1. Data Controller
For the personal data described in this policy, the data controller is:
For data that event organisers collect and manage through ShowIQ, such as their guest lists or the sign-ups on their pre-registration pages, the organiser is the controller and ShowIQ processes the data on their behalf. Section 3 explains how that works.
2. Personal Data We Collect
We collect the following categories of personal data:
- Account data — your name and email address, collected when you register or log in to ShowIQ.
- Billing data — the company name and invoicing details needed to invoice you for the events you order. We do not process card payments and do not store card numbers or bank details on our servers.
- Event data — data organisers enter into the platform, including artist profiles, crew records, guest list entries, accreditation requests and rider information. This data relates to the events they manage and may include personal data of third parties (artists, crew, guests).
- Form submissions — what you enter in a public form that an organiser runs on ShowIQ, such as a pre-registration page, a guest-list form or a crew sign-up form. Usually that is your name and email address, plus whatever else the organiser asks for, such as your phone number, country, age or answers to their questions. If the form asks for your consent, we also store whether and when you gave it and the wording you agreed to.
- Technical data — session tokens stored in strictly necessary cookies to keep you logged in; your IP address, used briefly to limit abuse of logins and public forms (for example, a maximum number of sign-ups per hour) and deleted automatically within a day after that time window ends; technical details of errors (browser, page and error message) and, for a small share of sessions and for sessions in which an error occurs, a recording of how the page behaved in which all text and form input is masked, so we can find and fix problems; and anonymous performance measurements without cookies. We do not use advertising or analytics cookies.
3. Data We Process on Behalf of Organisers
Organisers (our clients) use ShowIQ to run their events. If you appear in an organiser's event, as an artist, crew member or guest, or because you filled in one of their public forms, the organiser is the controller of your data. ShowIQ processes it on their behalf and on their instructions.
- A pre-registration page states which organiser collects your details and, where the organiser has provided one, links to the organiser's own privacy statement. That statement explains what they use your details for, for example to send you the ticket sale link or updates about the event.
- If a form asks for your consent, for instance to receive emails about the event, we store the moment you gave it and the exact wording, so the organiser can show what you agreed to.
- ShowIQ does not use this data for its own purposes. We do not send you marketing, do not sell the data and do not combine it with data from other organisers.
- Organisers can view and export the data, for example to their own mailing tool. From that moment the organiser's own privacy statement applies to that copy.
- Questions and requests about this data are best sent to the organiser. If you contact us instead, we forward your request to the organiser without undue delay and help them respond.
4. How and Why We Use Your Data
We process personal data on the following legal grounds under the GDPR:
- Performance of a contract — to create and manage your account, provide the ShowIQ platform and invoice you for the events you order.
- Legitimate interests — to keep the platform secure, prevent fraud and abuse (including limiting the number of requests per IP address) and find and resolve technical issues.
- Legal obligation — to comply with Dutch and EU financial record-keeping requirements.
For the data in Section 3, the organiser decides what it is used for and on which legal ground, for example your consent to receive emails about their event. ShowIQ processes that data only to provide the platform to the organiser.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
6. Data Retention
We retain personal data for as long as necessary to provide the service and to comply with our legal obligations. In practice:
- Account and billing data is kept for 5 years from the end of your contractual relationship with ShowIQ, in line with Dutch statutory retention requirements for financial records.
- Event data, including form submissions, is kept on the organiser's instructions. Organisers can delete a single submission, a whole list or an entire event at any time, which removes the data from the platform; it may remain in our hosting provider's backups for a short period until those are overwritten. Event data an organiser has not deleted is removed together with their account, and no later than 5 years after the end of the relationship.
- IP addresses used to limit abuse are deleted automatically within a day after the short time window they count towards.
- After these periods, personal data is securely deleted or anonymised.
- You may request earlier deletion of your account data; see Section 8 for your rights.
8. Your Rights Under the GDPR
As a data subject, you have the following rights:
- Right of access — obtain a copy of the personal data we hold about you.
- Right to rectification — have inaccurate data corrected.
- Right to erasure — request deletion of your personal data, subject to our legal retention obligations.
- Right to restriction — ask us to limit processing in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on your consent, withdraw it at any time.
To exercise any of these rights, email hello@showiq.nl. We will respond within 30 days.
For data we process on behalf of an organiser (Section 3), such as a pre-registration or a guest-list request, the organiser handles your request. You can contact them directly; if you write to us, we forward your request to them and help them respond. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. International Data Transfers
Some of our processors may process data outside the European Economic Area. In all such cases, we ensure that appropriate safeguards are in place, including the European Commission's Standard Contractual Clauses (SCCs), to protect your personal data to the standard required by EU law.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice within the platform at least 14 days before they take effect. The “Last updated” date at the top of this page always reflects the most recent version.
11. Contact
Questions about this Privacy Policy or our data practices? Contact us at: