Data and privacy

KAIF EMPIRE S.R.L. · bijgewerkt 27.09.2026

What we record, why, and who receives it. The data controller for the platform is KAIF EMPIRE S.R.L.; the organiser of a party is a separate controller for their own guests.

1. Who is responsible

We are responsible for the platform: KAIF EMPIRE S.R.L., details at the bottom of the page.

We pass the guest's name and email to the organiser of the party the ticket is for — otherwise they cannot run the door list or answer the guest. From that point the organiser handles this data themselves and answers for it themselves, including their own mailings.

2. What we collect

From a guest: the name entered at checkout, the email address, what was bought and when, the amount and currency, and whether the ticket was scanned at the door. We never see the card number: Stripe takes it.

From an organiser: name, brand name, email, storefront address, and the identifier of their Stripe account. Identity documents go to Stripe and never reach us.

An organiser's guest base: contacts the organiser uploads themselves (name, email, phone, city). Here we process data on the organiser's behalf: they decide what it is for, we store it, do not use it ourselves and do not pass it on. To be removed from such a base, write to the organiser or to us — we will pass the request on and follow up. The base is deleted together with the organiser's account.

When booking a table: name, phone number, number of guests and arrival time; email if you leave it. For an online deposit, also the amount and whether it was paid.

Technical: anonymous counters of views and clicks per party — daily numbers only. When someone subscribes for new dates we store a fingerprint of the network address (not the address itself) to hold back spam.

3. Legal basis

• Performing the contract — issuing the ticket, sending it, letting the guest in.
• Legitimate interest — protection against password guessing and spam, sales counters for the organiser, handling chargebacks.
• Legal obligation — keeping sales records for accounting and tax.
• Consent — for emails about new dates, and for emails about other organisers' parties in your city if you ticked “Send me parties in my city from ONETAP” at checkout. The box is unticked by default and the purchase works the same without it. You can unsubscribe through the link in any email or by writing to us; we keep a record of when and to which wording you agreed.
• Consent to the organiser — for emails from the party's organiser, if you ticked “Get news from <organiser>” at checkout. It is also unticked by default. The organiser writes and sends these emails from the Mailings section; we deliver them on the organiser's behalf. Every email has an “Unsubscribe” link — after it that organiser can no longer write to you.

4. Who receives it

• Stripe — taking payments, verifying the organiser, refunds.
• Cloudflare — the site and the database.
• Resend — sending ticket emails and organisers' mailings; for our domain it runs in the European region. For mailings Resend tells us when an address does not exist or someone marked an email as spam, and we stop writing to such addresses.
• Google — the map in the “How to get there” block on the event page. It loads only when you open that block yourself; Google then receives your network address and browser details, as with any visit to Google Maps.
• The organiser — names and emails of the guests of their party; for a table booking, also the phone number, number of guests and arrival time.
• Anthropic — the assistant in the organiser's account: it receives the organiser's question and aggregate figures of their parties (sales, attendance, price phases). It does not receive guests' names, emails or phone numbers.

We do not sell data and do not pass it to advertising networks. The platform runs no advertising or analytics trackers of its own.

Organiser pixels. An organiser can add a Meta or TikTok pixel to their own pages (event, storefront, post-payment page) to see which of their ads bring guests. The pixel only loads if you click “Allow” in the banner; otherwise nothing is sent to Meta or TikTok from the page. It receives the page address, your browser and device data, and the fact of a view, a checkout start and a purchase with its amount. Your name, email and phone are not passed to it. The organiser is responsible for this processing together with Meta Platforms Ireland Ltd. or TikTok Technology Ltd. (Art. 26 GDPR; legal basis: your consent, Art. 6(1)(a) GDPR; data may reach the USA). Consent applies to one organiser and can be withdrawn with the “Turn off ad pixels” button at the bottom of their page.

Brands sponsoring parties, once that programme runs, receive only aggregate figures — how many guests came in — with no names, email addresses or anything else that identifies a person.

5. Where data travels

Stripe, Cloudflare, Google and Anthropic are international services and may process data outside the European Economic Area under the standard contractual clauses approved by the European Commission.

6. How long we keep it

An order and its ticket are accounting records of a sale, so we keep them for 10 years after the end of the year of the sale — the period set by Romanian accounting law (Legea contabilității nr. 82/1991). Anonymous counters stay — no person can be found through them. A table booking without payment is kept for 12 months after the party, then deleted; a booking with a deposit is kept like an order, as a payment record. An organiser's account is kept while it is in use, and closed on request.

7. Cookies

ONETAP itself sets only the cookies the service cannot work without — the law does not require consent for them, which is why there is no general banner.

• sid — the organiser dashboard session, 30 days.
• gsid — the guest account session, 180 days.
• door and dlang — the door scanner and its language, for the shift.
• gbind — signing in with Google or Apple, a few minutes.
• rcode — which member of the organiser's team shared the link, until the browser is closed.
• otlang, otland — the chosen language, one year.
• otui — light or dark theme, one year.

An organiser may add advertising pixels (Meta, TikTok) to their own page. That page then shows a choice, and the pixel loads only after “Allow”. The choice is kept in the otpx_… cookie for 180 days; delete it in your browser to change your mind. The organiser, together with Meta or TikTok, is responsible for the pixel data.

8. Your rights

You may ask for a copy of your data, correct it, delete it, restrict processing, take it in a machine-readable form, or object to processing. Write to support@onetap.now — we answer within a month.

If the answer does not satisfy you, you may complain to a supervisory authority: in Romania that is ANSPDCP (dataprotection.ro), or to the authority of your own country.

Data already held by an organiser is theirs to handle: address requests about their mailings to them.

9. Children

The platform is not meant for children: the parties sold through it normally carry an age limit, and tickets are bought by adults.

Bedrijfsgegevens