How we process your personal data at Scennio.
We are NOCTION PLATFORM, S.L., a technology platform that connects Establishments (nightlife venues, restaurants, event halls) with people who purchase tickets, book tables or place orders. We process your data to provide the contracted service, process payments, communicate changes and comply with legal obligations. We share data with the contracting Establishment (for access control and customer service) and with technical providers. We retain data for as long as necessary to fulfil each purpose and, where applicable, for the legally required periods. You have the right to access, rectification, erasure, restriction, objection, portability and to lodge a complaint with the AEPD.
The controller of your data is NOCTION PLATFORM, S.L., a company incorporated under the laws of Spain, with registered office at Edificio Lanzadera, La Marina de València, Carrer del Moll de la Duana, s/n, 46024 València, Spain, and tax identification number NIF B88997002. For privacy-related queries or to exercise your rights, you can write to us at info@scennio.com .
Scennio has not appointed a Data Protection Officer (DPO) as it is not legally required. You may nonetheless direct any query or rights request to info@scennio.com .
The website, applications and technology services owned by NOCTION PLATFORM, S.L.
Natural person who purchases tickets, books tables, signs up to guest lists or places orders through the Platform.
Nightlife venue, restaurant, event hall or organising entity of the event or service contracted by the User.
Any information relating to an identified or identifiable natural person.
When you purchase a ticket, make a reservation or place an order, you provide us with data such as your first name, surname, email address, phone number and the data needed to process the payment. If you contact us, we may process the content of your enquiry.
When you use the Platform, we may collect technical information such as IP address, device and browser type, pages visited, dates and times of use, and identifiers associated with cookies or similar technologies (see the "Cookies" section).
Certain Establishments may upload data to the Platform relating to their events, guest lists or reservations. In these cases, Scennio acts as a processor on behalf of the Establishment.
We process your data for the following purposes, on the legal bases set out in Art. 6 GDPR:
Performance of the contract (Art. 6.1.b GDPR).
Issuing tickets, managing reservations, processing orders and enabling access to the Establishment.
Performance of the contract (Art. 6.1.b) and legitimate interest (Art. 6.1.f) in preventing fraud.
Collecting payment for the service, detecting fraudulent transactions and handling chargebacks.
Performance of the contract (Art. 6.1.b GDPR).
Sending purchase confirmations, reminders, access instructions and service-related communications.
Consent (Art. 6.1.a GDPR) and Art. 21 LSSI-CE.
Sending information about events, news or promotions where the User has consented. Consent may be withdrawn at any time.
Legitimate interest (Art. 6.1.f GDPR).
Keeping the service operational, detecting incidents, preventing abuse and protecting data integrity.
Legal obligation (Art. 6.1.c GDPR).
Responding to tax, commercial, anti-money-laundering or other requirements from competent authorities.
Consent (Art. 6.1.a GDPR) or legitimate interest (Art. 6.1.f) depending on the cookie.
Analysing use of the Platform to understand aggregate behaviour and improve the experience.
Consent (Art. 6.1.a GDPR) and pre-contractual steps at the request of the data subject (Art. 6.1.b GDPR).
Responding to enquiries and demo requests received through the website forms, email or WhatsApp, and following up commercially on the request when it comes from a professional or company interested in the platform.
Providing the data needed to deliver the service (name, contact details and payment information) is a contractual requirement; without it, Scennio cannot issue the ticket, manage the reservation or process the payment. Data for commercial communications is optional.
Data may be disclosed to the following recipients:
The necessary identification and contact data is shared with the Establishment responsible for the event or service, for the sole purpose of providing that service (access control, reservation management, customer support and compliance with the Establishment's legal obligations). The Establishment may act as an independent controller with respect to subsequent processing of that data in its own customer databases.
To provide the service we rely on providers acting as processors, in the following categories: PCI DSS-certified payment gateways, hosting and infrastructure providers, email, SMS, push notification and messaging providers, web analytics providers and fraud prevention providers. The main ones are: AltaPay (payment processing), Vercel (website hosting and cookieless analytics), Google (Google Cloud, Google Analytics 4 and Google Tag Manager), Meta Platforms (advertising measurement pixel, only with your consent) and Hotjar (anonymised session recording, only with your consent). All processors are bound by contracts compliant with Art. 28 GDPR.
Where legally required (tax authorities, law enforcement, courts or data protection authorities).
The Platform's main hosting takes place on servers located in the European Union. Certain processors may be established outside the European Economic Area (mainly in the United States). In those cases, Scennio guarantees an adequate level of protection by means of (a) adequacy decisions by the European Commission, including the EU-U.S. Data Privacy Framework for certified providers, or (b) the execution of Standard Contractual Clauses (SCCs) approved by the European Commission, as applicable.
We retain your data for the time strictly necessary to fulfil each purpose and, where applicable, for the legally required periods:
Up to six (6) years from the transaction, in accordance with Art. 30 of the Spanish Commercial Code.
Up to ten (10) years, in accordance with Spanish Act 10/2010 on the prevention of money laundering and applicable tax regulations.
Until consent is withdrawn, plus one (1) additional year as evidence of the consent itself.
Up to twenty-four (24) months, unless previously withdrawn.
Up to twelve (12) months from the last suspicious activity.
Up to six (6) months, unless investigations are ongoing.
Until the request is resolved and, at most, two (2) years from the last contact, unless a contractual relationship is formalised.
Scennio uses cookies and similar technologies to provide the service, remember your preferences, measure use of the Platform and, where you consent, display personalised content. We distinguish the following categories:
Enable the Platform's basic operation, session, cart and security.
Legal basis: legitimate interest (Art. 6.1.f GDPR); consent not required.
Remember User choices such as language or currency.
Legal basis: consent (Art. 6.1.a GDPR).
Allow us to measure aggregate use of the Platform and understand user behaviour.
Legal basis: consent (Art. 6.1.a GDPR).
Allow us to deliver personalised content or advertising and measure its effectiveness.
Legal basis: consent (Art. 6.1.a GDPR).
You can accept, reject or configure cookies at any time from the configuration panel available on the Platform. Rejecting is as accessible as accepting and does not condition access to the essential features of the service. You can also block or delete cookies from your browser settings.
Scennio will send you operational communications related to the provision of the service (confirmations, reminders, modifications, refunds, etc.) through the channels you have provided (email, SMS, push notifications or messaging). These communications form part of the contract and do not require additional consent.
Sending commercial communications by Scennio requires your prior and express consent, in accordance with Art. 21 of Spanish Act 34/2002 (LSSI-CE). You may withdraw your consent at any time from the communication itself or by requesting it at info@scennio.com .
Certain events may be photographed or recorded by the Establishment or by authorised third parties. Scennio is not responsible for the processing of images carried out by the Establishment; the legal basis, specific purposes and exercise of rights are governed by the information that the Establishment provides at the event's entry point.
The Platform is not directed at children under 14. In accordance with Art. 7 of Spanish Organic Law 3/2018, the processing of data of children under 14 requires the consent of those holding parental authority or guardianship. If we detect the processing of a minor's data without such consent, we will proceed to delete it. Certain events may also require higher minimum ages in accordance with the Establishment's conditions.
Scennio does not make individual decisions based solely on automated processing that produce legal effects or significantly affect the User. Anti-fraud controls may include automated rules to detect anomalies; if a transaction is blocked, the User may request human review of the case. AI-based assistance features (Scennio Copilot) are intended for Venues to analyse their own activity and do not make automated decisions affecting the User; where external AI model providers are involved, they act as processors under contracts compliant with Art. 28 GDPR and, where applicable, the international transfer safeguards described in this Policy.
Scennio applies reasonable technical and organisational measures to protect data, including: encryption in transit (TLS) and at rest, role-based access control, audit logs, environment segregation, periodic security testing and payment processing through PCI DSS-certified providers. Scennio does not store card data.
In the event of a security breach that entails a risk to the rights and freedoms of individuals, Scennio will notify the Spanish Data Protection Agency (AEPD) within a maximum of 72 hours from becoming aware of it, in accordance with Art. 33 GDPR, and the affected individuals where required under Art. 34 GDPR.
As a user of the Platform, you have the following rights over your personal data:
You can exercise these rights by sending your request to info@scennio.com , stating the right you wish to exercise and, where applicable, attaching a copy of a document proving your identity.
Scennio may modify this Privacy Policy to adapt it to regulatory, technical or service changes. When the changes are substantial and affect users' rights, we will notify them at least 15 calendar days in advance through the usual contact channels. The current version will always be published on this page, indicating the date of the last update.
For any query relating to this Policy or the processing of your personal data, you can write to us at info@scennio.com.