Privacy policy

1. Data controller

Associació Galacticat, tax ID G25774936, C/del Mig, 12, 25335 Penelles, Spain, is the data controller. Privacy contact: info@galacticat.cat. App support: portal@galacticat.cat.

The app’s technical design and development are provided under the XipApp trade name by Alex Colmenar Bofarull. Associació Galacticat remains the service owner, ticket seller and data controller.

2. Scope

This policy covers the main galacticat.cat website, the app.galacticat.cat portal and Galacticat mobile apps for iOS and Android that link to it. Each version only processes the data required for the features available in that version.

3. Purposes of processing

Providing the service and performing the contract: creating and managing accounts, processing purchases, delivering and recovering tickets, managing passes, resolving issues and enabling requested participation. Without essential data we cannot provide the relevant feature; browsing the programme does not require an account.

4. Data we process

Account: name, email, user ID, protected credentials, language and preferences; surname and town if provided. Purchases: products, sessions, amounts, discounts, payment status, references, tickets, passes and admission checks. We also process the email used for guest purchases.

Participation: votes, comments, reports and blocks. Communications: preferences by channel and purpose, device notification token, platform, environment, language, app version, last registration activity and delivery results. Support, accreditations and registrations: the data and messages you provide in the relevant forms.

Security: sessions, relevant actions and technical logs, which may include IP address and browser information. We do not request access to your address book, microphone, personal photos or device location to use the public app. Posters and venue locations are catalogue content, not data extracted from your device.

5. Legal bases

Consent: optional programme and promotional communications, according to the channel and purpose you accept. You can withdraw it without affecting the lawfulness of earlier processing or the use of basic features.

Legitimate interests: protecting accounts and purchases, preventing abuse and moderating content, using proportionate data and subject to your right to object. Legal obligations: invoicing, accounting and responding to valid legal requests. Reading this policy does not mean consenting to advertising.

6. Recipients and providers

We use hosting and infrastructure providers, Nominalia SMTP email and Apple Push Notification service (APNs) for iOS notifications. They receive the data necessary for their role. Web forms incorporating Cloudflare Turnstile use it to prevent automated submissions; it is not an advertising tracking feature of the app.

The Android version must identify its notification provider and any additional processing before enabling them. This policy does not declare Firebase or other Android services as active. We do not sell personal data. We may disclose data to authorities where legally required.

7. International transfers

Some providers, such as Stripe, Apple or Cloudflare, may process data outside the European Economic Area. Transfers must rely on an applicable adequacy decision or safeguards such as standard contractual clauses and, where appropriate, supplementary measures. You can request information about providers and applicable safeguards at info@galacticat.cat.

8. Purchases, guest tickets and linking

You can buy tickets as a guest with an email address for delivery. Passes require an account. The local wallet stores tickets and access keys in secure device storage. Email recovery uses a temporary link; do not share it.

Linking guest tickets to an account requires an authenticated session, verified email, proof of access to the purchase and explicit confirmation. It may update the ticket contact email, rotate the QR and revoke earlier guest access. Possessing a copy alone does not allow passes or tickets belonging to another account to be transferred.

Stripe processes payment in its own environment. Galacticat retains purchase references and status, but the card form is not sent to our servers. See https://stripe.com/privacy.

9. Ratings, comments and moderation

Your public name and comment are visible to other users when the comment is published. An automatic filter may publish it or hold it for human review. You can report content or block its author. The identity of the person reporting or blocking is not shown to other users; authorised staff handle issues. Do not post sensitive data or other people's personal data.

10. Communications and notifications

Purchase, recovery and security emails are service communications. Programme notifications and promotions are optional, with separate preferences. Push delivery also requires operating system permission; the app works without it.

In Account > Notifications you can withdraw consent for each category. The token and message are sent to the delivery service. Registration is linked to your account and a valid session; signing out stops eligibility. Deleting the account removes device registration and active preferences. Messages already delivered may remain visible on the device.

With your separate consent, we may send automatic rating reminders after screenings where your admission QR was scanned. We use the admission validation and screening schedule, not your device location. You can disable these reminders in Account > Notifications. General ratings are separate from audience award votes, which are available only during their voting period. Ratings are included in data exports and removed when you delete your account.

11. Local storage, cookies and tracking

The app stores language, appearance, catalogue cache and keys needed for sessions or tickets locally. It does not use advertising identifiers or combine data with other companies to track you for advertising. Consented promotions from Galacticat do not imply such tracking.

The portal uses cookies or storage needed for sessions and preferences. Additional cookies on the main website are governed by its consent manager and corresponding cookie policy. External content and payment pages have their own notices. This policy does not assume the app uses the main website's analytics cookies.

12. Data retention

Profile data is kept while the account is active; on deletion it is erased or pseudonymised as described below. Recovery tokens expire within the period stated in the message; expiry does not mean all technical records are immediately erased.

Necessary purchase, invoicing and audit data is retained for the periods required by tax and accounting obligations and to address liabilities or claims. The period depends on the document type and applicable obligation, not on whether the account exists. Support requests are kept to resolve them and address resulting liabilities; optional preferences are kept until changed or withdrawn.

Backups may retain earlier versions until securely retired. We do not promise immediate erasure of every backup; access is restricted and backups are not used to reactivate communications or deleted accounts. You can ask the privacy contact for retention criteria applicable to your data.

13. Rights and account deletion

You can request access, correction, erasure, objection, restriction and, where applicable, portability at info@galacticat.cat, or ask portal@galacticat.cat for help. We verify identity proportionately; do not send identity documents unless necessary and requested through an appropriate channel.

In the app you can edit your profile and start deletion at Account > Edit details > Delete account; data downloads are in Account > Privacy and data. If you no longer have the app, see https://app.galacticat.cat/legal/en/delete-account.html or request deletion by email. Verification prevents third parties from deleting other people's accounts.

Deletion revokes sessions, removes notification tokens, preferences, comments and votes, and pseudonymises the profile. Sales and audit records that must be retained remain; this is not absolute anonymisation of the entire history or a refund request. Contact support before deleting your account if you have unused tickets or passes, as you will lose account access to them.

You may complain to the competent data protection authority; in Spain, the Spanish Data Protection Agency (https://www.aepd.es), without prejudice to other competent authorities.

14. Children

The store age rating describes content; it does not replace legal requirements for consent to data processing or entering a contract. Where required, involvement of legal representatives must be established. We do not request children's sensitive data to browse the catalogue.

15. Security

We apply technical and organisational measures proportionate to risk, including encrypted connections, protected credentials, revocable sessions, limited permissions, audit logs, backups and abuse controls. No system is infallible; report incidents to portal@galacticat.cat without including passwords, recovery codes, QR codes or full card details.

16. Third-party content and external links

The website and apps may display third-party posters, photographs, synopses, maps or links. When you leave our services or open an external page, the third party’s notices apply. Review them before providing personal data.

17. Changes to this privacy policy

We will publish updates and their date here. If we introduce purposes or services that are incompatible with those described, or require new consent, we will request it before processing. Continued browsing does not replace specific consent.