Skip to content

Business Privacy Notice

How Apperah handles personal data in business accounts and relationships.

Effective:
On publication of this version
Last updated:
2026-10-08
Version:
paid-placement-2026-10-08

1. Who is responsible

Apperah AS is the controller of the personal data described here. For data-protection matters, contact us at dpo@apperah.com.

2. What we process

  • Identity and contact details of business representatives (name, role, email, phone).
  • Verification signals used to confirm a claim (e.g., business email/domain, documents you provide).
  • Communications with you.
  • Billing and tax data — for paid placement, including invoices, tax and credit movements. Stripe processes payments for Apperah AS, the seller.
  • Business/venue information enriched from public sources — some of which we did not get directly from you (for example, a publicly listed business contact). We are transparent about this under GDPR Article 14.
  • Portal sign-in data — if you sign in to the business portal with Google, Facebook, or Apple, we receive your OAuth identity (identifier, email, name) from that provider; the portal also uses strictly necessary session and security cookies.
  • Consent-action records — when you grant or withdraw a consent in the portal (such as the event-image consent below), we record the change together with the IP address and browser details of the action, so we can demonstrate the consent trail (GDPR Art. 7(1)).
  • Onboarding and verification — to set up and confirm your business account (Art. 6(1)(b) contract; Art. 6(1)(f) legitimate interests).
  • Enrichment of venue/business information — legitimate interests (Art. 6(1)(f)).
  • Payments — to take payment via our payment provider and meet bookkeeping duties (Art. 6(1)(b) and (c)).
  • Fraud prevention — legitimate interests and legal obligation (Art. 6(1)(f) and (c)).

4. Who receives it

Our service providers process data on our behalf. Notably, our payment provider handles payments — and acts as an independent controller for its own tax and fraud purposes. Service providers help with data enrichment. We do not sell your data.

4a. Controls you have over your venue’s content

  • Website events. In Place settings, owners and admins choose Off, Events, or Events + descriptions & photos. Off stops automated website collection for the place and removes collected events. Descriptions, photos and tags require acceptance of the content licence; withdrawing permission removes that content, pending suggestions and raw extractions. Titles and dates remain in Events mode. Ticketmaster/JamBase listings, events created by owners or users, and existing place photos are unaffected. Collection can be resumed; reversing a venue-filed objection requires explicit confirmation. Shared sites and claims without domain proof are reviewed manually.
  • Happenings visibility. You can choose per event whether it appears in the app’s Happenings feed.

5. International transfers

Where data goes outside the EEA (for example, to our payment provider or an AI provider), we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses, as described in the EU-bloc addendum.

6. How long we keep it

For the life of the business account, plus any period required by law (for example, billing records under the Norwegian Bookkeeping Act for five years).

7. Your rights

You can access, correct, delete, or object to the processing of your data, and opt out of enrichment from public sources where available. To exercise your rights, contact privacy@apperah.com. You can also complain to your data-protection authority.

For business paid placement, Apperah AS uses Stripe as payment processor. We process legal and billing identity, company and tax registration evidence, authorized representative and terms acceptance records, payment and document references, credit movements, bookings, decisions and complaint notices. We use these records to perform the business contract, meet tax and accounting obligations and investigate disputes. Financial records and required evidence survive account deletion for their applicable retention period. Payment card details are handled by Stripe.

Paid-placement exposure receipts and display/action counters do not retain viewer identifiers. Raw telemetry is retained for 90 days, with aggregated delivery reports retained separately. We do not use this telemetry to create personal advertising profiles. Required advertising disclosure remains available in native apps. See the Paid Placement Terms and Refund Policy.

More