Legal

Privacy Policy & GDPR notice

How we collect, use and protect personal data for buyers, sellers and their staff.

1. Who we are

Groupie ("we", "us") operates the Groupie marketplace at groupie.ie, where independent businesses sell tickets, vouchers and gift cards that are redeemed by QR scan. For the data described in this notice we act as the data controller. You can contact us at any time at hello@groupie.ie.

2. What we collect and why

Seller applications — name, company name, email, phone and any message you send us. Used solely to assess your application and contact you about it. Lawful basis: your consent and steps taken at your request prior to entering a contract (Art. 6(1)(a) and 6(1)(b)).
Purchases — buyer name, email and order details, so we can issue your QR pass and PDF voucher and support you if something goes wrong. Lawful basis: performance of a contract.
Payments — card details are entered directly with Stripe and never reach our servers. We store only the payment reference and status.
Account data — email and authentication details for sellers and their staff scanner logins. Lawful basis: contract and legitimate interests in securing the service.
Redemption records — when and where a pass was scanned, and remaining gift-card balances. Lawful basis: contract and fraud prevention.

3. Who we share it with

We use a small number of processors, each bound by data-processing terms: Stripe (payment processing), Supabase (database and authentication hosting), Lovable (application hosting and email delivery). When you buy from a seller, that seller receives the order details they need to honour your purchase and is an independent controller for their own use of it. We do not sell personal data and we do not use it for advertising.

4. International transfers

Some processors may handle data outside the European Economic Area. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

5. How long we keep it

Seller applications that don't proceed: deleted within 12 months.
Order, voucher and redemption records: retained for 7 years to meet tax and accounting obligations.
Account data: retained while the account is active, then deleted within 90 days of closure.

6. Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, withdraw consent at any time, and receive your data in a portable format. Email hello@groupie.ie and we'll respond within one month. If you're unhappy with our response you can complain to your national data protection authority (in Ireland, the Data Protection Commission).

7. Cookies and security

We use only strictly necessary cookies and local storage to keep you signed in and to keep scanner devices logged in — no advertising or third-party tracking cookies. Data is encrypted in transit, access is restricted per shop at the database level, and sensitive credentials such as payment keys are stored encrypted.

8. Changes

We may update this notice as the service evolves. Material changes will be highlighted on this page. Last updated: 16 August 2026.