Privacy Policy

1. Data Controller

Membrz Lda ("the Company," "we," "us," or "our") (Rua Garrett 44, 2 Andar, 1200-109 Lisbon, Portugal) is the data controller for personal data processed through joinmembrz.com.

Membrz runs a live events platform for independent artists, event organisers, and promoters, supporting ticket and merchandise sales, QR door check-in, real-time attendance tracking, and payout splits among stakeholders. Our processing follows these workflows. For data-protection questions or to exercise the rights below, contact [email protected].

2. Personal Data We Process

The data collected depends on whether you use joinmembrz.com as an event organiser or ticket purchaser.

As an event organiser (account holder)

• Identity and contact data: name, email address, phone number;
• Account login data: email address and hashed password;
• Event details you create: name, date, venue, ticket tiers and prices, merchandise catalogue, payout rules, and recipient identities;
• Payout data: bank details or connected Stripe account information needed to route event disbursements;
• Creator and Promoter subscription and billing data, processed through Stripe. Membrz Lda does not store full payment card numbers.

As a ticket purchaser

• Name and email address, to deliver your ticket and create your door-entry QR code;
• Payment transaction reference from Stripe after successful checkout. Stripe, not Membrz Lda, holds card data;
• Attendance record: a scan-confirmed entry log created when your QR code is scanned at the door.

Automatically collected from all visitors

• Technical data: IP address, browser type, operating system, referring URL, pages visited;
• Analytics data, collected only after prior consent through our cookie banner.

3. Purposes and Legal Bases (Article 6 GDPR)

Purpose	Legal basis
Create and manage your organiser account	Performance of a contract (Art. 6(1)(b))
Process ticket and merchandise sales and generate QR codes	Performance of a contract (Art. 6(1)(b))
Process door check-in and track attendance in real time	Performance of a contract (Art. 6(1)(b))
Calculate and route payout splits to event stakeholders	Performance of a contract (Art. 6(1)(b))
Financial records and tax compliance (Portuguese Código do IVA / IRC)	Legal obligation (Art. 6(1)(c))
Operate and secure the Service and prevent fraud	Legitimate interest (Art. 6(1)(f))
Answer inquiries and provide support	Legitimate interest (Art. 6(1)(f))
Analytics cookies to measure site usage	Consent (ePrivacy + Art. 6(1)(a))

4. Recipients and Transfers

Personal data is shared only with processors acting for us under Article 28 GDPR agreements. Our main sub-processors are:

• Stripe Payments Europe, Ltd.: card processing, subscription billing, and payout disbursement. Stripe handles card data under its own privacy notice. Membrz Lda does not receive or store full card numbers;
• Cloud hosting and infrastructure providers: EU/EEA server and database hosting;
• Transactional email provider: ticket confirmations, receipts, and payout notifications.

For transfers outside the EU/EEA, we use Standard Contractual Clauses (Article 46 GDPR) and conduct a transfer impact assessment as required after the Schrems II ruling.

We do not sell personal data or share it with advertisers.

5. Retention

• Organiser account data: kept while active and for 24 months after closure;
• Event and financial records, including ticket sales, payouts, and settlement statements: kept for 5 years from the relevant event date to meet Portuguese accounting and tax obligations;
• Ticket purchaser email address: deleted 24 months after the event unless the purchaser has a Membrz account;
• Door check-in scan logs: kept for 12 months from the event date;
• Server access logs: kept for 90 days.

6. Your GDPR Rights

• Right of access (Art. 15): confirm whether we process your data and obtain a copy;
• Right to rectification (Art. 16);
• Right to erasure / "right to be forgotten" (Art. 17), subject to our financial record-keeping obligations;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object (Art. 21), including to direct marketing processing without further conditions;
• Right not to be subject to automated decision-making with legal or similarly significant effects (Art. 22). The Company does not engage in such automated decision-making.

To exercise a right, email [email protected]. We respond within one calendar month. Complex requests may extend this by two further months, with notice of any extension.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), available at cnpd.pt. A list of all EU/EEA supervisory authorities is available at edpb.europa.eu.

8. Cookies

See our Cookie Policy. We do not set non-essential analytics or preference cookies without prior consent, as required by the ePrivacy Directive. Our banner requests that consent on your first visit.

9. Security

We use technical and organisational measures suited to the risk, including TLS encryption in transit, encrypted storage for sensitive fields, need-based access controls, and periodic security reviews. Stripe handles payment card data exclusively, and Membrz Lda does not store it on its infrastructure.

10. Changes to This Policy

Material policy changes will appear with an updated "Last updated" date at the top of this page. Where legally required, we will request renewed consent before they take effect.

11. Contact

Membrz Lda
Rua Garrett 44, 2 Andar
1200-109 Lisbon, Portugal
Email: [email protected]
Phone: +351 21 340 5170