36-40, 3905 KW Veenendaal (Netherlands), is responsible for the processing of personal data as set out in this privacy policy, except where Bilenti acts as a processor on behalf of organisers (see Section 2).
Contact details
- Bilenti
- Wiltonstraat 36-40, 3905 KW Veenendaal, Netherlands
- Email: [email protected]
- Website: https://bilenti.com
- KVK (Dutch Chamber of Commerce): 30269626
- VAT: NL001951677B31
Questions about privacy or requests relating to your personal data may be addressed to [email protected].
1. Who does this privacy policy apply to?
This policy applies to:
- Ticket buyers: visitors who purchase a ticket via Bilenti;
- Organisers: persons who create an account, on their own behalf or on behalf of an organisation, in order to sell tickets;
- Website visitors: anyone who visits bilenti.com.
2. Roles: controller and processor
For the operation of the platform (account management, payment settlement, invoicing, platform security, analysis and improvement of the service), Bilenti is the controller.
For personal data of ticket buyers processed for the purposes of a specific event (such as an organiser's attendee list), Bilenti acts as a processor on behalf of the organiser, who is the controller for that processing. Bilenti enters into a data processing agreement with every organiser for this purpose.
3. What personal data do we process?
From ticket buyers:
- first and last name;
- email address;
- order details (event, ticket type, quantity, price, order date);
- payment status and payment method (the payment itself is processed by Mollie — see Section 6);
- ticket scan data (date and time of admission);
- where applicable: waiting-list registrations.
From organisers:
- name and business details (company name, KVK number, VAT number);
- email address;
- bank account number (for payouts);
- account details and settings;
- invoicing and transaction data.
From website visitors:
- data about your use of the website (via cookies and similar technologies — see our cookie policy);
- IP address (masked where possible), browser type and device information.
4. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Creating and managing accounts | Performance of a contract (Art. 6(1)(b)) |
| Processing orders and delivering tickets by email | Performance of a contract (Art. 6(1)(b)) |
| Settlement of payments and payouts | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices and complying with tax retention obligations | Legal obligation (Art. 6(1)(c)) |
| Service communications (order confirmation, changes to the event) | Performance of a contract (Art. 6(1)(b)) |
| Fraud prevention and platform security | Legitimate interest (Art. 6(1)(f)) |
| Analysis and improvement of the service | Legitimate interest (Art. 6(1)(f)); for non-essential cookies: consent (Art. 6(1)(a)) |
| Newsletters and marketing communications | Consent (Art. 6(1)(a)); may be withdrawn at any time |
| Marketing cookies/pixels (Meta Pixel, TikTok Pixel) | Consent (Art. 6(1)(a)) |
We do not make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them (Art. 22 GDPR). Automated analyses for fraud prevention or platform security serve solely as a supporting tool; any decision with material consequences (such as blocking an account or order) is always reviewed by a human.
Artificial intelligence (AI). We do not use the personal data of ticket buyers, organisers or website visitors to train AI models — neither our own nor those of third parties. Where we offer features within the platform that use AI and with which you interact directly (such as a chatbot), we clearly disclose this before or at the first interaction, in accordance with Regulation (EU) 2024/1689 (AI Act); AI-generated content is labelled as such where required by law.
5. Retention periods
We do not retain personal data longer than necessary for the purposes for which it was collected, subject to statutory retention obligations:
| Data | Retention period |
|---|---|
| Order and ticket data | Up to 2 years after the event, then anonymised or deleted |
| Invoicing and payment data | 7 years (tax retention obligation, Article 52 of the Dutch General Tax Act (AWR)) |
| Organiser account data | For the duration of the account; up to 2 years after closure, subject to tax retention obligations |
| Waiting-list data | Up to 6 months after the event |
| Email address for newsletter | Until consent is withdrawn |
| Analytics data | A maximum of 26 months, aggregated/anonymised where possible |
6. Payment data and Mollie
Payments on the platform are processed by Mollie B.V., a payment service provider established in the Netherlands and regulated by the Dutch Central Bank (De Nederlandsche Bank). Bilenti has no access to your full payment details (such as account or card numbers); we receive only the status of the transaction and the data required to settle the order. Mollie's processing is governed by Mollie's privacy statement: https://www.mollie.com/privacy.
7. Sharing personal data with third parties
We do not sell your data to third parties. We share personal data only:
- with the organiser of the event for which you purchase a ticket (name, email address and order details), so that the organiser can run the event;
- with Mollie for the settlement of payments;
- with hosting and email providers that technically enable our platform and email delivery;
- with integrations connected by the organiser (such as Mailchimp, Zapier, Meta Pixel, TikTok Pixel or Google Analytics) — only insofar as the organiser activates that integration and is itself responsible for it;
- where we are legally obliged to do so.
With all service providers that process personal data on our behalf as processors, we enter into data processing agreements in accordance with Art. 28 GDPR.
8. Transfers outside the EEA
We store personal data within the European Economic Area (EEA) wherever possible. Insofar as service providers process data outside the EEA, this occurs only on the basis of appropriate safeguards, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses (SCCs).
9. Security
We take appropriate technical and organisational measures to protect personal data against misuse, loss, unauthorised access, unwanted disclosure and unauthorised alteration, including: encrypted connections (TLS), encrypted storage of sensitive data, access control based on least privilege, logging and monitoring, and periodic updates and backups. Do you suspect misuse or a security issue? Report it via [email protected].
10. Cookies
Bilenti uses cookies and similar technologies. We place essential cookies without consent; analytics and marketing cookies only after you have given your consent via the cookie banner. See our cookie policy for a full overview and for instructions on how to adjust or withdraw your preferences.
11. Minors
Our platform is not directed at persons under the age of 16. We do not knowingly collect data from persons under 16 without the consent of a parent or guardian. Do you believe we have collected data from a minor without such consent? Please contact us at [email protected] and we will delete this data.
12. Your rights
Under the GDPR (Regulation (EU) 2016/679), you have the following rights:
- Access to the personal data we process about you (Art. 15 GDPR);
- Rectification of inaccurate or incomplete data (Art. 16 GDPR);
- Erasure of your data (Art. 17 GDPR);
- Restriction of processing (Art. 18 GDPR);
- Portability of your data in a structured, commonly used and machine-readable format (Art. 20 GDPR);
- Objection to processing based on legitimate interest and to direct marketing (Art. 21 GDPR);
- Withdrawal of consent, without affecting the lawfulness of processing carried out before the withdrawal.
You can submit your request via [email protected]. To verify that the request comes from you, we may ask for additional information to confirm your identity. We respond within one month; for complex requests, this period may be extended by two months, in which case we will inform you.
If your request concerns data that we process as a processor on behalf of an organiser, we will forward your request to the organiser concerned or refer you to that organiser.
13. Complaints
Are you dissatisfied with how we handle your data? Please contact us at [email protected]. You also have the right at all times to lodge a complaint with the supervisory authority: the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) (https://autoriteitpersoonsgegevens.nl).
14. Changes
We may amend this privacy policy. The current version is always available at bilenti.com. In the event of material changes, we will inform account holders by email.
Questions about this privacy policy? Contact us at [email protected].