Privacy · Datenschutz
Privacy policy
What we process, why we need it, who receives it and when it is erased – for everyone who books, orders, asks or sells here.
Last updated: 29 September 2026 · Auf Deutsch lesen (verbindliche Fassung)
The short version
- When you book a ticket or order something, your contract is with that organizer or seller (“the seller”) – not with us. The seller is responsible for your order details; we process them on the seller’s behalf. Who the seller is appears on every listing, at checkout, on your order page, on the ticket and in every email.
- Your money goes straight to the seller – by bank transfer or through the seller’s own PayPal or Stripe account. No payment passes through us, and no card or bank details are typed into this site.
- The name, email address and other contact details on an order are erased automatically 30 days after the event (details in section 5).
- Visits are only counted if you explicitly agree. No advertising, no selling of data, no profiles across sellers.
1. Controller and contact
The controller under the General Data Protection Regulation (GDPR) for this website is:
Milan Adhikari
Donnersbergring 26
64295 Darmstadt
Deutschland
Email: support@martnepali.com
Contact form: www.martnepali.com/contact
MartNepali is a free platform run by a private individual (see the legal notice). “We” and “us” below mean that operator.
We have not appointed a data protection officer, as there is no legal obligation to do so. For any question about your data, reach us directly by email to support@martnepali.com or through the contact form.
2. Who is responsible for what?
There are two roles on MartNepali, depending on what you do:
- We are the controller for running the website itself and for the platform’s own features: page visits, security, cookies and consent, the customer account, reviews, the waitlist, the AI helper, the Ask bar and the help bot, the contact form, and the data of organizers and sellers themselves.
- The seller is the controller for everything that belongs to your purchase: orders and bookings, tickets, matching payments, entry and collection, standing orders, the seller’s “keep me posted” list, customer card and referral programme, and questions you send the seller through the question form. We process this data as a processor under Art. 28 GDPR, on the basis of a data processing agreement and only on the seller’s instructions. The seller’s name, address and legal representative are shown on every listing, at checkout, on your order page, on the ticket and in every email about your order.
You can send requests about data a seller is responsible for to the seller or to us – we forward them to the seller without delay and help them answer. The sections below explain those processing operations too, so you can see in one place what happens to your data.
3. Visiting the site, hosting and security
When you open a page, the server necessarily processes your IP address, the date and time, the address (URL) requested and your browser’s identifier (user agent). These appear in the server logs.
Purpose and legal basis
Delivering the website, keeping it stable, finding faults and fending off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the platform.
Hosting
The platform is hosted by Render Services, Inc. (San Francisco, USA); the servers are in Frankfurt am Main, Deutschland (EU). Your data is therefore stored in the EU. As Render is a US company, access from the USA in individual cases (for example for support or maintenance) cannot be ruled out. Render uses the network of Cloudflare, Inc. (San Francisco, USA) to deliver the site and protect it against overload attacks. Both act as processors. Where this involves a transfer of data to the USA or another third country, it takes place on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR).
Abuse protection
To protect forms and sign-ins against floods of requests, we count requests per IP address – only in the server’s memory, never in the database; the counters expire after a short time or on every restart. For the daily limits on AI features we store only a hash of the IP address, salted afresh every day (the address cannot be read back from it); these entries are deleted after about two days.
Storage period
The hosting provider keeps server logs only for a limited period and then deletes them automatically. We look at them only when there is a reason, such as a fault or an attack.
5. Tickets and orders
The seller is the controller; we process the data on their behalf (section 2).
What data
Required are your name and your email address. Optional, depending on the listing, are a phone number, the payer’s name (if different) and a note to the seller. Then there is the order itself: tickets or items and options chosen, seat, table or pickup slot, prices, discount and referral codes, payment, entry and collection status.
Purposes
- to send you your ticket or collection code – and to send it again if it goes missing;
- to match your payment: your order gets a short reference like TICKETS-AB12CD34, by which the seller recognises your transfer;
- to check you in at the door or at collection;
- to send you the emails about your order: confirmation with ticket, payment instructions, at most one payment reminder and, for goods, “ready to collect”.
The QR code on the ticket holds a random code and nothing else – not your name, not your email. Whoever scans it at the door learns only whether the ticket is valid and unused. Your order page opens only through the personal, signed link in your email or through your customer account.
Legal basis
Art. 6(1)(b) GDPR (the contract between you and the seller, or steps towards it).
Who sees what
- The seller sees your details and what you ordered – they need them to give you your ticket or your goods.
- We, as processor, access them only where needed to run the platform, fix faults or support the seller.
- Emails are sent through Twilio SendGrid (section 23). Nobody else receives your data; we sell no data, and an order puts you on no mailing list.
Erasure
Name, email address, phone number, payer’s name and your note are overwritten automatically 30 days after the date of the event. For goods this happens 30 days after collection, and at the latest 365 days after payment even if you never collect; for listings without a date, 365 days after the order. This is not a flag but a real overwrite – the old values are gone. What remains is anonymous counts and amounts, so the seller’s books still add up. The data disappears from backups within 30 days at the latest.
6. Payment
You pay the seller directly; MartNepali receives no money and charges no fee.
- Bank transfer: we show you the seller’s bank details (IBAN) and the payment reference. You never enter your own bank details anywhere on this site.
- PayPal: if the seller offers PayPal, PayPal’s script is loaded only when you click “Pay with PayPal”; PayPal then technically receives your IP address and browser data. You pay in PayPal’s own window, into the seller’s account. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
- Stripe: if the seller offers Stripe, we send you to the checkout page of the seller’s Stripe account and pass on your email address and the order reference. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
PayPal and Stripe are the seller’s payment providers and process your payment data as independent controllers under their own privacy notices; both may also transfer data to the USA. From them we receive only whether, and under which reference, the payment was made. The legal basis for passing your details on is Art. 6(1)(b) GDPR.
7. Customer account
An account is optional; you can order without one. With one, you see every order that belongs to your confirmed email address, and your basket follows you between devices. We are the controller.
- Sign-in by emailed code: we send you a six-digit code valid for ten minutes. We store your email address, your name (if you give it), when you last signed in and your saved basket.
- “Sign in with Google”: if you choose it, we send you to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We pass no data about you to Google, but Google learns from the sign-in itself that you are signing in to MartNepali. From Google we receive your name, email address and Google account ID. Google may also transfer data to the USA; Google’s privacy notice applies.
- The sign-in cookie customer_session lasts 60 days or until you sign out.
Manage it yourself: on /account you can download your data as a file (JSON) and delete your account at any time. Accounts nobody has signed in to for 730 days are deleted automatically, basket included. Your orders are not affected – they follow the periods in section 5.
The legal basis is Art. 6(1)(b) GDPR (providing the account you asked for).
8. “Keep me posted” – a seller’s announcements
At checkout there is an optional box asking whether that one seller may tell you when they announce something new. It is never pre-ticked, and your order works exactly the same without it. The seller is the controller; we send on their behalf.
Double opt-in: ticking the box does not subscribe you by itself – anyone could type anyone’s address. You get one confirmation email, and only the button in it puts you on the list. No press, no subscription; unconfirmed requests are deleted after 30 days.
Once you confirm, we keep your email address – the address alone, not your name – with the time of your consent, for exactly one job: that one seller’s announcements, at most one email per new listing. Because you asked for it, this address outlives the after-event erasure and stays until you unsubscribe.
Every announcement carries an unsubscribe link – one click, no sign-in, no expiry. After you unsubscribe, your address is kept only as a do-not-email record, so nobody can add you back without a fresh consent you confirm yourself. Want even that record erased? Just ask.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future (Art. 7(3) GDPR). The do-not-email record rests on Art. 6(1)(c) and (f) GDPR (proof of consent and respecting your withdrawal).
9. Customer card
Once you have paid, the order page offers you a card with that one seller. It is only an offer: no press, no card. The seller is the controller.
Press it and we store your email address, filed against that seller, and give you a page of your own with a QR code. The page shows your referral code, your vouchers and what you have bought from that seller. The QR carries the card’s random code and nothing else.
The card works with that one seller only. It does not recognise you at another seller, and nowhere on MartNepali are your cards put side by side. Only that seller can look the code up, and then sees your name, how many orders you have placed with them, how long you have held the card and which vouchers you have not spent. Door staff with a scanner link cannot.
The card lasts as long as you want it: “Close this card” on the card page deletes it outright, no sign-in needed. The legal basis is Art. 6(1)(b) GDPR (the service you asked the seller for).
10. Subscribe & save (standing orders)
Where a seller offers regular deliveries or collections, we store your name, email address, chosen items, rhythm and status. You manage the subscription through a private link in your emails (pause, resume, cancel). The seller is the controller; the legal basis is Art. 6(1)(b) GDPR. Cancelled or ended subscriptions are deleted 30 days after they end, and also when the listing no longer exists. The individual orders follow the periods in section 5.
11. Referrals and vouchers
After an order you can share a link carrying a random referral code. If someone books through it, the seller can see in their insights who referred whom (by name) and may thank you with a voucher, which we email to you. The seller is the controller; the legal basis is Art. 6(1)(b) GDPR (taking part in the seller’s referral offer).
Your email address as the referrer on a voucher is erased 30 days after the voucher is spent or expires – but not while you still have a paid order with that seller whose details have not yet been erased; then together with it.
12. Reviews
After a purchase you can write a review. We check against your order that you really bought, and publish your text with a short byline of first name and initial (e.g. “Sunita K.”). Reviews may be checked before or after publication and removed if unlawful. When your order is erased under section 5, your review is anonymised too: the words stay, your name does not. We are the controller; the legal basis is Art. 6(1)(b) GDPR (the review feature you use) and, for checking authenticity, Art. 6(1)(f) GDPR (our interest in trustworthy reviews). We delete your review on request.
13. Sold-out waitlist
When a listing has sold out, you can leave your email address. That is all we store – no name, no account. If spots free up, everyone on the list gets exactly one email at the same moment. After that your address is deleted within 14 days; if the event takes place without anything freeing up, it is deleted then. For goods and undated listings an entry is deleted at the latest 180 days after you signed up. The seller sees only how many people are waiting, not the addresses. We are the controller; the legal basis is Art. 6(1)(b) GDPR (the notification you asked for).
14. Questions to sellers, the AI helper, the Ask bar and the help bot
Questions to the seller (question form)
With the question form on a listing you can ask the seller something without signing in. Name and email are optional; we use the email only to send you the seller’s answer. The question goes straight to the seller, who answers it in their seller hub – no AI service is involved.
Answered questions are published with their answer on the listing page – without your name or email (“Asked by a visitor”). So write your question as if it were public. The listing’s AI helper (below) may use published questions and answers as background. Name and email are erased on the same clock as order details (section 5; for goods counted from when you asked); unanswered questions are then deleted entirely. Question and answer stay as public information about the listing.
The seller is the controller; we process the question on their behalf. Legal bases: Art. 6(1)(b) GDPR for answering, including by email (your request, often before a booking), and Art. 6(1)(f) GDPR for publishing it without your name (the seller’s interest in giving other visitors the same answer). Your question is removed on request.
The AI helper on listings
For an instant answer you can ask the listing’s AI helper instead. Your text is sent to an AI service (section 18) together with the listing’s information and the questions and answers published there, and is not stored in our database. If the helper finds no answer, you can pass the question to the seller with one click – only then is it stored as described above. We are the controller for the AI helper; the legal basis is Art. 6(1)(b) GDPR (the feature you use).
The Ask bar and the help bot
What you type into the Ask bar or the help bot is sent to an AI service (section 18) to find matching listings or answer questions about the platform. We do not store it in our database; the history lives only in your browser’s session storage. Please do not type personal details there. The legal basis is Art. 6(1)(b) GDPR (the feature you use).
15. Voice input (microphone)
Wherever you see a microphone, using it is your choice – every one of those boxes can be typed into instead. Nothing is recorded until you tap it and your browser allows access. The recording is sent to Google Gemini, which turns it into text and sends the text back – only under the terms of paid use (section 18); otherwise the feature is switched off. We do not save the recording on the server, in the database or in logs; it exists for the duration of the request. Only the text you see and can edit remains. The legal basis is Art. 6(1)(b) GDPR (the feature you started).
16. Contact form and contact chat
The contact form asks for your name, email and what you would like – plus a few optional details about your event if you are asking for a seller account. We store the request so it cannot be lost to an email outage, and email it to ourselves.
The contact chat on the same page is answered by Google Gemini – only under the terms of paid use (section 18); otherwise it answers without AI. Email addresses and phone numbers are removed from your text automatically before it is sent.
We are the controller. The legal basis is Art. 6(1)(b) GDPR where your request is aimed at a contract (e.g. a seller account), otherwise Art. 6(1)(f) GDPR (our interest in answering requests). Requests are deleted 365 days after they arrive, or sooner if you ask.
17. Automatic translation
Pages can be translated automatically into German or Nepali. Only the page’s own text is sent to Google Gemini for this. Names, email addresses, phone numbers, bank details, order and ticket codes and other buyer details are excluded. Because only published page text is sent, the free tier of the Gemini API may be used for this. Translations are cached on our server and in your browser (section 4). Legal texts such as this policy are never machine-translated. The legal basis is Art. 6(1)(f) GDPR (our interest in offering the platform in its users’ languages).
18. How we use AI services
- Google Gemini (Google Cloud EMEA Limited, Dublin, Ireland, or Google LLC, USA) receives content that may contain personal data – what you type into the AI helper, the Ask bar and the help bot, voice input, the contact chat and the assistant tools for sellers – only once we have set up paid use. Under Google’s terms for paid use, your content is not used to improve Google’s products and is handled under Google’s data processing addendum. Otherwise, or once the daily limit is reached, these features work without AI or with Anthropic.
- Anthropic (Anthropic Ireland, Limited, Dublin, Ireland, or Anthropic, PBC, USA) answers as a fallback when Gemini is unavailable and helps sellers draft FAQ entries and design pages. Under Anthropic’s commercial terms, content sent through its API is not used for training.
- The AI makes no decisions about you; it words answers and texts. Answers can be wrong – what the seller states is what counts.
Both act as processors. Where this involves a transfer of data to the USA or another third country, it takes place on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR).
19. Counting visits (Google Analytics)
We use Google Analytics 4 to see which pages people actually read – it is how we decide what to build next, and it is the only measurement on this site.
It only runs if you said yes. Until you answer the banner nothing is loaded – no script, no cookie, no request to Google. Saying no is one click, the same as saying yes, and no feature depends on it. Not answering counts as no.
What is sent is the page (without anything after the question mark), roughly where you are, your browser and device, and the referring page; Google sets the cookies _ga and _ga_… (up to 2 years) to tell visits apart. Never measured, whatever you answered: your order page, your tickets, your customer card, your subscription, your account, the door scanner, the seller hub and the admin area. Nothing you type is sent to Google. “Google signals” (linking visits to Google accounts) and use for personalised advertising are switched off.
The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC in the USA. Where this involves a transfer of data to the USA or another third country, it takes place on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time, as easily as you gave it:
Withdrawing stops the counting immediately and deletes the cookies Google has already set on this device. A browser that blocks analytics cookies, or any of the usual blockers, stops it too.
20. Installable app and offline tickets
You can install MartNepali on your device like an app. The app then keeps the site’s program files and images and – so you can show your ticket at the door without signal – your own ticket pages, each for at most 60 days. This happens only on your device; none of it is sent to us. Order pages, customer cards, subscriptions, your account, the basket, the seller hub and the admin area are never kept, and signing out deletes kept pages. The legal basis is § 25(2) no. 2 TDDDG together with Art. 6(1)(b) GDPR.
21. Sellers’ photos and videos
Photos and videos on listings are uploaded by the sellers themselves. Location and camera data (metadata) is removed automatically. The seller is responsible for publishing pictures in which people can be recognised and needs a legal basis for it, such as consent – and for children, their parents’ consent. If you appear in a picture and do not agree, contact the seller or us – we will pass your request on and remove unlawful content.
22. Information for organizers and sellers
This section concerns you if you offer events or goods on MartNepali yourself. For your own data we are the controller; for your customers’ data you are the controller and we are your processor under the data processing agreement, which is part of the terms for sellers.
What data
- Account: name, email, password (only as a salted scrypt hash), where used the secret of your authenticator app for two-step sign-in (stored encrypted), sessions, time and browser of new sign-ins (for the sign-in alert), sign-in and reset codes (hashed, short-lived).
- Legal identity: name, address, legal representative, register entry and contact email where given – shown to buyers on listings, at checkout, on order pages, tickets and in emails.
- Payout details: account holder and IBAN, shown to buyers for bank transfers; if you choose, the credentials of your own PayPal or Stripe account, which we store encrypted with AES-256-GCM and use only to create and check payments for your orders.
- Content: your listings, texts, photos and videos, a WhatsApp number if you give one (publicly visible), answers to questions, announcements.
- Assistant tools: what you type into the setup assistant, FAQ drafts or the page designer is sent to Google Gemini (only under paid use) or Anthropic (section 18).
- Your acceptance of the terms and the data processing agreement (version and time).
Purpose and legal basis
Providing the platform under the terms (Art. 6(1)(b) GDPR); security features such as sign-in alerts and warnings about changed payout details (Art. 6(1)(f) GDPR – our and your interest in preventing misuse of your account and diversion of payments). Emails to you are sent through Twilio SendGrid.
Storage period
For as long as your account exists. After it ends we delete your data and your customers’ data within 30 days unless the law requires us to keep it; it disappears from backups within a further 30 days at the latest. Export what you need for your books beforehand (CSV export in the seller hub).
23. Recipients and transfers outside the EU
These service providers process data on our behalf (Art. 28 GDPR):
| Recipient | Purpose | Location |
|---|---|---|
| Render Services, Inc. 525 Brannan Street, Suite 300, San Francisco, CA 94107, USA | Hosting of the application, the database and uploaded files; server logs; storage snapshots | Servers: Frankfurt am Main, Deutschland (EU); access by the US company possible in individual cases (e.g. support) |
| Cloudflare, Inc. 101 Townsend Street, San Francisco, CA 94107, USA | used by Render: delivering the website (content delivery network), protection against attacks and overload | globally distributed network, including the USA |
| Twilio Inc. (Twilio SendGrid) 101 Spear Street, Suite 500, San Francisco, CA 94105, USA | Sending emails (tickets, payment instructions, order status, sign-in codes, answered questions, confirmed announcements) | USA |
| Google (Gemini API) for customers in the EEA usually Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; affiliate Google LLC, Mountain View, USA | AI features: answering questions, contact chat, voice input (speech to text), assistant tools, translating page text | EU and USA |
| Anthropic (Claude API) Anthropic Ireland, Limited, Dublin, Ireland (contracting party for customers in the EEA); affiliate Anthropic, PBC, San Francisco, USA | AI features: fallback for answering questions when Gemini is unavailable; tools for organizers (FAQ drafts, page designer) | USA |
These receive data as independent controllers:
- the seller you order from or ask a question (sections 5–11, 14);
- PayPal or Stripe, when you pay there into the seller’s account (section 6);
- Google, if you choose “Sign in with Google” (section 7);
- Google Ireland Limited for Google Analytics, only with your consent (section 19);
- authorities, where we are legally obliged (Art. 6(1)(c) GDPR).
Where this involves a transfer of data to the USA or another third country, it takes place on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the basis of the EU standard contractual clauses (Art. 46(2)(c) GDPR).
24. Storage periods at a glance
| Name, email, phone, payer, note on an order | 30 days after the event; goods 30 days after collection, at the latest 365 days after payment; undated 365 days after the order |
| Name and email on questions; unanswered questions | as order details (section 14) |
| Name on a review | when the order behind it is erased |
| Waitlist | 14 days after the notification, or when the event passes; goods at the latest after 180 days |
| “Keep me posted” | until you unsubscribe (then a do-not-email record); unconfirmed 30 days |
| Customer card | until you close it |
| Ended subscriptions | 30 days after they end |
| Referrer’s email on a voucher | 30 days after it is spent or expires (section 11) |
| Customer account | until you delete it; automatically after 730 days without sign-in |
| Contact requests | 365 days, sooner on request |
| Seller account | while it exists, then 30 days |
| Backups | 30 days |
Anonymous counts and amounts with no personal reference remain for the sellers’ books.
25. What you must provide; no automated decisions
To order, your name and email address are required – without them the seller cannot issue a ticket or match a payment. A customer account requires an email address. Everything else is optional; there is no legal obligation to provide any of it.
There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
26. Your rights
Under the GDPR you have the right to
- access the data we hold about you (Art. 15),
- have inaccurate data corrected (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- data portability (Art. 20),
- object to processing based on Art. 6(1)(f) (Art. 21, see below),
- withdraw consent at any time with effect for the future (Art. 7(3)); processing before the withdrawal remains lawful.
Contact us by email to support@martnepali.com or through the contact form. With a customer account you can also download and delete your data yourself on /account. Where your request concerns data a seller is responsible for, you can also go to the seller directly; if it reaches us, we forward it without delay.
27. Right to object
Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your data is processed for direct marketing – such as a seller’s announcements – you can object at any time without giving reasons (Art. 21(2) and (3) GDPR); the easiest way is the unsubscribe link in every announcement. Otherwise send your objection informally to us, by email to support@martnepali.com or through the contact form.
28. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
datenschutz.hessen.de
29. Changes to this policy
We update this policy when the platform or the law changes. The version published here applies. The German version is binding; this English version is for information.