Privacy Policy

1. Who is the data controller

Events on EzMrch run in one of two modes, and every event page, checkout and order confirmation shows a Seller & Responsibility Card naming the seller (see the Terms):

• Events sold by EzMrch ("full-cycle"). EzMrch is the seller and the data controller end-to-end — for your order, pickup code, refunds and the records around them. This policy applies as written.
• Events sold by the organizer ("software mode"). The seller named on the Seller Card is the data controller for your order and its fulfilment — taking your payment, handing over the goods, receipts, refunds and complaints. EzMrch processes the order data on the seller's behalf (as a processor) to run the reservation flow. EzMrch remains an independent controller for the platform itself: accounts, security, abuse prevention and our own legal obligations.

For Artist, Licensor and organizer account data, EzMrch is always the controller.

2. What we collect

Buyers (no account is created)

• Email address — to send your pickup code and order updates. It's the only channel we use for your code, so it's required to order.
• Order contents — the items you order and the amount.
• A random browser session id — stored in your browser to keep your cart together. It isn't tied to your identity and you can clear it any time.

Artists / licensors

• Account email.
• Identity, organization and rights-verification details you submit, plus the tax documentation (such as tax-residence certificates) needed before licence remuneration can be paid.
• Sales-statement and remuneration records, for calculating your share, withholding where legally required, reconciliation and tax.

Technical

• Standard server logs (IP address, user agent) for security and abuse prevention.

3. What we don't collect

We never receive or store full card numbers — card payments happen on the payment provider's own hosted page. We don't run advertising trackers on buyer pages and we don't build advertising profiles.

4. How we use it

To deliver your order or reservation (pickup code, updates, collection at the booth), operate and verify licensor accounts, calculate and pay licence remuneration (including any legally required withholding), process refunds, keep tax/bookkeeping records, prevent fraud and abuse, and answer support requests. Our legal bases are performance of a contract, legal obligation (VAT/bookkeeping), and legitimate interests (licensor verification, fraud prevention, running the Service). At software-mode events we process order data on the seller's behalf (Section 1); the seller is responsible for its own use of that data. We don't use your data for advertising, and we don't sell it.

5. Who processes it for us

• The payment provider(s) — to take card payments.
• Our transactional email provider — to send your code and notices.
• EU-based hosting and object storage — to run the Service.

Each receives only what it needs. Who sees your order data at the booth depends on the event mode (Section 1). At events sold by EzMrch, orders are fulfilled by EzMrch: booth staff at the event, acting for EzMrch, see the order details needed to hand you your merchandise, and Artists and licensors do not receive Buyers' personal data — they get aggregated sales statements. At events sold by the organizer, the seller fulfils your reservation — that's the point of the software — so the seller sees the order data needed to do it: your reserved items and amounts, your pickup code and the contact details attached to the order. The seller uses that data as its own controller, under its own privacy obligations. We may disclose data where required by law, and in a merger or asset sale data may be transferred as part of that transaction. We do not sell your personal information.

6. Retention

Order and sales records are kept for as long as tax law requires. Licensor account, verification and tax documentation (including residence certificates) is kept for the account's life plus the statutory period. Your buyer session id lives in your browser until you clear it. Server logs rotate on a short schedule.

7. Security

HTTPS/TLS across all surfaces, access controls, re-authentication for sensitive licensor-portal actions, and a PCI-DSS-compliant payment provider that keeps card data off our servers. No system is perfect, but we work to protect your data and to collect as little as possible.

8. Your GDPR rights (EEA/UK)

You have the rights of access, rectification, erasure (subject to our legal retention duties), restriction, portability, objection, and withdrawing consent. You can also lodge a complaint with your supervisory authority — in Poland, the UODO (uodo.gov.pl). Email hello@ezmrch.com to exercise a right; we respond within one month (extendable by up to two further months for complex requests — we'll tell you if we need that, and why). Where we process order data on a seller's behalf at software-mode events (Section 1), we pass your request to the seller and help it respond. Buyers can also clear their session id from their browser at any time.

9. Cookies & local storage

We store on your device only what's needed to provide the service you asked for: an anonymous cart/session identifier, the language you choose with the language switcher, and — for licensor-portal and booth sign-in — session and trusted-device tokens. We don't set advertising or analytics storage, and we don't use third-party trackers. If we ever want to add storage that isn't strictly necessary, we'll ask for your consent first.

10. Children

The Service isn't directed to children under 16 (EEA) / 13 (US) and we don't knowingly collect their data. If you believe a child gave us data, contact us and we'll delete it.

11. International transfers

We aim to keep processing within the EU/EEA, but not all of it stays there — for example, our transactional email provider processes data in the United States. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

12. Changes

We may update this policy; the date above reflects the latest version. For material changes affecting Artists/Licensors we'll also notify by email.