Privacy Policy

Aalaap Limited — aalaap.app

Last updated: 11 August 2026 | Version 1.0

---

1. Who we are

AALAAP LIMITED ("Aalaap", "we", "us", "our") is a company registered in England and Wales under company number 17354026, with its registered office at 33 Northolme Road, London, N5 2UU, United Kingdom.

AALAAP LIMITED operates and trades as Aalaap, providing the platform at aalaap.app (the "Platform").

We are the data controller for the personal data described in section 3 of this policy.

We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER — INSERT ONCE ISSUED].

Contact us about privacy at aalaap.app@gmail.com.

We have not appointed a Data Protection Officer, as we are not required to. Privacy queries are handled by the directors of Aalaap Limited.

2. Controller and processor roles — important

Aalaap is a marketplace. Who controls your data depends on the situation:

• Aalaap is the controller for: account registration data, Platform usage and analytics, security and moderation records, support correspondence, and our own marketing.
• The event Organiser is the controller for attendee data collected through their event — such as who registered, ticket details and any information you give them. Aalaap acts as their processor for that data.

This means that if you attend an event, the Organiser decides how your data is used in relation to that event, and you should also read the Organiser's own privacy information. If you cannot find it, contact us and we will help you reach them.

3. What we collect

Account data — name, email address, password (stored hashed, never in plain text), account type, and for Organisers the business or performing name and any details you add to your profile.

Event and ticket data — events you create or register for, ticket type and quantity, order reference, attendance and check-in status, and any information you provide in a registration form.

Payment-related data — order amount, currency, timestamp, Stripe identifiers, payment status and refund status. We never receive or store your full card number, CVV or bank account details. Card data goes directly to Stripe, which is PCI-DSS compliant.

Communications — emails and support messages you send us, messages sent through in-app support or the help button, and our replies.

Content you upload — event descriptions, artwork, photographs, audio and video, and any personal data contained within them.

Technical data — IP address, browser type and version, device type, operating system, time zone, referring page, pages viewed, and actions taken on the Platform. This comes from server logs generated automatically when you use the Platform. We do not use any third-party analytics or tracking service, and we do not build advertising or behavioural profiles.

Cookies and similar technologies — see section 8.

Special category data. We do not ask for special category data (such as health, religious belief, ethnicity or sexual orientation). Please do not include it in free-text fields. If you tell an Organiser about an access requirement, that may be health data and is processed by the Organiser as controller, on the basis of your explicit consent.

Children's data. The Platform is not directed at children. Organiser accounts require you to be 18 or over. Where a parent or guardian buys a ticket for a child, we process only the minimum necessary. If we learn we hold a child's data without a proper basis, we will delete it.

4. How we use it, and our lawful bases

Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You may object — see section 9.

5. Marketing

We will only send you marketing emails where you have consented, or where you have bought from us and we are marketing similar services under the soft opt-in in the Privacy and Electronic Communications Regulations 2003. Every marketing email has an unsubscribe link, and you can opt out at any time without affecting transactional emails you need to receive.

Organisers may email their own attendees. That is the Organiser's responsibility as controller, and you should opt out with them directly.

6. Who we share data with

We share personal data only where necessary, with:

• Event Organisers — where you register for or buy a ticket to their event, they receive your name, email and order details so they can admit you and contact you about the event.
• Stripe Payments Europe Limited — payment processing, fraud screening and payouts. Stripe is a separate controller for its own compliance purposes; see stripe.com/privacy.
• Vercel Inc. — hosting of the Platform and delivery of content.
• Neon Inc. — database hosting and storage.
• Resend (Plus Five Five, Inc.) — delivery of transactional and, where applicable, marketing email.
• Professional advisers — accountants, insurers and lawyers, where needed.
• Authorities — the police, National Crime Agency, Internet Watch Foundation, Ofcom, ICO, CMA, HMRC, courts or other bodies, where required by law or necessary to prevent crime or protect a person from harm.
• A buyer of the business — if Aalaap is sold or merged, data may transfer, subject to the same protections.

We do not sell personal data, and we do not share it with advertisers for their own purposes.

7. International transfers

Some of our providers are based outside the UK, or process data outside the UK. Vercel, Neon and Resend are United States companies. Stripe Payments Europe Limited is established in Ireland.

Where personal data is transferred outside the UK, we rely on an appropriate safeguard — an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified), the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. You can ask us which safeguard applies to any specific transfer.

8. Cookies

We use strictly necessary cookies only. These keep you logged in, maintain your session, protect the Platform against fraud and abuse, and remember essential settings. Cookies of this kind are exempt from the consent requirement in the Privacy and Electronic Communications Regulations 2003, because the Platform cannot work without them. For that reason we do not show a cookie consent banner.

We do not use advertising cookies, tracking cookies, third-party analytics cookies, social media pixels, or any similar technology that follows you across other websites.

Where you make a payment, Stripe sets its own cookies on the checkout for fraud prevention and security. That processing is governed by Stripe's own privacy notice at stripe.com/privacy.

You can block or delete cookies through your browser settings, but blocking strictly necessary cookies will stop parts of the Platform working.

If we ever introduce non-essential cookies, we will ask for your consent first and update this policy before doing so.

9. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• access a copy of the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances;
• restrict processing in certain circumstances;
• data portability — receive data you gave us in a machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time;
• not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions. Automated content screening and fraud flags are always reviewed by a person before an account is closed.
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email aalaap.app@gmail.com. We will respond within one month, extendable by two further months for complex requests, and will tell you if we need more time. There is no fee unless a request is manifestly unfounded or excessive. We may ask you to verify your identity.

If your request concerns data held by an Organiser as controller, we will pass it to them and help where we can.

10. How long we keep data

We delete or anonymise data once the period ends, unless we must keep it longer for a legal claim, regulatory requirement or investigation.

11. Security

We protect data with encryption in transit (HTTPS/TLS), hashed passwords, access controls limiting staff access to what is needed, authentication on administrative systems, logging of administrative actions, regular backups, and vetted providers under written data processing terms.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours of becoming aware, and will tell you directly without undue delay where the risk to you is high.

12. Complaints

How to complain to us. Email aalaap.app@gmail.com with "Data protection complaint" in the subject line. You can also use the contact form on the Platform. We will acknowledge your complaint within 30 days of receiving it, tell you who is handling it, investigate, and give you a substantive response and the outcome. Every complaint and the action taken on it is logged. You do not need to use any particular wording, and there is no charge.

How to complain to the regulator. You also have the right to complain to the UK supervisory authority. We would ask you to raise it with us first, but you are not required to:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk

13. Changes to this policy

We will update this policy as the Platform, our providers and the law change. The "Last updated" date and version number at the top show the current version. Where a change materially affects how we use your data, we will tell registered users by email or in-app notice before it takes effect, and where the law requires it we will seek your consent. Previous versions are kept and available on request.

14. Contact

AALAAP LIMITED 33 Northolme Road, London, N5 2UU, United Kingdom Company number: 17354026 Registered in England and Wales ICO registration: [ICO REGISTRATION NUMBER — INSERT ONCE ISSUED] Email: aalaap.app@gmail.com

---

This document is a draft prepared for review. It has not been reviewed by a qualified solicitor and does not constitute legal advice.