Politique de confidentialité

AfghanVibes is a global ticket marketplace and event discovery platform for the Afghan community worldwide. Data controller: AfghanVibes Contact: [email protected] Website: https://afghanvibes.com

We collect the following personal data when you use AfghanVibes: Account data: Name, email address, password (encrypted) Purchase data: Ticket purchases, order history, payment status Payment data: Handled securely by Stripe — we never see or store your full card number Device & usage data: IP address, browser type, pages visited, time of visit (collected via server logs and analytics) Communications: Emails you send to us, support requests If you are an organizer, we also collect: • Organization name and description • Event details you submit • Payout bank account details (handled by Stripe)

We use your data to: • Process ticket purchases and send confirmation emails • Generate and deliver QR code tickets • Process payouts to organizers via Stripe • Send you relevant event updates and notifications (you can opt out anytime) • Improve our platform and fix bugs • Comply with legal obligations • Detect and prevent fraud

If you are in the European Economic Area (EEA), we process your data on the following legal bases: Contract performance: Processing your ticket purchase, sending your tickets, processing organizer payouts Legitimate interests: Improving the platform, preventing fraud, sending relevant event updates Legal obligation: Complying with tax and financial regulations Consent: Marketing emails — you can withdraw consent at any time by clicking "unsubscribe"

We share your data only where necessary: Stripe: Payment processing and organizer payouts. Stripe is PCI DSS Level 1 certified. Event organizers: Your name and email are shared with the organizer of events you purchase tickets for, so they can manage attendees and process refunds. Legal authorities: If required by law or valid legal process. We never sell your personal data to third parties.

We use essential cookies to keep you logged in and remember your preferences. We may also use analytics cookies to understand how the site is used. You can disable cookies in your browser settings, but some features may not work correctly without them.

We retain your personal data for as long as your account is active, plus: • Purchase records: 7 years (legal/tax obligation) • Support communications: 2 years • Account data: Until you request deletion You can request deletion of your account and data at any time by emailing [email protected].

If you are in the EEA, you have the following rights: Right of access: Request a copy of the personal data we hold about you Right to rectification: Request correction of inaccurate data Right to erasure: Request deletion of your data ("right to be forgotten") Right to restriction: Request that we limit how we use your data Right to data portability: Request your data in a portable format Right to object: Object to processing based on legitimate interests Right to withdraw consent: For marketing emails — unsubscribe at any time To exercise any of these rights, email us at: [email protected] We will respond within 30 days.

We take security seriously: • Passwords are encrypted with bcrypt • All data is transmitted over HTTPS (TLS) • Payment data is handled by Stripe (PCI DSS Level 1) • JWT tokens are signed with RSA keys • We regularly review and update our security practices No system is 100% secure. If you become aware of any security issue, please contact [email protected] immediately.

AfghanVibes operates from Sweden. Your data may be processed on servers in the European Economic Area (EEA) and by our service providers (Stripe, Vercel, Railway) who may process data outside the EEA. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (such as EU Standard Contractual Clauses).

AfghanVibes is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a prominent notice on the website. The "Last updated" date at the top reflects the most recent revision.

For privacy questions or to exercise your rights: [email protected] If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten — IMY): Website: www.imy.se