Privacy Policy

This Privacy Policy explains how Wasla, a product of Zerophia (“Wasla”, “we”, “us”), collects, uses, and protects your personal data when you use our website and services at wasla.club (the “Service”). We handle your data in line with the EU General Data Protection Regulation (GDPR) and the Dutch implementation (UAVG).

This document is provided for transparency and compliance. It is not personalised legal advice.

1. Who we are

Wasla is a product owned and operated by Zerophia, the data controller, based in the Netherlands. We are an online-only service and do not operate a public physical address. If we appoint a Data Protection Officer, contact details will be added here.

For any privacy question or to exercise your rights, contact privacy@wasla.club. Support: support@wasla.club.

2. The data we collect

Account: When you create an account, we collect display name, email, password hash (or Google/Apple account identifiers if you sign in with an OAuth provider), email verification status, role (member/host), and optional avatar URL and bio. After verification we also require your date of birth (user-provided; kept private and not shown on public profiles) and the country and city you are based in (worldwide; user-provided), so we can confirm you meet our minimum age (Wasla is for users 16+) and personalise communities and events for your area.

Communities & events: Listings, venue/location, trust labels, image URLs, descriptions, and related host content you publish or that is shown to you.

Bookings & membership: Attendee name and email, booking status, check-in code, optional linked account, and community membership records so hosts can message members and so we can email you about new events in communities you join.

Messages: If you send your first message to an event or community organizer, we store the message and send it to that organizer by email. The organizer receives your display name and Wasla email so they can reply. Public member and attendee sections show initials only, not names, photos, or email addresses.

Billing (hosts): Stripe customer/subscription identifiers, plan status, and invoice/tax metadata. Payment card data is processed by Stripe; we do not store full card numbers.

Payouts & Connect (hosts): When you collect ticket money through Wasla, we store your Stripe Connect account id, onboarding and capability status (for example whether transfers are active), and related timestamps. Identity, bank, and tax details you submit during Stripe Express onboarding are processed by Stripe under Stripe’s notices. We may receive status updates and limited compliance signals from Stripe so we can enable payouts, support risk reviews, and notify you if more information is required.

Wasla ticket Checkout (attendees): When you pay for a ticket through Wasla, we and Stripe process payment metadata (amount, currency, booking/event identifiers, and payment status) needed to confirm attendance and settle funds to the host’s connected account. Card data is handled by Stripe.

External payment links (hosts): If a host adds a ticket payment link outside Wasla Checkout (for example Tikkie, Stripe Payment Link, PayPal, or another allowlisted provider), we store the link URL, provider hostname, and related event/listing metadata. Wasla does not process those payments and does not receive card or bank details from the external provider. We may review this information together with account and listing signals to detect fraud, scams, restricted activities, and other misuse of the Service.

Technical / security: We generate limited service-access logs (such as IP address, timestamp, and pages used), kept for up to 90 days for security and troubleshooting and not used for profiling. Essential cookies and request metadata may be processed by our hosting/security providers (e.g. Cloudflare) for delivery and abuse prevention. We use Google reCAPTCHA on forms to reduce bots and abuse; that may involve processing limited device and browser signals under Google’s terms.

If you accept analytics cookies, we also receive usage measurement data from Google Analytics 4 (see Cookies). We do not knowingly collect data from anyone under 16 (or the higher digital consent age required where you live).

3. Special category data

Wasla is designed for community social activities with clear trust labels (audience, alcohol, prayer notes). Event and community context may relate to religious or community preferences. Profile photos may also reveal characteristics that can be sensitive. Do not upload special-category personal data about others without a lawful basis. Hosts must not require attendees to disclose health, religion of others, or other special-category data beyond what is necessary and lawful for the event context.

Where we process special-category data that you voluntarily provide in connection with using the Service, we do so on the basis of your explicit consent (GDPR Art. 9(2)(a)) and/or because the processing is necessary for reasons of substantial public interest or other Art. 9 bases that may apply in limited cases (for example, safety or legal claims). You can withdraw consent where processing is consent-based (see section 12).

Sexual content and abuse

Wasla is a family-friendly platform built for a safe environment. We are against nudity, pornography, sexual content, sexual abuse, exploitation, grooming, and any sexualised use of the Service. That includes profile photos, event images, listings, bios, messages, and offline events promoted on Wasla.

Do not upload, post, organise, or solicit sexual or sexually suggestive material. Do not use Wasla to arrange sexual encounters, distribute intimate imagery (including non-consensual intimate imagery), or exploit or abuse anyone. Child sexual abuse material (CSAM) and exploitation of minors are strictly prohibited and will be reported to competent authorities where required by law.

To protect users, we may process reports, safety signals, and related account and content data to investigate violations, remove material, suspend or ban accounts, and cooperate with law enforcement. Report concerns to abuse@wasla.club or see our Notice & action page. Our Community Guidelines describe prohibited conduct in more detail.

4. Why we use your data and our lawful basis

• To operate accounts, communities, events, and bookings — lawful basis: performance of a contract (Art. 6(1)(b)).
• To process organizer subscriptions, Wasla ticket Checkout, Connect payouts, platform fees, and payment risk/compliance support — lawful basis: performance of a contract; legitimate interests / legal obligations for accounting, fraud prevention, chargeback handling, and marketplace compliance (including reviewing whether hosts collect money for restricted activities).
• To keep the Service secure and meet legal obligations (including tax/VAT, lawful authority requests, and DSA notice records) — basis: legitimate interests (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)).
• To measure and improve the Service with Google Analytics 4 — only if you accept analytics cookies — lawful basis: consent (Art. 6(1)(a)). We use aggregate insights to improve reliability, performance, and features. We do not use analytics to build advertising profiles about you.
• To enforce Terms and Community Guidelines (including our zero-tolerance policy against sexual content, nudity, exploitation, and abuse) and prevent spam, fraud, and abuse — basis: legitimate interests, balanced against your rights as a user of a social events platform.
• To review external payment links and related activity for fraud prevention, platform integrity, and compliance with law — basis: legitimate interests (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)) where applicable.

We do not use your data for automated decision-making that produces legal or similarly significant effects (GDPR Art. 22). Recommendations or rankings on the platform (if any) are tools for you to act on; you remain in control of bookings and interactions.

5. Who we share it with

We do not sell your personal data. We share it only when necessary with carefully selected service providers that process data on our behalf to help us operate, secure, and improve the Service:

• Hosting, delivery, security, and storage — Cloudflare, to provide and protect the Service.
• Payments — Stripe for organizer subscriptions, Wasla-processed ticket Checkout, and Stripe Connect host payouts. Stripe acts as an independent payment controller for card and Connect identity/bank data, and as our processor for checkout and account-status metadata we receive (privacy).
• Security and abuse prevention — including Google reCAPTCHA and similar measures to detect bots, fraud, spam, and other malicious activity.
• Email communications — to send confirmations, booking notices, and service messages. Separately, if you opt in, we may send optional weekly event recommendations matched to your interests. You can unsubscribe anytime via the link in those emails or from your account email preferences.
• Sign-in with Google (optional) — if you choose Google OAuth, Google provides account identifiers under Google’s terms.
• Analytics — Google Analytics 4, only if you accept analytics cookies, to understand how the Service is used and to enhance product quality. We do not share message content or full profile dossiers with advertisers for their own marketing (Google privacy).
• Database infrastructure — storage of account, event, and booking records.

We require our service providers to protect personal data, use it only for the services they provide to us (except where they act as independent controllers under their own notices, such as Stripe for card processing or Google for reCAPTCHA/analytics), and comply with applicable data-protection law. We may also disclose data where required by law, to protect our rights or the safety of others, to competent authorities or law enforcement when we reasonably believe disclosure is necessary to investigate or report suspected fraud, financial crime, or other illegal activity, or in connection with a business reorganisation, subject to appropriate safeguards.

Hosts may see member/attendee names and emails needed to run their communities and events. Public listings and profiles are visible as intended by the Service. We do not sell your data to unrelated third parties.

6. International transfers

We aim to process and store personal data within the European Economic Area (EEA). Some service providers (including Google and Stripe) may process data in countries outside the EEA. Where an international transfer occurs, we use safeguards required by applicable data-protection law, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with additional measures where appropriate. Analytics data is sent to Google only after you accept analytics cookies.

7. Cookies

We keep cookies to the minimum needed to run and improve the Service:

• Sign-in session — strictly necessary to keep you logged in. Up to 30 days.
• Cookie preference — strictly necessary to remember whether you accepted or rejected analytics. Set without marketing consent because it is required to honour your choice. Lasts up to 1 year.

If you accept analytics (“OK, got it”), Google Analytics 4 may set cookies to measure site usage so we can improve and enhance Wasla. If you reject, those cookies are not loaded. You can change your preference at any time by clearing cookies / site data for wasla.club; the banner will reappear. More detail: Cookie Policy.

8. Security of your data

We apply organisational and technical safeguards appropriate to the risk, in line with Article 32 GDPR, including hashed passwords, HTTPS, access controls, and edge protections. Service providers that process data on our behalf are contractually required to implement appropriate safeguards. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work to reduce risk and review our measures regularly.

9. Personal data breaches

A personal data breach means a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

If we become aware of a breach that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in clear language, describing what happened in general terms, categories of data affected, likely consequences and steps we are taking, measures you can take where appropriate, and how to contact us. We will also notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of a breach where required by law. Not every incident is reported to users — we assess each case individually. If you believe your account or data has been compromised, contact privacy@wasla.club immediately.

10. How long we keep it

• Account data: while your account is active. When you request deletion and we process that request, associated personal data is removed or anonymised from our active product systems (we aim within one month; complex cases may take longer as GDPR allows). See Delete account.
• Server logs: up to 90 days.
• Bookings & financial / tax records: typically up to 7 years where accounting rules require (may be kept in anonymised or limited form).
• Analytics (GA4): according to Google Analytics retention settings for the property; withdraw consent anytime via the Cookie Policy / clearing consent.
• Post-deletion compliance archive (Art. 17(3) GDPR): after removal from active systems, we may retain a limited archive for up to 7 years for legal obligation, accounting, dispute resolution, fraud prevention, safety/abuse investigation, and DSA notice records. That archive does not keep profile bios or avatars for marketing use. After 7 years these records are deleted.

Hosts should cancel any active Stripe organizer subscription first (via the billing portal) so charges stop. Communities or events you own may be archived, anonymised, or reassigned so public listings do not keep your personal profile.

11. Children

The Service is for users 16+ (or older if your country requires a higher digital consent age). We do not knowingly create accounts for younger children.

12. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• data portability;
• withdraw consent at any time (this does not affect processing done before withdrawal);
• not be subject to solely automated decisions with significant effects (see section 4).

To exercise any of these rights, email privacy@wasla.club or use Delete account / Profile → Request account deletion. We aim to respond within one month.

13. Complaints

If you are unhappy with how we handle your data you can complain to our lead supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl. We’d appreciate the chance to address your concern first via privacy@wasla.club.

14. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for significant changes, notify you by email where appropriate. Contact privacy@wasla.club / support@wasla.club.