Privacy Statement

1. Our role

Tryfe B.V. operates Flux and is responsible for the personal data it processes to provide and secure the platform. That includes accounts, authentication, event signups, payments, communications, support, and security.

Event organizers may also process attendee data for their own events. In those cases, the organizer may be separately responsible for how it uses attendee data, for example for admission, event management, refunds, safety, or follow-up communication.

2. Personal data we process

Depending on how you use Flux, we may process:

1. your name
2. your phone number
3. your email address, if you verify or use one
4. your profile picture, if you upload one
5. your event signups, ticket type, check-in status, and group membership information
6. photos you take or upload in an event roll, and related metadata needed to show them
7. payment and refund information for paid events (web portal only)
8. event eligibility information, such as verified email-domain access
9. technical and security information, such as IP address, device or browser information, app installation identifiers, session identifiers, request logs, and security events
10. communications we send or receive in relation to your account, signup, payment, support request, or privacy request

Phone numbers are the primary way Flux identifies users.

Where logs contain personal data, Flux masks sensitive values such as phone numbers where applicable.

3. Why we process personal data

We process personal data to:

1. create and manage user access
2. verify phone numbers and email addresses
3. enable event signups and group access
4. show tickets and support event check-in
5. host and display event roll photos for participants and organizers of that event
6. send signup confirmations, verification messages, and service updates
7. process paid event checkouts, refunds, and payment administration
8. enforce capacity, eligibility, duplicate signup, and checkout rules
9. provide support and respond to requests
10. secure Flux, prevent abuse, and investigate errors or incidents
11. comply with legal, tax, accounting, and administrative obligations
12. handle complaints, disputes, and legal claims

4. Legal bases

We process personal data on the following legal bases:

1. Contract: to provide Flux, process signups, manage accounts, send confirmations, and support payments.
2. Legal obligation: for tax, accounting, payment, compliance, and legal recordkeeping obligations.
3. Legitimate interests: to secure Flux, prevent fraud and abuse, diagnose errors, enforce capacity and eligibility rules, support organizers, and handle disputes.
4. Consent: where specific consent is required by law, for example for certain device permissions in the mobile apps.

5. Payments

Paid events may be processed through Mollie B.V.. Mollie and the relevant banks or payment providers may process payment data under their own terms and privacy notices.

Flux stores payment and refund records needed to complete checkout, reconcile payments, handle refunds, prevent fraud, and meet compliance obligations.

Checkouts may expire after approximately 30 minutes. If payment succeeds but capacity is no longer available, Flux or the organizer may reject the signup and start a refund process.

6. Communications

Flux may send:

1. SMS verification codes
2. email verification messages
3. event signup confirmations
4. payment, checkout, refund, and service messages
5. support and security messages

Flux uses service providers such as Bird B.V. for SMS and email delivery.

7. Cookies and similar technologies

On the website, Flux only uses cookies that are necessary for authentication, security, session management, CSRF protection, and secure operation of the platform.

1. __Http-at: access token for web sessions
2. __Http-rt: refresh token for web sessions
3. __Secure-csrf: CSRF protection token readable by the browser
4. __Http-autht: temporary cookie used during phone verification
5. __Http-anon_id: anonymous cross-subdomain tracing cookie used for security, abuse prevention, diagnostics, and request correlation. Its default lifetime is one year.

The mobile apps may store session and security data on the device so you stay signed in. Flux uses these technologies for security and platform operation only, not for marketing or advertising.

8. Service providers

Flux uses trusted service providers to operate the platform, including:

1. Bird B.V. for SMS and email delivery
2. Mollie B.V. for payment processing
3. Hetzner Online GmbH for hosting and storage infrastructure
4. BunnyWay d.o.o. for content delivery and image optimization through bunny.net

These providers may only process personal data where needed to provide their services, comply with law, or protect their systems.

9. Retention

Flux keeps personal data only for as long as reasonably necessary.

By default, event registrations and payment records are kept for 2 years for compliance, administration, dispute handling, and financial recordkeeping.

Separately from account deletion, a user may ask that their attendance is hidden before the end of that period, unless Flux or an organizer needs to keep certain data for legal, payment, security, fraud prevention, accounting, or dispute reasons.

Technical logs are kept only as long as needed for security, diagnostics, and operations, unless longer retention is required for an incident, dispute, or legal obligation.

10. Security

Flux uses technical and organizational measures to protect personal data, including secure authentication, session protection, CSRF protection, restricted internal access, encrypted storage of sensitive merchant payment tokens, and masking of personal data in logs where applicable.

No system is perfectly secure. If you believe your account or data has been misused, contact us at privacy@onflux.nl.

To report a photo, profile, or other content on Flux as unlawful or abusive, email abuse@onflux.nl. To act on a report we may share what is needed to do so with the host of the event concerned, who can remove photos from that event’s roll.

11. Your rights

You may have the right to:

1. access your personal data
2. correct inaccurate data
3. request deletion of your account or data
4. request a data export
5. restrict or object to certain processing
6. withdraw consent where processing is based on consent
7. lodge a complaint with a data protection authority

You can delete your Flux account in the mobile app under Settings. That removes your account and associated personal data from active use on Flux, including your phone number and email address where stored for the account.

You can also request account or data deletion by emailing privacy@onflux.nl. We may need to verify your identity before handling your request.

In some cases we may need to retain certain data for legal, payment, security, fraud prevention, accounting, or dispute reasons, even after an account deletion request.

If you need a copy of your data and cannot find what you need in the product, email privacy@onflux.nl.

12. International transfers

Flux uses providers and infrastructure suitable for Netherlands and EU-facing services where possible. If personal data is transferred outside the European Economic Area, Flux will use appropriate safeguards where required by law.

13. Children

Flux is not specifically aimed at children. Events may have their own age or eligibility requirements. Organizers are responsible for making those requirements clear where relevant.

Flux does not set a platform-wide minimum age or parental-consent rule.

14. Changes

We may update this Privacy Statement as Flux develops. The latest version will be published on Flux.

15. Contact