Privacy Policy

1. Data controller

The controller of personal data processed in connection with the PartyM8 mobile app and service is:

In the remainder of this document we use the terms “PartyM8”, “we”, “us” or the “Controller”.

2. Scope of this document

This Policy applies to the use of the PartyM8 app, the PartyM8 website and related features, including user profiles, the map and event listings, communication, publishing content, reporting content, paid event promotion and customer support.

This document does not govern the processing of data by independent event organisers, clubs, ticket sellers, payment providers or other third parties acting as separate controllers. Before providing them with any data, you should read their own privacy policies.

3. Age requirement

PartyM8 is intended solely for people who are at least 18 years old. We do not direct the service at children and do not intend to knowingly collect their data.

If we receive reliable information that an account belongs to a minor, we may block or delete the account and the data associated with it, except for data whose continued retention is required by law or necessary for security purposes and for the establishment, exercise or defence of legal claims.

4. What data we collect

Account and identity data

• first name, nickname or profile name;
• email address, phone number or third-party login identifier, where that method is available;
• date of birth or confirmation that you are an adult;
• password in the form of a secure hash, and login and session data;
• account status, settings, consents and preferences.

Profile data and user content

• profile photo, bio, interests, party preferences and other information provided voluntarily;
• events, posts, comments, photos, videos, live streams or other material uploaded to PartyM8;
• reactions, likes, invitations, lists of interested users and other interactions;
• messages and communication metadata, to the extent necessary to deliver messages, prevent abuse and handle reports.

Location data

• approximate location determined from your IP address;
• more precise device location, if the user grants the system permission;
• city, search area, selected radius and event locations.

Organiser and event data

• organiser name, contact details and business information;
• event description, venue, date, time, prices, admission rules, links and promotional materials;
• data needed to verify a listing, process a paid promotion or deal with a report.

Technical and analytics data

• IP address, device and app identifiers, operating system, app version, language and time zone;
• event logs and data on errors, crashes, performance, sessions and how features are used;
• advertising identifiers or similar technologies, only where they are used in accordance with the law and the user's settings.

Payment data

We may receive information about the product purchased, the amount, currency, transaction status, date, order ID and payment provider. Full payment card details are, as a rule, processed by the payment provider or app store and not by PartyM8.

Security and support data

• reports, complaints, correspondence with technical support and survey responses;
• information about blocks, breaches, suspicious activity, fraud and moderation actions;
• evidence necessary to protect users, comply with legal obligations or establish, exercise or defend legal claims.

5. Sources of data

We obtain data directly from the user, automatically from their device, from login and payment providers, from other users through reports or interactions, from event organisers and from lawfully available public sources where this is necessary to verify an event or protect the service.

6. Purposes and legal bases

We do not make decisions about users based solely on automated processing that produce legal effects concerning them or similarly significantly affect them. We may use automated recommendations, sorting and detection of spam or risk signals, but significant moderation actions may be reviewed in accordance with the available appeal procedure.

7. Public data and profile visibility

Information published in a profile, event, post, comment or media item may be visible to other users and, depending on the feature, also to people who are not logged in. Before publishing, check your visibility settings and do not share information that should remain private.

We do not ask you to disclose special category data, such as information about your health, political opinions, religion, sexual orientation or ethnic origin. If a user voluntarily includes such information in content or in their profile, they should be aware that it may become accessible to others. Where required by law, we process such data on the basis of explicit consent, which can be withdrawn by deleting the content or changing the settings.

8. Location

Features for discovering nearby events and users may require location data. We process precise device location only after permission has been granted in the operating system. This permission can be revoked in the device settings.

Where possible, the app may show other users a distance or an approximate area instead of exact coordinates. Users should not publish their home address or share their live location with people they do not trust.

9. Messages, reports and moderation

The content of private messages is not intended to be displayed publicly. However, we may process messages and related data where this is necessary to deliver communications, ensure security, detect spam or fraud, deal with a report, comply with legal obligations or protect users' rights.

Users may report content, accounts and behaviour. A report may include a copy of the material, details of the person making the report and of the person reported, a history of actions and the moderation decision. In justified cases, information may be passed to law enforcement agencies, regulators or organisations working in the field of safety.

10. Payments

Payments may be processed by the Apple App Store, Google Play, an online payment provider or another provider indicated before purchase. These providers may process data as separate controllers in accordance with their own rules.

PartyM8 stores only the information necessary to activate the purchased feature, for accounting, to process refunds, to prevent fraud and to deal with complaints.

11. Who we may disclose data to

Data may be shared only to the extent necessary with the following categories of recipients:

• providers of hosting, databases, file storage and cloud infrastructure;
• providers of login, maps, geolocation, push notifications, email and customer support services;
• providers of analytics, crash diagnostics, cyber security, abuse detection and moderation services;
• payment providers, app stores, accountants and advisers;
• other users and organisers, in line with the feature chosen by the user;
• public authorities, courts, regulators and law enforcement agencies, where there is an appropriate legal basis;
• a legal successor or purchaser of all or part of the service, subject to appropriate safeguards.

Parties acting on our behalf receive only the data necessary to perform the specific service and are required to protect it.

12. International data transfers

Some technology providers may process data outside the European Economic Area (EEA). In such cases, data is transferred on the basis of a mechanism provided for in the GDPR, such as a European Commission adequacy decision, the Standard Contractual Clauses approved by the Commission or another lawful measure, together with an assessment of the safeguards required.

13. How long we keep data

We keep data for no longer than is necessary to achieve the purposes described, perform the contract, ensure security and comply with legal obligations. In particular, we apply the following criteria:

• account and profile: for as long as the account is active and, after its deletion, usually for up to 30 days; backups may be overwritten on a cycle of up to 90 days;
• content and messages: until they are deleted, the account is closed or the period needed to provide the feature has expired; material that is the subject of a report may be retained for longer;
• technical and security logs: usually for up to 12 months, unless a longer period is needed to investigate an incident;
• reports and moderation actions: usually for up to 24 months and, in the event of a dispute or risk, for the period necessary to resolve it;
• transaction and accounting records: for the period required by tax and accounting legislation, usually up to 6 years;
• marketing data: until consent is withdrawn or an objection is raised; we may keep a minimal record of the objection so that we do not send further messages.

Some data may be anonymised and continue to be used in a form that does not allow the user to be identified.

14. Security

We use organisational and technical measures appropriate to the nature of the service and the risk, including access control, secure data transmission, event monitoring, backups, permissions management and incident response procedures.

No system is completely immune to threats. Users should protect their login details, use a unique password, not share authentication codes and report any suspicious activity without delay.

15. User rights

Depending on the circumstances and the applicable law, the user may have the right to:

• be informed and access their data;
• have inaccurate data rectified or incomplete data completed;
• have their data erased;
• restrict processing;
• object to processing based on legitimate interests and to direct marketing;
• data portability, where processing is carried out by automated means on the basis of consent or a contract;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
• challenge a decision based solely on automated processing, where that right applies;
• lodge a complaint with the competent supervisory authority.

Requests can be made using the features available in the app, the contact details published on the PartyM8 website or by post to the Controller's address. Before dealing with a request, we may ask you to confirm your identity.

16. Data protection complaints

A complaint about how data is processed can be sent to the Controller's address or through the contact channel provided in the app or on the PartyM8 website. We will acknowledge receipt of the complaint within 30 days at the latest, carry out an appropriate investigation and inform you of the outcome.

The user may also lodge a complaint with a supervisory authority. The authority competent for the Controller is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee. A complaint may also be lodged with the supervisory authority of the EU Member State in which the user has their habitual residence or place of work, or in which the alleged infringement took place. Users in the United Kingdom may also contact the Information Commissioner’s Office (ICO).

17. Cookies, local storage and mobile SDKs

The website and app may use cookies, local storage, app identifiers and mobile SDKs. Strictly necessary technologies are used for purposes including login, security, remembering settings and ensuring the service works properly.

Analytics, advertising or personalisation technologies are activated only in accordance with the requirements of the applicable law, including after consent has been obtained where it is required. Preferences can be changed in the app settings, the consent banner or the device settings.

18. Notifications and messages

We may send service messages about your account, security, messages, events and changes to the service. Push notifications require device permission and can be turned off in the system settings.

Marketing communications can be turned off at any time via the unsubscribe link, the account settings or by contacting the Controller. Turning off marketing does not affect messages that are necessary for account administration and security.

19. Events, links and third-party services

PartyM8 may contain events, advertisements and links to third-party services, including the websites of clubs, organisers, maps, ticketing and payment systems. Once you go to such a service, its operator may collect data independently. PartyM8 is not responsible for the privacy practices of independent third parties.

20. Changes to this Privacy Policy

We may update this document in response to changes in features, technology, providers or the law. The new version will be published in the app or on the website, together with its effective date. If a change materially affects users' rights, we will provide additional notice in an appropriate manner.

21. Contact

For matters relating to privacy, the exercise of rights or complaints, you can contact the Controller via the contact channel provided in the app or on the partym8.com website, or by post at: