Legal

Privacy Policy

Last updated 21 October 2026

1. Controller

V.O.F. HEAT ENTERTAINMENT (Vennootschap onder firma (V.O.F.)), trading as Vibra (“we”, “us”), is the controller of personal data collected on this site. Registered office: Bercylaan 111, 1031 KP Amsterdam, the Netherlands. KvK 42066099. VAT NL869551978B01.

Contact the controller: privacy@vibra-pulse.com. Statutory details: legal notice.

This policy covers the Vibra website and member platform at vibra.amsterdam and vibra-pulse.com. It is written for visitors in the EEA/UK (GDPR) and Brazil (LGPD — Lei nº 13.709/2018).

2. What we collect

• Account: email, password (handled by our auth provider), display name, username, and profile details you choose to add. If you sign in with Google, we also receive your Google name, email, and profile photo.
• Ticket purchase: the name printed on the ticket, email, mobile number, and date of birth, to confirm you are 18+ and to deliver the ticket. Guests also give the country and city where they live. Members confirm their date of birth the first time they buy; we keep it on the account.
• Guest list: your display name on an event’s “who’s going” list. Vibra is an LGBTQ+ community, so that list can reveal information about your sexual orientation or gender identity. If you bought a ticket before 22 October 2026, your name stays on that list. From that date on, a new buyer’s name stays off until they switch it on in their profile. Anyone can turn it off again. A separate switch, also off until you turn it on, lets other members find you by email. That email is not shown on your public profile.
• Instagram: if you connect Instagram, we store the username and Instagram user id so the profile can show the account is linked. You can disconnect it.
• Pulse and activity: points, level, check-ins, ticket orders, and similar product events needed to run loyalty and events.
• Payments: Stripe processes card data. We receive payment status, amount, and identifiers needed to issue tickets — not full card numbers.
• Technical: IP address and basic request logs on our host (Vercel) and database (Supabase), for security and abuse prevention.
• Cookies: a consent cookie, plus analytics/marketing cookies only if you allow them. See the Cookie Policy.
• Support: the name, email, and message you send through the support desk, so we can reply.
• Partnerships: the name, email, event or venue, and message you send through the partners page, so we can reply about selling tickets or working together.

3. Why we use it (purposes and legal bases)

• Providing the service — accounts, events, tickets, Pulse, and member features. GDPR: contract / steps prior to contract (Art. 6(1)(b)). LGPD: execution of a contract (Art. 7, V).
• Support — reading and replying to messages you send us. GDPR: contract or legitimate interests (Art. 6(1)(b) or (f)). LGPD: execution of a contract or legitimate interest.
• Partnerships — reading and replying to notes from the partners page, as a step toward selling tickets or working together. GDPR: steps prior to a contract or legitimate interests (Art. 6(1)(b) or (f)). LGPD: execution of a contract or legitimate interest.
• Promotional emails — events, perks, Pulse, and related offers, only if you opt in. GDPR: consent (Art. 6(1)(a)). LGPD: consent (Art. 7, I). You can withdraw at any time.
• Guest list and email search — your name on an event list. Buyers before 22 October 2026 stay listed. Later buyers appear only after they switch it on. Email search works only after that separate switch. GDPR: explicit consent, including for data that can reveal sexual orientation or gender identity (Art. 6(1)(a) and Art. 9(2)(a)). LGPD: consent for sensitive data (Art. 11, I). Withdraw it in your profile; that stops new display and does not affect a ticket you already bought.
• Running the site and keeping it secure — GDPR: legitimate interests (Art. 6(1)(f)). LGPD: legitimate interest (Art. 7, IX) and/or compliance with a legal obligation.
• Legal, tax, and accounting — invoices, VAT, and dispute records. GDPR: legal obligation (Art. 6(1)(c)). LGPD: legal obligation.
• Measurement (Google Tag Manager / Analytics) — only with cookie consent. GDPR: consent (Art. 6(1)(a) and ePrivacy). LGPD: consent.

4. Who we share with

We do not sell your personal data. We share it only like this:

• Supabase (database and auth) — stores accounts and product data.
• Vercel (hosting) — serves the site and API.
• Stripe — payment processing when you buy tickets. We do not receive full card numbers.
• The event organiser — the name, email, and mobile number on tickets they sell, so they can admit you and handle a refund. For that door list they are a separate controller, not a Vibra processor.
• Other members — your display name on a guest list if you bought before 22 October 2026 or you later switched it on, and your email in member search only when you have switched that on.
• Google — sign-in when you choose “Continue with Google”, and Tag Manager / Analytics only if you accept analytics or marketing cookies.
• Meta — Instagram username and user id, only if you connect Instagram.
• An email provider, when we send transactional or opted-in promotional messages.

Some processors are outside the EEA and Brazil (for example the United States). Where required we rely on Standard Contractual Clauses or an equivalent transfer tool, plus the consent you gave for cookies/email.

5. How long we keep it

Account and product data are kept while your account is active and for a reasonable period afterward if needed for legal, tax, or dispute purposes. Ticket and payment records are kept as long as tax and consumer-law rules require. A guest-list or email-search switch is a setting on your account: turning it off takes your name or email off those surfaces. Marketing contacts are kept until you unsubscribe or ask us to delete them. Consent records are kept as long as needed to show we had a valid opt-in. Server logs are kept for a short security window.

6. Your rights

GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may complain to the Dutch AP (autoriteitpersoonsgegevens.nl) or your local DPA.

LGPD (Brazil): confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excess data, portability, information about sharing, information about the possibility of refusing consent and consequences, and revocation of consent (Art. 18). You may complain to the ANPD (gov.br/anpd).

To exercise rights, email privacy@vibra-pulse.com. We will respond within the legal time limits (as a rule, one month under the GDPR). Withdrawing consent does not affect processing that already happened.

7. Children

This site is for adults (18+). We do not knowingly collect data from children.

8. Security

Access to personal data is restricted to operators who need it. Auth and database access go through our providers’ security controls. No method of transmission is 100% secure.

9. Changes

We will update this page when our practices change. For material changes to marketing or new purposes, we will ask for consent again where the law requires it.