Privacy policy

This policy explains what personal data Fuse processes through fuse.bg, why, who it is shared with and what your rights are under the General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act.

1. Controller

The data controller is SALSA PLUS Ltd. (САЛСА ПЛЮС ЕООД), company no. (ЕИК) 208499233, 12 Graf Ignatiev St, 1000 Sofia, Bulgaria. For questions about personal data: club@fuse.bg, phone +359 877 762 222.

2. What we process and why

• When you buy a ticket: name, email, phone (optional), the guests' names per place, the note on the order, the chosen tickets and the amount, the order number, the form language, the time of payment, the Stripe payment reference and the ad campaign that brought you to the site (if the link carries one). Basis: performance of the contract with you (Article 6(1)(b) GDPR).
• At the door: which guest came in and when, by the name on the ticket, and a name entered by the staff when a place has none. Basis: performance of the contract and our legitimate interest in controlling entry and preventing ticket misuse.
• When you send a private-party inquiry: name, phone, email, date, number of guests and your message. Basis: steps at your request before a contract.
• If you accept the advertising cookies: the Meta Pixel tells Meta which pages of the site you open and when, which tickets you add to the cart and buy (type, number and amount, without your name or contact details), from which browser and device, your IP address and an identifier from a cookie, so that we can measure and target our Facebook and Instagram ads. Basis: your consent (Article 6(1)(a) GDPR and Article 4a of the Bulgarian Electronic Communications Act), which you can withdraw at any time.
• Payment records (amount, date, payment reference) are also kept because the law requires it (Bulgarian Accountancy Act, Tax and Social Security Procedure Code).
• We never receive your card details: they are entered on Stripe's page.

3. Who receives the data

• Stripe Payments Europe, Ltd. (Ireland) processes the payment and is an independent controller for the card data; it may transfer data to Stripe, Inc. (USA) under the GDPR safeguards (standard contractual clauses and the EU-US Data Privacy Framework).
• SuperHosting.BG Ltd. (Bulgaria) hosts the site, the database and the mail through which we send the confirmations.
• The door staff see the names on the ticket at the check.
• Meta Platforms Ireland Ltd. (Ireland) receives the Meta Pixel data only if you have accepted the advertising cookies. Fuse and Meta are joint controllers for collecting and transmitting it; from there Meta processes it under its own policy (https://www.facebook.com/privacy/policy) and may transfer it to Meta Platforms, Inc. (USA) under the EU-US Data Privacy Framework.
• Google (Google Ireland Ltd.) receives data only if you press "Show the map" – then Google Maps loads with its own cookies. Videos from Facebook (Meta Platforms Ireland Ltd.) and YouTube (Google) likewise load only after you press play.
• Public authorities where the law requires it.

We do not sell data. Only the Meta Pixel data is passed on for advertising, and only with your consent.

4. How long we keep the data

• Orders, tickets and guest names: up to 12 months after the event, to settle refunds and disputes; then they are deleted or anonymised.
• Payment records (amount, date, payment reference): 10 years, as the Bulgarian Accountancy Act requires.
• Party inquiries: until the correspondence is closed, at most 12 months.
• The staff action log (who ticked a guest off at the door): 12 months.
• Your cookie choice: 6 months, then we ask again.

5. Cookies and local storage

There are advertising cookies only if you accept them in the banner; until then nothing from Meta loads.

• The Meta Pixel (Meta Platforms Ireland Ltd.) switches on after "Accept" and sets the _fbp and _fbc cookies (up to 90 days), by which Meta links the visit to the Facebook or Instagram ad. The ticket page and the return from the payment are never reported to Meta.
• Your choice is kept in the fuse_consent cookie for 6 months. You change it or withdraw your consent under "Cookie settings" at the bottom of the page; if you decline, the pixel stops and its cookies are deleted.
• The ticket cart is kept in your browser's local storage (localStorage) on your device only, until you complete the order or clear it.
• A session cookie is set only when signing in to the administration (staff only); the on-page editing mode uses sessionStorage on the staff member's device.
• Visit statistics are our own and cookie-free: to count the day's unique visits, the IP address and browser are turned into a hash with a random value that changes daily; the IP address itself is never stored. We also count visits per ad campaign – from the utm parameters in the address, without cookies.
• Google Maps and the videos from Facebook and YouTube set their own cookies only after you press the button that loads them; nothing of theirs loads before that.
• The payment page is Stripe's and has its own cookie policy.

6. The ticket page

The ticket is available at an address with a unique code to anyone who knows it, and shows the guests' names per place so that anyone in the group can show it at the door. Do not publish the code. The names can be changed only with the buyer's private link.

7. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, portability and objection, and to withdraw consent you have given. Write to club@fuse.bg; we reply within one month. If you believe we are violating your rights, you can lodge a complaint with the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, www.cpdp.bg, kzld@cpdp.bg.

8. Security and changes

The site runs over HTTPS only, access to the data is limited to staff with individual accounts, and actions in the administration are logged. This policy may change; the current version is always on this page with the date of the last change.